93 lines
No EOL
2.3 KiB
Text
93 lines
No EOL
2.3 KiB
Text
# Exploit Title: Samsung SyncThruWeb SMB Hash Disclosure
|
|
|
|
# Date: 8/28/15
|
|
|
|
# Exploit Author: Shad Malloy
|
|
|
|
# Contact: http://twitter.com/SecureNM
|
|
|
|
# Website: https://securenetworkmanagement.com
|
|
|
|
# Vendor Homepage: http://www.samsung.com
|
|
|
|
# Software Link:
|
|
http://www.samsung.com/hk_en/consumer/solutions/type/SyncThruWebService.html
|
|
|
|
# Version: Known Vulnerable versions Samsung SCX-5835_5935 Series Printer
|
|
Main Firmware Version : 2.01.00.26
|
|
|
|
Samsung SCX-5635 Series Printer Main Firmware Version : 2.01.01.18
|
|
12-08-2009
|
|
|
|
|
|
|
|
# Tested on:
|
|
|
|
Samsung SCX-5835_5935 Series Printer
|
|
|
|
Main Firmware Version : 2.01.00.26
|
|
|
|
Network Firmware Version : V4.01.05(SCX-5835/5935)
|
|
12-22-2008
|
|
|
|
Engine Firmware Version : 1.20.73
|
|
|
|
UI Firmware Version : V1.03.01.55 07-13-2009
|
|
|
|
Finisher Firmware Version : Not Installed
|
|
|
|
PCL5E Firmware Version : PCL5e 5.87 11-07-2008
|
|
|
|
PCL6 Firmware Version : PCL6 5.86 10-28-2008
|
|
|
|
PostScript Firmware Version : PS3 V1.93.06 12-19-2008
|
|
|
|
SPL Firmware Version : SPL 5.32 01-03-2008
|
|
|
|
TIFF Firmware Version : TIFF 0.91.00 10-07-2008
|
|
|
|
Samsung SCX-5635 Series
|
|
|
|
Main Firmware Version : 2.01.01.18 12-08-2009
|
|
|
|
Network Firmware Version : V4.01.16(SCX-5635)
|
|
12-04-2009
|
|
|
|
Engine Firmware Version : 1.31.32
|
|
|
|
PCL5E Firmware Version : PCL5e 5.92 02-12-2009
|
|
|
|
|
|
PCL6 Firmware Version : PCL6 5.93 03-21-2009
|
|
|
|
|
|
PostScript Firmware Version : PS3 1.94.06 12-22-2008
|
|
|
|
TIFF Firmware Version : TIFF 0.91.00 10-07-2008
|
|
|
|
|
|
|
|
Proof of Concept
|
|
|
|
1. Using the default username and password (admin/admin), it is
|
|
possible to obtain all credentials used for SMB file transfer. To obtain the
|
|
file access http://<printer url>/smb_serverList.csv.
|
|
|
|
2. The UserName and UserPassword fields are unencrypted and
|
|
visible using any text editor.
|
|
|
|
|
|
|
|
Relevant Patches
|
|
|
|
http://downloadcenter.samsung.com/content/FM/201508/20150825111208555/SCX563
|
|
5_V2.01.01.28_0401113_1.00.zip
|
|
|
|
http://downloadcenter.samsung.com/content/FM/201508/20150825112233867/SCX583
|
|
5_5935_V2.01.00.56_0401113_1.01.zip
|
|
|
|
|
|
|
|
Shad Malloy
|
|
|
|
Secure Network Management, LLC |