-
Notifications
You must be signed in to change notification settings - Fork 13.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Grandstream UCM62xx IP PBX Websocket Blind SQL Injection Credential Dump #16087
Grandstream UCM62xx IP PBX Websocket Blind SQL Injection Credential Dump #16087
Conversation
Fix spelling
Spelling in the description
|
documentation/modules/auxiliary/scanner/http/grandstream_ucm62xx_sql_account_guess.md
Outdated
Show resolved
Hide resolved
documentation/modules/auxiliary/scanner/http/grandstream_ucm62xx_sql_account_guess.md
Outdated
Show resolved
Hide resolved
documentation/modules/auxiliary/scanner/http/grandstream_ucm62xx_sql_account_guess.md
Outdated
Show resolved
Hide resolved
documentation/modules/auxiliary/scanner/http/grandstream_ucm62xx_sql_account_guess.md
Outdated
Show resolved
Hide resolved
documentation/modules/auxiliary/scanner/http/grandstream_ucm62xx_sql_account_guess.md
Outdated
Show resolved
Hide resolved
modules/auxiliary/scanner/http/grandstream_ucm62xx_sql_account_guess.rb
Outdated
Show resolved
Hide resolved
modules/auxiliary/scanner/http/grandstream_ucm62xx_sql_account_guess.rb
Outdated
Show resolved
Hide resolved
modules/auxiliary/scanner/http/grandstream_ucm62xx_sql_account_guess.rb
Outdated
Show resolved
Hide resolved
modules/auxiliary/scanner/http/grandstream_ucm62xx_sql_account_guess.rb
Outdated
Show resolved
Hide resolved
modules/auxiliary/scanner/http/grandstream_ucm62xx_sql_account_guess.rb
Outdated
Show resolved
Hide resolved
Given this is an sqlite database consider usage of the library for injections see: #13847 |
modules/auxiliary/scanner/http/grandstream_ucm62xx_sql_account_guess.rb
Outdated
Show resolved
Hide resolved
modules/auxiliary/scanner/http/grandstream_ucm62xx_sql_account_guess.rb
Outdated
Show resolved
Hide resolved
modules/auxiliary/scanner/http/grandstream_ucm62xx_sql_account_guess.rb
Outdated
Show resolved
Hide resolved
modules/auxiliary/scanner/http/grandstream_ucm62xx_sql_account_guess.rb
Outdated
Show resolved
Hide resolved
modules/auxiliary/scanner/http/grandstream_ucm62xx_sql_account_guess.rb
Outdated
Show resolved
Hide resolved
modules/auxiliary/scanner/http/grandstream_ucm62xx_sql_account_guess.rb
Outdated
Show resolved
Hide resolved
modules/auxiliary/scanner/http/grandstream_ucm62xx_sql_account_guess.rb
Outdated
Show resolved
Hide resolved
modules/auxiliary/scanner/http/grandstream_ucm62xx_sql_account_guess.rb
Outdated
Show resolved
Hide resolved
modules/auxiliary/scanner/http/grandstream_ucm62xx_sql_account_guess.rb
Outdated
Show resolved
Hide resolved
# do a version check so the attacker doesn't waste their time | ||
if !check_version | ||
print_error('The reported version is not vulnable') | ||
return |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
return |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
On second inspection, it looks that this should be returning using return
otherwise we will attempt to exploit a target that we know isn't vulnerable.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
After the refactor this is now called vulnerable_version?
should that be check
and return CheckCode
values? Then it might be possible to use AutoCheck
.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Scanners don't use check, right?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Sorry I had missed the commend about if scanner
was the right place for this, I would suggest based on the functionality that this is more an auxiliary/gather
module as it does not really scan for things.
…asploit-framework into grandstream_CVE_2020_5724
Following @jmartin-r7's advice, I updated the module to use the sqli mixin which reduced/simplified the code quite nicely. I've update the documentation to show the new output. |
@jbaines-r7 Sorry for the delay on this whilst I was working on research, will get this reviewed today! |
modules/auxiliary/scanner/http/grandstream_ucm62xx_sql_account_guess.rb
Outdated
Show resolved
Hide resolved
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Overall looks good but I do have some minor edits and some concern r.e error handling around the WebSocket connections that should be addressed before we land this.
documentation/modules/auxiliary/scanner/http/grandstream_ucm62xx_sql_account_guess.md
Outdated
Show resolved
Hide resolved
modules/auxiliary/scanner/http/grandstream_ucm62xx_sql_account_guess.rb
Outdated
Show resolved
Hide resolved
modules/auxiliary/scanner/http/grandstream_ucm62xx_sql_account_guess.rb
Outdated
Show resolved
Hide resolved
modules/auxiliary/scanner/http/grandstream_ucm62xx_sql_account_guess.rb
Outdated
Show resolved
Hide resolved
Going to go ahead and fix all the minor issues so long, will leave WebSocket issue open though as thats a deeper issue to address. |
As per requests I made the following changes:
|
modules/auxiliary/gather/grandstream_ucm62xx_sql_account_guess.rb
Outdated
Show resolved
Hide resolved
…a so we know what we are failing on
For any future travelers, to decode WebSocket traffic in Wireshark, use the Looking at the PCAP was able to see the initial check using TCP stream 0 and then packets 800 and 801 show the successful and unsuccessful SQL injection attempts showing how it would be possible to blind SQLi and retrieve info. LGTM, will land this now. |
Release NotesA new module has been added which exploits CVE-2020-5724, a blind SQL injection in GrandStream UCM62xx IP PBX devices prior to firmware version 1.20.22 to dump usernames and passwords from the |
Description
This module uses a blind SQL injection (CVE-2020-5724) affecting the Grandstream UCM62xx IP PBX to dump the users table. As mentioned in my previous UCM62xx pull, there are a number of internet facing PBX still affected by this issue and presumably internal-only systems are even less likely to be patched.
The injection occurs over a websocket at the websockify URI. This is sort of neat from a module writing point of view since there are few (no?) examples of a stand-alone exploit/scanner using the websocket API (this statement could be wrong, but it looks right). That also increases the odds that I did it The Wrong Way™ but I'm sure ya'll will put me on the right path if so. The injection can occur when the user requests a challenge (as part of a challenge and response authentication scheme). The injection is blind, but the server response contains a different status code if the query was successful. As such, the attack can guess the contents of the user database. Most helpfully, the passwords are stored in cleartext within the user table (CVE-2020-5723).
This issue was patched in Grandstream UCM62xx IP PBX firmware version 1.20.22.
Final thought: I put this in auxiliary/scanner. I'm not sure that was correct. 🤷
Verification
List the steps needed to make sure this thing works
msfconsole
use auxiliary/scanner/http/grandstream_ucm62xx_sql_account_guess
set RHOST <ip>
run
PCAP || GTFO
The default settings has the web interface on 8089 using SSL. However, for the attached pcap I disabled SSL and dropped down to port 8080.
ucm62xx_websocket_blind_users_dump.zip
Video || GTFO
https://www.youtube.com/watch?v=1_k36LMoUoU