NetBT e-Fatura - Privilege Escalation

ExploitDBExploitDB exploitScannerEDB-52509

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a text file that demonstrates how to check for an unquoted service path vulnerability (CWE-428) in the NetBT e-Fatura InboxProcessor service. It provides commands to query the service configuration and check directory permissions, but contains no code to exploit the vulnerability or achieve privilege escalation.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence is a plaintext description of an unquoted service path vulnerability (CWE-428) in NetBT e-Fatura. It contains no executable code, no instructions for the reviewer to perform any action, and no concealed or deceptive payload. The content is limited to a vulnerability description, service configuration output, and access control check results.

ClassificationScanner
Model confidence95%
AuthenticationRequired
Languagesbatch
Target softwareNetBT e-Fatura
Attack typesprivilege_escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact only provides commands to query the service configuration and check directory permissions. It does not include any code to place a malicious executable, restart the service, or otherwise trigger the vulnerability. This is a detection/validation procedure, not an exploit.

exploits/multiple/local/52509.txt:21-43

Requirements

  • Local user access to the systemexploits/multiple/local/52509.txt:15
  • The InboxProcessor service must be installed and runningexploits/multiple/local/52509.txt:21
  • The service binary path must be unquoted and contain spacesexploits/multiple/local/52509.txt:28
  • The user must have write permissions to a parent directory in the unquoted pathexploits/multiple/local/52509.txt:36-43

Observed behavior

  • Queries the configuration of the InboxProcessor service using 'sc qc'exploits/multiple/local/52509.txt:21
  • Checks write permissions on the service binary directory using accesschk.exeexploits/multiple/local/52509.txt:36
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Description
CWE-428 Unquoted Search Path or ElementThe artifact describes a local privilege escalation vulnerability in NetBT e-Fatura where an unquoted service path could allow an unauthorized local user to execute arbitrary code.exploits/multiple/local/52509.txt:7-8exploits/multiple/local/52509.txt:15
Service Configuration
InboxProcessor service with binary path C:\inetpub\wwwroot\InboxProcessor\Netbt.Inbox.Process.exeThe service runs as LocalSystem and the binary path contains spaces without quotes, which is the basis for the described privilege escalation.exploits/multiple/local/52509.txt:21-33
Access Check Output
BUILTIN\Users has RW access to C:\inetpub\wwwroot\InboxProcessor\The accesschk output shows that the BUILTIN\Users group has read/write permissions on the service binary directory, which is a prerequisite for the described privilege escalation.exploits/multiple/local/52509.txt:36-46
Review boundaries

What the analysis did not establish

  • The artifact is a text file containing only commands and output; no executable code is present.
  • The analysis is based solely on the supplied text; no external tools or resources were used.
  • Review is limited to the single text file provided; no external resources or referenced tools (e.g., accesschk.exe) were inspected.
  • The artifact is a vulnerability description, not a proof-of-concept exploit payload; no executable behavior is present to analyze.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1