Update on CVE-2014-9141: Thomson Reuters Fixed Assets CS <= 13.1.4

Received notification from vendor today:

"We appreciate your report and attention on the connectbgdl.exe vulnerability.  We are scheduled to address this with our next major release, 2015.1.0, scheduled for November of 2015.  This will be our first opportunity to address it since it came to our attention following our last major release of 2014.1.0 in November of 2014.  As of this point in time, we have seen no reports of this vulnerability being exploited within our customers' systems."

This patch should be immediately applied when released. Steps to remediate this vulnerabilityshould be taken until the next major release.

Update on CVE-2015-2081 : Multiple Vulnerabilities in Datto Siris and Alto

Interesting post on the DATTO vulnerabilities we had discovered in February (and some additional items that were not covered in our post):

http://silentbreaksecurity.com/tearing-apart-a-datto/

Our investigation turned up a vulnerable webserver as well. As part of that, we investigated some of the pages and services available. We decided to keep these findings private with the vendor and publishing as a CVE at the time and we did so. As another security researcher has posted some of these findings as well and rooted the box publicly, we're releasing this as it's useful for remediation of additional issues that are present on the device.

The below pages and information were available from the webserver embedded, without authentication.

Potentially Dangerous Information Leakage:

/?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000 

/?=PHPE9568F36-D428-11d2-A769-00AA001ACF42

/?=PHPE9568F34-D428-11d2-A769-00AA001ACF42

/?=PHPE9568F35-D428-11d2-A769-00AA001ACF42

 All of these help determine what is running the webserver and versioning behind it.

/admin.php

/test.php

/esx.php

/home.php

/tech.php

/network.php

/report.php

/filters.php

/test.php

/status.php

/ticket.php

/ajax.php

/virtualization.php

/logout.php

/agent.php

/permissions.php

/push.php 

Session Expired when visited. This suggests the request is processed and the server may be vulnerable to cookie stealing or session hijacking 

 

/includes

/scripts

/registration

Access is Forbidden. Not a internal message or error, suggests the same finding as above. 

/lib

/log

/sc

/api

/vendor

/junk

Significant amount of PHP scripts for launching just about any function on the device, unauthenticated. Extremely critical to fix. Can be used to establish a reverse shell, a foothold in the server or any number of attacks against the device and data.

/status

Processes, blank page.

/tmp

Temp directory, reveals sensitive information. For example, the desktop screenshot gives username, system name, OS version, internal directory structure and software information

/cgi-bin

Internal 500 error. Useful if structure can be determined.

/images

Useful for determining what software and attack surfaces are available. For example, Ajax is vulnerable and it can be determined with this directory that it's installed and available.

/scripts/jquery.js

/index.php

/scripts/jquery-ui.js

/scripts/prototype.js

/log/

/scripts/scriptaculous.js

/scripts/setup.js

/scripts/common.js

/scripts/network.js

/scripts/base64.js

/scripts/adminSettings.js

/scripts/ga_stats.js

Can view/download JavaScript code, extremely useful for any number of attacks.

/index2.php

Reveals a lot of private information about the box. May be by design.

/about (and its subdirectories)

Significant amount of useful information for determining software loads, versioning

/branding

Empty. Available to view

/debian

internal structure, software loads and setup scripting.

/css

All of the css sheets. Very useful for a number of attacks. 

The vendor was made aware of these issues in February and stated they were working on remediation.

CVE-2015-2081: Multiple Vulnerabilities in DATTO Siris and Alto

# Exploit Title: Multiple Vulnerabilities in DATTO Siris and Alto

# Date: 2/26/15
# Exploit Author: singularitysec@gmail.com
# Vendor Homepage: http://www.datto.com
# Version: Siris and Alto Products
# Tested on: N/A
# CVE : 2015-2081

Product Affected:
Datto Siris and Datto Alto Physical and Virtual Devices
 
These vulnerabilities have been reference checked against multiple installs. This configuration was identical across all systems and each version encountered.

Vulnerabilities:

1. VNC is enabled on the devices by default and has a static password used by the vendor.

Update: Vendor acknowledges this issue and has stated that the end users can (and should) change the VNC password inside of the administration console.

2. The version of PHP installed on the devices is a known vulnerable install with multiple vulnerabilities and vectors for attack. (PHP 5.3.2)

Update: Vendor acknowledges this issue and has stated that the versions in use are being addressed in a future release.

3. Multiple Web Virtual Directories leak sensitive information about data,  software versions, virtual machines running on the devices and configuration information via unauthenticated access to the installed webserver.

Update: Working with vendor on this issue.

4. Remote Code Execution can be accomplished by executing PHP scripts available to an unauthenticated user accessing the vulnerable webserver.

Update: Working with vendor on this issue.

5. Device/VM restore mount points allow unauthenticated access to them by default, allowing a remote attacker to access sensitive information and data.

Update: Vendor acknowledges this issue and has stated that the end users can (and should) apply an ACL to the folders created inside of the administration console.


Vendor Alerted 2-26-15 

Vendor Contact 2-26-15 to address issues and handoff initial findings.


Remediation:

Working with vendor on remediation for multiple issues.

1. Change the password for the VNC server to a suitably complex password or disable the service.
2. Implement complementary controls to detect or prevent attacks against the vulnerable attack service.
3. No update. Apply vendor patch when it is distributed.
4. No update. Apply vendor patch when it is distributed.
5. Apply an Access Control List to the folders during/after creation and restoration.Note: Information on these vulnerabilities will be updated as communication with the vendor continues.                                                                                   

Website: www.information-paradox.net

This vulnerability was discovered by singularitysec@gmail.com. Please credit the author in all references to this exploit.

OCLHASHCAT - Cracking passwords with a low-cost GPU - Preview

This was all done with a low-cost GPU (graphics card), a dictionary list and a laptop.

I benchmarked the stats on a standard mobile workstation as well, these are the results from an MD5 password list:

Dictionary Attack:

Session.Name...: oclHashcat
Status.........: Exhausted
Input.Mode.....: File (/****/Desktop/rockyou.txt)
Hash.Target....: File (/****/Desktop/hashes)
Hash.Type......: MD5
Time.Started...: Mon Jan 19 19:13:41 2015 (4 secs)
Time.Estimated.: 0 secs
Speed.GPU.#1...:  3631.2 kH/s
Recovered......: 11/12 (91.67%) Digests, 0/1 (0.00%) Salts
Progress.......: 14343297/14343297 (100.00%)
Skipped........: 0/14343297 (0.00%)
Rejected.......: 1599/14343297 (0.01%)
HWMon.GPU.#1...:  0% Util, 60c Temp, 48% Fan


11/12 passwords in 4 seconds, all from a commonly used password list that was hashed and the standard "rockyou.txt" dictionary file that is widely distributed.

Brute Force


Session.Name...: oclHashcat
Status.........: Running
Input.Mode.....: Mask (?1?2?2?2?2?2) [6]
Hash.Target....: File (/****/Desktop/hashes)
Hash.Type......: MD5
Time.Started...: Mon Jan 21 19:15:33 2015 (18 secs)
Time.Estimated.: Wed Jan 21 19:16:11 2015 (14 secs)
Speed.GPU.#1...:   114.5 MH/s
Recovered......: 4/12 (33.33%) Digests, 0/1 (0.00%) Salts
Progress.......: 2101215232/3748902912 (56.05%)
Skipped........: 0/2101215232 (0.00%)
Rejected.......: 0/2101215232 (0.00%)
HWMon.GPU.#1...: 94% Util, 61c Temp, 50% Fan

4 passwords from the same list in 18 seconds using brute force and the same password list.

Most of the others finished in under an hour or so, longer passwords took under 4 hours.

I'll be posting more detailed data shortly, along with a detailed post about this. It's nothing new or groundbreaking, just an example of how easy it is to defeat password encryption these days. You can do the same for PDF documents and ZIP files, amongst others.

Most sites use MD5 or SHA1 to hash their passwords. Of those, quite a few are using unsalted hashes.

If you're not using stronger hash algorithms, it's an invitation for disaster.

Updates on CVE-2014-9113 and CVE-2014-9141

Quick update on the two CVE's that were published recently:

CVE-2014-9113

A security update has been released on 12/03/2014 to address the vulnerability in CCH Wolters Kluwer ProSystem fx Engagement. This update corrects the permissions on necessary application services. Please see the online release bulletin for instructions on how to apply the security update.

https://support.cch.com/updates/Engagement/pdf/Services%20Security%20Update%20-%20Release%20Bulletin%20-%20US.pdf


CVE-2014-9141

Contact with vendor has been made. Formal acknowledgement of the issue has not occurred. Detailed documentation of the vulnerability was provided. Documentation demonstrated successful exploitation using the standard installer package and instructions.

Thomson Reuters has changed the support person responsible but have not heard from the newly assigned personnel. Follow up has been requested several times, no change in status since initial report

CVE-2014-9141: Thomson Reuters Fixed Assets CS <= 13.1.4

# Exploit Title: Thomson Reuters Fixed Assets CS <=13.1.4 Local Privilege Escalation/Code Execution

# Date: 12/1/14
# Exploit Author: singularitysec@gmail.com
# Vendor Homepage: https://cs.thomsonreuters.com
# Version: Fixed Assets CS <=13.1.4 Local Privilege Escalation/Code Execution
# Tested on: Windows XP -> Windows 7, Windows 8
# CVE : 2014-9141

Product Affected:
Fixed Assets CS <=13.1.4 (Workstation Install)

Note: 2003/2008 Terminal Services/Published apps *may* be vulnerable, depending on system configuration.
 
This vulnerability has been reference checked against multiple installs. This configuration was identical across all systems and each version encountered.

Executables/Services:
C:\WinCSI\Tools\connectbgdl.exe

Attack Detail:

The Fixed Assets CS installer places a system startup item at C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup

Which then executes the utility at C:\WinCSI\Tools\connectbgdl.exe.

The executables that are installed, by default, allow AUTHENTICATED USERS to modify, replace or alter the file. This would allow an attacker to inject their code or replace the executable and have it run in the context of an authenticated user.

An attacker can use this to escalate privileges to the highest privileged level of user to sign on to the system. This would require them to stop the vulnerable executable or reboot the system. The executable appears to only allow on instance to be executed at a time by default, the attacker would need to restart or kill the process. These are the default settings for this process.

This could compromise a machine on which it was installed, giving the process/attacker access to the machine in question or execute code as that user. An attacker can replace the file or append code to the executable, reboot the system or kill the process. It would then compromise the machine when a higher privileged user (ex. administrator) logged in.

This affects workstation builds. It may be possible on legacy servers/published application platforms but this was not tested.

Remediation:
 
Remove the modify/write permissions on the executables to allow onlyprivileged users to alter the files.
Apply vendor patch when distributed.

Vulnerability Discovered: 11/27/2014
Vendor Notified: 12/1/2014
                                                                                        

Website: www.information-paradox.net

This vulnerability was discovered by singularitysec@gmail.com. Please credit the author in all references to this exploit.

CVE-2014-9113 : CCH Wolters Kluwer PFX Engagement <= v7.1 Local Privilege Escalation

Product Affected:

CCH Wolters Kluwer PFX Engagement <= v7.1

This vulnerability has been reference checked this against multiple installs. This configuration was identical across all systems and each version encountered.

Executables/Services:

Pfx.Engagement.WcfServices

PFXEngDesktopService

PFXSYNPFTService

P2EWinService

Attack Detail:

The PFX services for engagement install with LOCAL SYSTEM service credentials in the directory C:\PFX Engagement\

 

The executables that are installed, by default, allow AUTHENTICATED USERS to modify, replace or alter the file. This would allow an attacker to inject their code or replace the executable and have it run in the context of the system.

This would allow complete compromise of a machine on which it was installed, giving the process LOCAL SYSTEM access to the machine in question. An attacker can replace the file or append code to the executable, reboot the system or restart the service and it would then  compromise the machine. As LOCAL SYSTEM is the highest privilege level on a machine, this allows total control and access to all parts of the system. This affects both the server and workstation builds.

Remediation:

Remove the modify/write permissions on the executables to allow only privileged users to alter the files.
Apply vendor patch when distributed.

Vulnerability Discovered: 11/26/2014

Vendor Notified: 11/26/2014

Vendor states this will be patched with next software update.

Website: www.information-paradox.net
This vulnerability was discovered by singularitysec@gmail.com. Please credit the author in all references to this exploit.

  


A security update has been released on 12/03/2014 to address the vulnerability in CCH Wolters Kluwer ProSystem fx Engagement. This update corrects the permissions on necessary application services. Please see the online release bulletin for instructions on how to apply the security update.

https://support.cch.com/updates/Engagement/pdf/Services%20Security%20Update%20-%20Release%20Bulletin%20-%20US.pdf