Empirum Password Obfuscation

2013.02.16
Credit: otr
Risk: High
Local: Yes
Remote: No
CVE: N/A
CWE: N/A

# Vuln Title: Empirum Password Obfuscation Design Flaw # Date: 20.12.2012 # Author: otr # Software Link: http://www.matrix42.com/products/workplace-automation-empirum/ # Version: 14.0 # Tested on: Windows # CVE : To be assigned # Risk: medium # Type: Privilege Escalation # Vendor: Matrix42 # STATUS: final Timeline: 2012-12-20 Flaw Discovered 2013-01-08 Vendor contacted 2013-01-14 Vendor contacted (again) 2013-02-08 Vendor contacted (again) 2013-02-13 No response from vendor 2013-02-13 Public disclosure Summary: The Empirum software from Matrix42 is prone to a trivial password recovery attack that allows users to obtain passwords encrypted with the EmpCrypt.exe. Context: Empirum is a product that featues software management and OS installation over the network. For the network installation feature Empirum uses a combination of bootp/tftp (PXE) and smb (or http/https). The Empirum server serves two hidden shares via SMB. These are EMPINST$ and CONFIGURATOR$. The two shares contain OS images, software management files and configuration files. The Empirum agent which is installed on the client workstations uses these configuration files in order to install the operating system, configure it and manage the workstation (e.g. install patches). Design Flaw: The Empirum ini configuration files on the CONFIGURATOR$ share which define several settings used by the Empirum Agent also define passwords for use in Empirum. These are the following SETUP, MD5, EIS and SYNC. The MD5 password is an unsalted raw MD5 hash of the password. The SETUP, EIS, and SYNC passwords use other obfuscation methods. The SETUP, EIS, and SYNC Passwords can be prepared by the Empirum Administator using the EmpCrypt.exe tool which is part of Empirum. It was found that sometimes all of the four password values in the configuration file are an obfuscation of the same password (it was not verified if this is always the case). The SETUP password uses a kind of obfuscation that can easily be deobfuscated using a modified EmpCrypt.exe tool. The hashing algorithms of the SETUP/EIS and SYNC passwords were not analyzed in detail, but apparently SETUP and EIS passwords are hashed passwords. For different input values they have a constant length output value. It was not verified if cryptographically secure hashing algorithms are used. SETUP passwords are not hashes (the length of the SETUP values is variable) but some form of encoding. The EmpCrypt.exe tool already contains functionality to decrypt SETUP passwords which is not exposed via the command line interface. Using a reverse engineering and binary patching it is possible to create a version of EmpCrypt.exe that decodes SETUP passwords. There may be simpler ways to archeive this e.g. an undocumented command line parameter. The decoded password can be used by an attacker to perform various attacks inside of a windows domain, as pass the hash to other systems or privilege escalations. It may also disclose internal password policies or password creation patterns. That allow the attacker to perform further password cracking. Example: Empcrypt.exe /SETUP "ABC -> copies password "*YZXZ" into clipboard EmpDecrypt.exe /SETUP "*YZXZ" -> copies "ABC" into clipboard Empcrypt to EmpDecrypt binary patch: EmpDecrypt.exe is a patched EmpCrypt.exe at the following code: loc_4020FB: mov esi, 0Fh mov [ebp+var_1C], esi mov [ebp+var_20], ebx [...] cmp [ebp+var_4F], bl jnz loc_402284 <- in the original code this was jz Or in hex encoding: # diff <(xxd -c 16 EmpCrypt.exe) <(xxd -c 16 EmpDecrypt.exe) < 0001510: 45fc 01e8 5815 0000 385d b10f 8463 0100 E...X...8]...c.. --- > 0001510: 45fc 01e8 5815 0000 385d b10f 8563 0100 E...X...8]...c.. Fix: In Windows environment the active directory and domain structure (kerberos) may be used in order to handle authentication and avoid storing weakly obfuscated passwords accessible to workstations.

References:

http://www.matrix42.com/products/workplace-automation-empirum/


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top