Canon Driver Privilege Escalation

Canon TR150 print drivers versions 3.71.2.10 and below allow local users to read/write files
within the "CanonBJ" directory and its subdirectories. By overwriting the DLL at
C:\ProgramData\CanonBJ\IJPrinter\CNMWINDOWS\Canon TR150 series\LanguageModules\040C\CNMurGE.dll
with a malicious DLL at the right time whilst running the C:\Windows\System32\Printing_Admin_Scripts\en-US\prnmngr.vbs
script to install a new printer, a timing issue can be exploited to cause the PrintIsolationHost.exe program,
which runs as NT AUTHORITY\SYSTEM, to successfully load the malicious DLL. Successful exploitation
will grant attackers code execution as the NT AUTHORITY\SYSTEM user.

This module leverages the prnmngr.vbs script
to add and delete printers. Multiple runs of this
module may be required given successful exploitation
is time-sensitive.