Privilege escalation MitraStar routers

vendor:

DSL-100HN-T1 and GPT-2541GNAC (HGU)

by:

j0lama

8,8

CVSS

HIGH

Bad SSH Configuration

287

CWE

Product Name: DSL-100HN-T1 and GPT-2541GNAC (HGU)

Affected Version From: ES_113WJY0b16 (DSL-100HN-T1) and 1.00(VNJ0)b1 (GPT-2541GNAC)

Affected Version To: N/A

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2017

Privilege escalation MitraStar routers

SSH has a bad configuration that allows execute commands when you connect avoiding the default shell that the manufacturer provide us. This give us a shell with root permissions. Note: the password for 1234 user is under the router. You can copy all file system to your local machine using scp. In some of the MitraStar routers there is a zyad1234 user with password zyad1234 that have the same permissions of the 1234 user (root).

Mitigation:

In the latest firmware versions this have been fixed. If you try to execute scp, the router's configuration file will be copy to your computer instead of any file as occurred before.

Source

Exploit-DB raw data:

# Exploit Title: Privilege escalation MitraStar routers
# Date: 28-10-2017
# Exploit Author: j0lama
# Vendor Homepage: http://www.mitrastar.com/
# Provider Homepage: https://www.movistar.com/
# Models affected: MitraStar DSL-100HN-T1 and MitraStar GPT-2541GNAC (HGU)
# Software versions: ES_113WJY0b16 (DSL-100HN-T1) and 1.00(VNJ0)b1 (GPT-2541GNAC)
# Vulnerability analysis: http://jolama.es/temas/router-attack/index.php

Description
-----------
SSH has a bad configuration that allows execute commands when you connect avoiding the default shell that the manufacturer provide us.

$ ssh 1234@ip /bin/sh

This give us a shell with root permissions.

Note: the password for 1234 user is under the router.

You can copy all file system to your local machine using scp.
In some of the MitraStar routers there is a zyad1234 user with password zyad1234 that have the same permissions of the 1234 user (root).


Solution
--------
In the latest firmware versions this have been fixed. 
If you try to execute scp, the router's configuration file will be copy to your computer instead of any file as occurred before.