Exploit-DB #35419
Description: Prolink PRN2001 - Multiple Vulnerabilities
Type: webapps
Platform: hardware
Date: 2014-12-02
Author: Herman Groeneveld

Exploit:
Exploit Title: Prolink PRN2001 Multiple Vulnerabilities

1. -Advisory Information-

Title: Prolink PRN2001 Multiple Vulnerabilities
Firmware: Ver 1.2
Firmware URL: http://www.prolink2u.com/download/fw/fw_PRN2001_V1.2_20130323.zip
Vendor Homepage: http://www.prolink2u.com/
Author: Herman Groeneveld aka sh4d0wman
Tested On: Windows 7 / Kali
Date published: Dec 01 2014
Release mode: Coordinated release

2. -Vulnerability Information-

PROLiNK® PRN2001 Wireless- N Broadband AP / Router is the ideal wireless solution most suited for home and small-businesses. Designed to support wireless speeds of up to 150Mbps, the PRN2001 offers stellar performance on the 2.4GHz frequency band. This top-notch home networking device functions as an Access Point, Router or a Universal Repeater.

Multiple vulnerabilities have been discovered in this router. The majority require a valid account on the device to exploit. Default credentials are: admin/password

In the default configuration all vulnerabilities are restricted to exploitation over the LAN/WLAN interfaces. A successful compromise would give an attacker full control over the device. This would enable an attacker to enable remote device management over the WAN interface. 


3. - Technical Description / Proof of Concept Code -

Introduction:

The following type of vulnerabilities have been discovered in the device:
- 3.1: CWE-286: Incorrect User Management
- 3.2: CWE-668: Exposure of Resource to Wrong Sphere
- 3.3: CWE-200: Information Exposure
- 3.4: CWE- 80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
- 3.5: CWE-730: OWASP Top Ten 2004 Category A9 - Denial of Service
- 3.6: CWE-933: OWASP Top Ten 2013 Category A5 - Security Misconfiguration


Technical Description:
--------------------------------------------------------------

3.1 -Class: CWE-286: Incorrect User Management- 

Description: insufficient separation of privileges. Any account with user-level privileges has the following privileges in the web-management interface:
- Create new users with administrative privileges 
- Upgrade the device firmware
- Download and upload configuration files

PoC: users could escalate their privileges by creating a new account.

--------------------------------------------------------------

3.2 -CWE-668: Exposure of Resource to Wrong Sphere-

Description: a user-level account is not restricted from exporting or importing a device configuration file. The configuration file "config.img" is stored as plain-text XML. This is the root cause for the following vulnerabilities:

---------------------------------------------------------------

Name: privilege escalation through device configuration file

Description: the plaintext XML configuration file leaks the administrative user and password of the device giving an attacker full control over the device. 

PoC: administrative accounts have Flag value 0x0:
<chain N="USERNAME_PASSWORD">
<V N="FLAG" V="0x0"/>
<V N="USERNAME" V="admin"/>
<V N="PASSWORD" V="password"/>
<V N="PRIORITY" V="0x2"/>
</chain>

---------------------------------------------------------------

Name: telnet privilege escalation through device configuration file

Description: in the plaintext XML configuration file any administrative user account is set to: <V N="PRIORITY" V="0x2"/>. When this value is changed to <V N="PRIORITY" V="0x1"/> the account gains the following additional command options in a telnet shell:

- chksum: Check sum checking. Syntax: chksum address length
- dhcp: Enable DHCP client
- disable: Turn off privileged commands
- enable: Turn on privileged commands
- loaddll: Unknown functionality / DoS: issuing loaddll crashes the device
- script: Run specified script
- system: Show general system information
- webdll: Unknown functionality
- xfile: File copy functionality
- xip: Resolve dns

--------------------------------------------------------------

3.3 -CWE-200: Information Exposure-

Description: the device is leaking various kinds of sensitive information which can aid the attacker in vulnerability discovery and/or escalate privileges.

Vulnerable Functions:

--------------------------------------------------------------

Name: configuration-file sensitive information disclosure

Description: the XML configuration file "config.img" can be exported by user-level accounts and is stored as plain-text. The following sensitive information is leaked:

Confidentiality Related:
- Plaintext administrative credentials 
- Plaintext user-level credentials
- Plaintext PPoE WAN credentials
- Plaintext WEP key | WPA PSK | WSC Pin

Device Integrity Related:
- Create, Modify or Delete accounts:
PoC: change anything inside the chain or delete the complete chain:
<chain N="USERNAME_PASSWORD">
<V N="FLAG" V="0x0"/>
<V N="USERNAME" V="admin"/>
<V N="PASSWORD" V="password"/>
<V N="PRIORITY" V="0x2"/>
</chain>

- Enabling Device Management over WAN:
PoC: modify NATRULE_INSRC_STATIC to allow web and or telnet device management over the WAN port.

- DNS traffic redirection:
PoC: modify DHCP Assigned DNS settings to point clients to a rogue DNS server.

--------------------------------------------------------------

Name: log-file sensitive information disclosure

Description: logging is disabled by default. When it is enabled any valid user-level or administrative accounts can view this log through the web-management interface. Invalid logon attempts show the username and invalid passwords in plaintext. If a user does misspell his password an attacker has a high chance of guessing the correct password.

Data Exposed:
- Usernames
- Passwords (partial)

--------------------------------------------------------------

Name: telnet sensitive information disclosure

Description: the telnet command "show web" lists the complete web structure which can aid an attacker in vulnerability discover