mdudek-ics/antiweb_testing-suiteSuite de herramientas que sacan partido del CVE-2017-9097 (+RCE)
A vulnerability has been found in ICS/OT-associated web applications running on Anti-Web servers (up to version 3.8.7). The vulnerabilities that have been identified affect several well-known manufacturers in the industrial process automation and telecommunications industry. These devices already had two similar and old CVEs (CVE-2010-4730 & CVE-2010-4733); after reporting, a third CVE (2017-9097) was obtained, and immediately the vendor released a patch. Immediately, others followed.
To have an approximate reference of the degree of exposure of these devices, we use the hosts indexed in Shodan, which are just over 800 potentially vulnerable devices.
Regarding the LFI that our tool seeks to exploit, the different affected vendors already have their respective official patches that counteract the vulnerability. Therefore, in a way, trying to exploit the flaw serves to corroborate the commitment of the operators and those responsible for these technologies, answering a fundamental question: "Have the corresponding patches been installed?"
One of the first tools seeks to exploit and corroborate the existence of an LFI. A second tool will try to take advantage of the LFI by taking the file where the credentials that give access to the web panel are stored, where the usernames are in plain text and the passwords are hashed with md5, which the tool will try to crack. And finally, a last tool that will exploit an RCE.
usr@pwn:~$ git clone https://github.com/ezelf/AntiWeb_testing-Suite
usr@pwn:~$ cd AntiWeb_testing-Suite
usr@pwn:~$ ls -l
total 16
drwxr-xr-x 4 root root 4096 sep 14 21:05 LFI
drwxr-xr-x 4 root root 4096 sep 14 21:05 RCE
-rwxrwxr-x 1 root root 1852 sep 24 08:42 README.md
drwxr-xr-x 3 root root 4096 sep 24 08:05 seekAndDestroy
It simply corroborates the existence of the LFI by checking some predefined paths and/or giving the user the possibility of passing their own path.
Optionally, one can pass it a (valid) session cookie.
usr@pwn:~$ python anti-web-v1.py --help
usage: anti-web.py [-h] [-v] --host HOST [--port PORT] [--file LFI]
[+] CVE: CVE-2017-9097
optional arguments:
-h, --help show this help message and exit
-v, --version show program's version number and exit
--host HOST host
--port PORT Set port (default = 80)
--file LFI Test LFI
-ck COOKIE Set Cookie
[+] Demo: anti-web.py --host 192.168.1.100 --port 80
This tool seeks to put the LFI to good use. To do so, it points to the file "/home/config/users.cfg" where the credentials that allow access to the web application are stored.
"Seek And Destroy" parses this file, identifies the hash that corresponds to the concatenation of the password and its user passed to the Md5 hash function. With precomputed lists, it will discover what is hidden behind these hashes.
You can attack a single host individually or a list of them.
usr@pwn:~$ python seekAndDestroy.py --help
usage: seekAndDestroy.py [-h] [-v] [--host HOST] [--list HOST_LIST]
[--port PORT]
[+] Obtain and break the credentials of your industrial control system .
optional arguments:
-h, --help show this help message and exit
-v, --version show program's version number and exit
--host HOST host
--list HOST_LIST hosts
--port PORT set port (default = 80)
[+] Usage: seelAndDestroy.py --list host_list.txt --port 8080
And we come to what is perhaps the most interesting one: the possibility of executing operating system commands on the hardware that supports the vulnerable system. *** "Del Http a la Shell" ***
.
#### continuara... (mañana es lunes. xd)
usr@pwn:~$ python rce.py --help
usage: RCE.py [-h] [-v] --host HOST [--port PORT] -ck COOKIE --cmd COMMAND
[+] COMMANDS over your industrial control system .
optional arguments:
-h, --help show this help message and exit
-v, --version show program's version number and exit
--host HOST Host
--port PORT Port
-ck COOKIE Cookie
--cmd COMMAND Command
[+] Demo: python rce.py --host <host> -ck <sessionCookie> --cmd "ls -la /"
....Wait
* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9097
* https://ics-cert.us-cert.gov/advisories/ICSA-17-222-05
* https://www.seebug.org/vuldb/ssvid-96555 (RCE)
* https://www.seebug.org/vuldb/ssvid-96556 (LFI)
* https://vuldb.com/es/?id.102570
* https://github.com/hoytech/antiweb/
* https://nvd.nist.gov/vuln/detail/CVE-2017-9097
* https://www.9165619.com/vulnerability/cve-2017-9097-89702
* http://old.cnnvd.org.cn/vulnerability/show/cv_id/2017051027
* http://jvndb.jvn.jp/ja/contents/2017/JVNDB-2017-005240.html
* http://plugins.openvas.org/nasl.php?oid=106886 (*down)
* http://webcache.googleusercontent.com/search?q=cache:Z1VaYjaZLB4J:plugins.openvas.org/nasl.php%3Foid%3D106886+&cd=1&hl=es-419&ct=clnk&gl=cl
''' [+] CVE-2009-4462 ( Intellicom NetBiterConfig.exe ) [+] CVE-2009-4463 ( Intellicom NetBiterConfig.exe ) (http://blog.48bits.com/exposing-hms-hicp-protocol-0day-light/)
[+] CVE-2010-4730 ( Directory traversal vulnerability in cgi-bin/read.cgi in WebSCADA )
[+] CVE-2010-4731 ( Absolute path traversal vulnerability in cgi-bin/read.cgi in WebSCADA )
[+] CVE-2010-4732 ( RCE, using a config.html 2.conf action to replace the logo page's GIF image file )
[+] CVE-2010-4733 ( default username and password to obtain superadmin access via the web interface )
Intellicom NetBiter products based on the NB100 and NB200 platforms, including:
WebSCADA (WS100)
WebSCADA (WS200)
Easy Connect (EC150)
Modbus RTU – TCP Gateway (MB100)
Serial Ethernet Server (SS100).
* https://ics-cert.us-cert.gov/advisories/ICSA-10-316-01A
'''
The tools in question are in (AntiWeb_testing-Suite): https://github.com/ezelf/AntiWeb_testing-Suite/
Video that combines the three tools in their first beta version: https://www.youtube.com/watch?v=HdkZA1DO08Y