usage: exploit.py [-h]
[--action {LaunchElevatedRequest,FixDirectoryPrivilegesRequest,CreateDirectoryRequest,QueryProcessInfoRequest,InstallServiceRequest,DeleteServiceRequest,MoveAndVerifyGlobalDependencyRequest}]
target
positional arguments:
target
optional arguments:
-h, --help show this help message and exit
--action {LaunchElevatedRequest,FixDirectoryPrivilegesRequest,CreateDirectoryRequest,QueryProcessInfoRequest,InstallServiceRequest,DeleteServiceRequest,MoveAndVerifyGlobalDependencyRequest}
该工具利用了调用敏感 GalaxyClientService 方法时缺少身份验证的漏洞。尝试 FixDirectoryPrivilegesRequest（授予 EVERYONE 对目标文件的访问权限）或 CreateDirectoryRequest（在目标位置创建目录）以查看实际效果。