CVE-2020-28148

A common way to attack WIFI, not only applicable to Xinrui (a subsidiary of Sangfor) WIFI products. Through multiple offensive and defensive engagements, it has been found that this exploitation method can bypass multiple AC vendors.

This article is intended to disclose the exploitation method. Do not use the vulnerability for illegal attacks. The author is not responsible for any actions taken by others.

English: https://github.com/fengchenzxc/CVE-2020-28148/blob/main/CVE-2020-28148(English).md

Xinrui WIFI Authentication Bypass Vulnerability 0day

Introduction

This scenario involves Xinrui (wholly-owned subsidiary of Sangfor) AP3600 and AC6600, with the portal authentication system and AC management web system both updated to the latest versions. Other products have not been tested.

The WIFI distribution is shown in the figure. WIFIs starting with "office" are office WIFIs, among which:

• xxxx is used by internal employees and requires WPA/WPA2 password authentication followed by portal authentication on the login page;
• guest is an open guest WIFI, requiring visitors to enter their name and phone number to generate a QR code, which is then scanned by internal employees before using the WIFI;
• partner is for partner WIFI, requiring WPA password authentication followed by secondary authentication.

Vulnerability Details:

Connect to the WIFI "office-xxxx" with a password. Current IP is 10.3.163.121, MAC address is 3C-22-FB-07-A4-CA.

At this point, accessing any page redirects to the internal employee authentication interface:

Scan the current subnet and discover a host as follows:

Modify the local MAC address: sudo ifconfig en0 ether A4:C3:F0:C3:9C:B8

Check the current address; the IP is automatically assigned to 10.3.163.210.

Now access the WIFI authentication interface. It is found that the portal authentication has been bypassed and login is successful, granting access to the internal network!

More critically, when connecting to the office-guest open guest WIFI (which does not require a password), an attacker can also scan the subnet and modify the MAC address to bypass authentication.

Modify the MAC address:

sudo ifconfig en0 ether 38:BA:F8:32:5C:F8