Contact

Exploit Analysis: Bonjour Service – ‘mDNSResponder.exe’ Unquoted Service Path- EDB-ID: 52061

The Bonjour Service, specifically the mDNSResponder.exe executable, has a vulnerability related to an unquoted service path. This type of vulnerability can be exploited to escalate privileges on a Windows system. The exploit targets systems where Bonjour Service is installed and running, potentially affecting a wide range of applications that use Bonjour for network discovery and communication.

Technical Details

The core of this vulnerability lies in the way the Windows operating system handles service paths that contain spaces and are not enclosed in quotes. If a service path is unquoted, a local attacker could insert a malicious executable in a path that precedes the actual service executable. When the service is started, Windows will execute the attacker’s code with the privileges of the service.

 


# Exploit Title: Bonjour Service - 'mDNSResponder.exe' Unquoted Service
Path
# Discovery by: bios
# Discovery Date: 2024-15-07
# Vendor Homepage: https://developer.apple.com/bonjour/
# Tested Version: 3,0,0,10
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Microsoft Windows 10 Home# Step to discover Unquoted Service Path:C:\>wmic service get name,displayname,pathname,startmode |findstr /i “auto”
|findstr /i /v “c:\windows\\” |findstr /i /v “””
Bonjour Service
Bonjour Service
C:\Program Files\Blizzard\Bonjour Service\mDNSResponder.exe
Auto

C:\>systeminfo

Host Name: DESKTOP-HFBJOBG
OS Name: Microsoft Windows 10 Home
OS Version: 10.0.19045 N/A Build 19045

PS C:\Program Files\Blizzard\Bonjour Service> powershell -command
“(Get-Command .\mDNSResponder.exe).FileVersionInfo.FileVersion”
>>
3,0,0,10

#Exploit:

There is an Unquoted Service Path in Bonjour Services (mDNSResponder.exe) .
This may allow an authorized local user to insert arbitrary code into the
unquoted service path and escalate privileges.


If an attacker places a malicious executable at C:\Program.exe, the system might execute C:\Program.exe instead of C:\Program Files\Bonjour\mDNSResponder.exe, leading to privilege escalation.

Exploit Scenario

  1. Preparation: The attacker needs to have local access to the target system.
  2. Insertion: The attacker places a malicious executable in a path that will be searched before the actual service executable. For instance, they might place a file named Program.exe in the root of the C: drive.
  3. Execution: When the Bonjour Service is started, the system executes the malicious Program.exe with the same privileges as the service, which could be LocalSystem, thereby granting the attacker elevated privileges.

Mitigation

To mitigate this vulnerability, ensure that all service paths are enclosed in quotes. This can typically be done by modifying the service configuration through the registry or using system configuration tools to update the service parameters.

Conclusion

The unquoted service path vulnerability in Bonjour Service’s mDNSResponder.exe is a critical issue that can lead to privilege escalation if exploited. It highlights the importance of proper service configuration and the need for vigilant system administration to prevent such security flaws.

Related Posts