exploit the possibilities

DASAN H660RM Information Disclosure / Hardcoded Key

DASAN H660RM Information Disclosure / Hardcoded Key
Posted Mar 26, 2019
Authored by Krzysztof Burghardt

DASAN H660RM allows for unauthenticated ping access, has a hardcoded key for encryption, and logs sensitive information into /tmp.

tags | exploit, bypass, info disclosure
advisories | CVE-2019-9974, CVE-2019-9975, CVE-2019-9976
MD5 | b6e3b7c7cce2ddb903a24032c5b296b1

DASAN H660RM Information Disclosure / Hardcoded Key

Change Mirror Download
Hi!

CVE-2019-9974: diag_tool.cgi on DASAN H660RM devices with firmware
1.03-0022 allows spawning ping processes without any authorization
leading to information disclosure and DoS attacks

Remote attacker could enumerate hosts on LAN interface sending
requests to /cgi-bin/diag_tool.cgi with ip parameter set to target IP
address. Lack of authorization in /cgi-bin/diag_get_result.cgi allow
retrieval of results. Each call to diag_get_result.cgi retrieves one
line of ping (or traceroute) output.

Same CGI script has another weakness, CWE-400: Uncontrolled Resource
Consumption, which allows memory memory exhaustion Denial of Service
(DoS) attack against device. Around 170 spawned ping processes is
enough to cause crash and reboot of router. PoC exploit available.

More: https://blog.burghardt.pl/2019/03/diag_tool-cgi-on-dasan-h660rm-devices-with-firmware-1-03-0022-allows-spawning-ping-processes-without-any-authorization-leading-to-information-disclosure-and-dos-attacks/


CVE-2019-9975: syslog_tool.cgi on DASAN H660RM devices with firmware
1.03-0022 uses a hard-coded key for logs encryption

DASAN uses a hard-coded key “dasanektks123” for logs encryption. Data
stored using this key can be decrypted by anyone able to access this
key.

More: https://blog.burghardt.pl/2019/03/syslog_tool-cgi-on-dasan-h660rm-devices-with-firmware-1-03-0022-uses-a-hard-coded-key-for-logs-encryption/


CVE-2019-9976: Boa Webserver on DASAN H660RM devices with firmware
1.03-0022 saves post data, including credentials, to /tmp/boa-temp

Exploitation is possible for users logged in over telnet of SSH. If
user logged though Web UI and until he make any other POST request,
his credentials can be retrieved with:

$ cat /tmp/boa-temp
StatusActionFlag=-1&Username=admin&Password=vertex25

More: https://blog.burghardt.pl/2019/03/boa-webserver-on-dasan-h660rm-devices-with-firmware-1-03-0022-saves-post-data-including-credentials-to-tmp-boa-temp/

BR,
--
Krzysztof Burghardt <krzysztof@burghardt.pl>
http://www.burghardt.pl/

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

July 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    34 Files
  • 2
    Jul 2nd
    15 Files
  • 3
    Jul 3rd
    9 Files
  • 4
    Jul 4th
    8 Files
  • 5
    Jul 5th
    2 Files
  • 6
    Jul 6th
    3 Files
  • 7
    Jul 7th
    1 Files
  • 8
    Jul 8th
    15 Files
  • 9
    Jul 9th
    15 Files
  • 10
    Jul 10th
    20 Files
  • 11
    Jul 11th
    17 Files
  • 12
    Jul 12th
    15 Files
  • 13
    Jul 13th
    2 Files
  • 14
    Jul 14th
    1 Files
  • 15
    Jul 15th
    20 Files
  • 16
    Jul 16th
    0 Files
  • 17
    Jul 17th
    0 Files
  • 18
    Jul 18th
    0 Files
  • 19
    Jul 19th
    0 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close