Tecnovision DLX Spot – SSH Backdoor Access

• Exploit Database
• 114 阅读

• 作者： Simon Brannstrom
  日期： 2017-05-19
• 类别：

  • remote
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/42753/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35

  # Exploit Title: DlxSpot - Player4 LED video wall - Hardcoded Root SSH Password. # Google Dork: "DlxSpot - Player4" # Date: 2017-05-14 # Discoverer: Simon Brannstrom # Authors Website: https://unknownpwn.github.io/ # Vendor Homepage: http://www.tecnovision.com/ # Software Link: n/a # Version: All known versions # Tested on: Linux # About: DlxSpot is the software controlling Tecnovision LED Video Walls all over the world, they are used in football arenas, concert halls, shopping malls, as roadsigns etc. # CVE: CVE-2017-12928 # Linked CVE's: CVE-2017-12929, CVE-2017-12930   # Visit my github page at https://github.com/unknownpwn/unknownpwn.github.io/blob/master/README.md for complete takeover of the box, from SQLi to root access. ###############################################################################################################################   Hardcoded password for all dlxspot players, login with the following credentials via SSH   username: dlxuser password: tecn0visi0n   Escalate to root with the same password.   TIMELINE: 2017-05-14 - Discovery of vulnerabilities. 2017-05-15 - Contacted Tecnovision through contact form on manufacturer homepage. 2017-06-01 - No response, tried contacting again through several contact forms on homepage. 2017-08-10 - Contacted Common Vulnerabilities and Exposures (CVE) requesting CVE assignment. 2017-08-17 - Three CVE's assigned for the vulnerabilities found. 2017-08-22 - With help from fellow hacker and friend, byt3bl33d3r, sent an email in Italian to the company. 2017-09-18 - No response, full public disclosure.   DEDICATED TO MARCUS ASTROM FOREVER LOVED - NEVER FORGOTTEN