full-disclosure - [FD] [CVE-2018-15555 / 15556] Telus Actiontec WEB6000Q Local Privilege Escalation

Open Source and information security mailing list archives

Message-ID: <10595e7f-fefe-bee1-7670-823896cabe93@aklaus.ca>
Date: Sun, 9 Jun 2019 12:27:39 -0600
From: Andrew Klaus <andrew@...aus.ca>
To: fulldisclosure@...lists.org
Subject: [FD] [CVE-2018-15555 / 15556] Telus Actiontec WEB6000Q Local
 Privilege Escalation

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

###  Device Details
Discovered By: Andrew Klaus (andrew@...aus.ca)
Vendor: Actiontec (Telus Branded)
Model: WEB6000Q
Affected Firmware: 1.1.02.22

Reported: July 2018
CVE: CVE-2018-15555 (Main OS)
CVE: CVE-2018-15556 (Quantenna OS)

### Summary of Findings

Both “main” and “quantenna” have a UART header on the motherboard and
each of them provide full shell + bootloader access.

While the main OS has the credentials user: root pass: admin, the
quantenna environment can be accessed with user: root  with an empty
password.

I used a Raspberry Pi to interface with the UART header, but there are
USB UART adapters to do the same thing.

Once root access is obtained, TR-069 Updating can be fully disabled,
preventing the vendor from pushing updates to the device.

### Proof of Concept

Hooking up a Raspberry Pi's UART GPIO header to either UART header on
the modem will give a login prompt. root/admin  or root/(nopass)
depending on which modem header connected to.

### Enabling SSH daemon on Main OS

After retrieving a root shell on the main OS over UART, SSH can be
enabled by running the following:

# cli -s Device.X_ACTIONTEC_COM_RemoteLogin.Enable int 1
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
dropbear -p 22 -I 1800 &

$ ssh 192.168.1.2 -l admin -oKexAlgorithms=+diffie-hellman-group1-sha1
admin@....168.1.2's password:

BusyBox v1.17.2 (2016-02-03 21:34:18 PST) built-in shell (ash)
Enter 'help' for a list of built-in commands.
#

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives