Samsung SyncThruWeb 2.01.00.26 – SMB Hash Disclosure - 体验盒子

作者： Shad Malloy

日期： 2015-08-29

类别：

webapps

平台：

hardware

来源：https://www.exploit-db.com/exploits/38004/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

# Exploit Title: Samsung SyncThruWeb SMB Hash Disclosure

# Date: 8/28/15

# Exploit Author: Shad Malloy

# Contact: http://twitter.com/SecureNM

# Website: https://securenetworkmanagement.com

# Vendor Homepage: http://www.samsung.com

# Software Link:

http://www.samsung.com/hk_en/consumer/solutions/type/SyncThruWebService.html

# Version: Known Vulnerable versions Samsung SCX-5835_5935 Series Printer

Main Firmware Version : 2.01.00.26

Samsung SCX-5635 Series Printer Main Firmware Version : 2.01.01.18

12-08-2009

# Tested on:

Samsung SCX-5835_5935 Series Printer

Main Firmware Version :2.01.00.26

Network Firmware Version :V4.01.05(SCX-5835/5935)

12-22-2008

Engine Firmware Version :1.20.73

UI Firmware Version :V1.03.01.55 07-13-2009

Finisher Firmware Version :Not Installed

PCL5E Firmware Version : PCL5e 5.87 11-07-2008

PCL6 Firmware Version : PCL6 5.86 10-28-2008

PostScript Firmware Version : PS3 V1.93.06 12-19-2008

SPL Firmware Version : SPL 5.32 01-03-2008

TIFF Firmware Version : TIFF 0.91.00 10-07-2008

Samsung SCX-5635 Series

Main Firmware Version : 2.01.01.18 12-08-2009

Network Firmware Version : V4.01.16(SCX-5635)

12-04-2009

Engine Firmware Version : 1.31.32

PCL5E Firmware Version : PCL5e 5.92 02-12-2009

PCL6 Firmware Version : PCL6 5.93 03-21-2009

PostScript Firmware Version :PS3 1.94.06 12-22-2008

TIFF Firmware Version : TIFF 0.91.00 10-07-2008

Proof of Concept

1.Using the default username and password (admin/admin), it is

possible to obtain all credentials used for SMB file transfer. To obtain the

file access http://<printer url>/smb_serverList.csv.

2.The UserName and UserPassword fields are unencrypted and

visible using any text editor.

Relevant Patches

http://downloadcenter.samsung.com/content/FM/201508/20150825111208555/SCX563

5_V2.01.01.28_0401113_1.00.zip

http://downloadcenter.samsung.com/content/FM/201508/20150825112233867/SCX583

5_5935_V2.01.00.56_0401113_1.01.zip

Shad Malloy

Secure Network Management, LLC