- Ubiquiti ap dropbear ssh vulnerability cracked#
- Ubiquiti ap dropbear ssh vulnerability manual#
- Ubiquiti ap dropbear ssh vulnerability upgrade#
- Ubiquiti ap dropbear ssh vulnerability password#
Mit Ihrer Einwilligung erklären Sie sich auch mit der Verarbeitung Ihrer Daten in den USA einverstanden.Ubiquiti, a global networking technology company came onto the mainstream marketplace beginning in 2005 with a clever idea of offering products at low prices to mass markets guiding channel players to monetize their services instead of the hardware. eines heimlichen Datenzugriffs durch US-Behörden verbunden ist. Rechtsgrundlage für die Datenverarbeitung: freiwillig, jederzeit widerrufbare Einwilligungįolgen der Nichteinwilligung: Keine unmittelbaren Auswirkung auf die Funktion der Website jedoch eingeschränkte Möglichkeiten zur Weiterentwicklung und Fehleranalyseĭatenübermittlung in die USA: Ihre Daten werden durch den Anbieter Google in den USA verarbeitet, was mit entsprechenden Risiken, z. Gemeinsamer Verantwortlicher: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland Speicherdauer: Daten auf ihrem Endgerät bis zu zwei Jahre. Verarbeitungsvorgänge: Erhebung von Zugriffsdaten, Daten ihres Browsers und Daten über die aufgerufenen Inhalte Ausführung von Analysesoftware und Speicherung von Daten auf ihrem Endgerät, Anonymisierung der erhobenen Daten Auswertung der anonymen Daten in Form von Statistiken Zweck: Fehleranalyse, statistische Auswertung unserer Webseitenzugriffe, Kampagnenanalyse, Conversiontracking, Retargeting This version was the latest at the time the security vulnerabilities were discovered. Ubiquiti Networks UniFi Cloud Key version 0.5.9/0.6.0 has been tested. $ /usr/bin/sudo /sbin/ubnt-systool chpasswd
Ubiquiti ap dropbear ssh vulnerability password#
With the following commands one can change the root password without actually knowing it: Www-data ALL=NOPASSWD:/sbin/ubnt-systool, /usr/bin/apt-get, /usr/sbin/service unifi *, /usr/bin/java
Ubiquiti ap dropbear ssh vulnerability cracked#
The root password hash in /etc/shadow is SHA-512 hashed, but in system.cfg the same password is just MD5 hashed and can be cracked easily in reasonable time.īecause of the following line in /etc/sudoers.d/cloudkey-webui one can elevate the rights of www-data to root: $ cat system.cfg | grep "users\.1\.password" To hijack the cloud account, steal username and password hash:
Ubiquiti ap dropbear ssh vulnerability upgrade#
To ‘hide’ the command from the eyes of the user in the upgrade window, one can also decorate the link: The following link opens a reverse-shell: The following PHP snipplet is responsible for the command execution:Įxec(CMD_WGET. This is possible because some binaries can be executed with sudo by this user without the root password.ġ) Authenticated Command Injection & Cloud-User Hash Leak The password of the root user can be changed by a lower privileged user on the device.
This configuration can be read by the user “A remote-configuration of the wireless lan of the user is now possible for an attacker.
This configuration file consists the username and the password hash of the cloud user which is the same on all access points and the UniFi Cloud Key. The hashes are stored in “system.cfg” using only MD5 hashing algorithm which can be cracked easily in reasonable time. Since the UniFi Cloud Key has to communicate with the access points and configure their passwords as well, a hash has to be stored at another place than /etc/shadow to persist the keys on the devices. The web user is “www-data” which has only few access and execution rights but by exploiting vulnerability 2) it is possible to gain root access on the device!Īfter a successful command injection the cloud user account password hash can be dumped.
Ubiquiti ap dropbear ssh vulnerability manual#
The manual UniFi Cloud Key firmware upgrade function is prone to a command injection vulnerability which can be exploited for example by sending a manipulated upgrade link to a victim.Ī reverse-shell can be used to get access to the device and this allows an attacker to get access to the internal network of the attacked user. SEC Consult recommends not to use this device in production until a thorough security review has been performed by security professionals and all identified issues have been resolved.ġ) Authenticated Command Injection & Cloud User Weak Crypto Our technology platforms focus on delivering highly advanced and easily deployable solutions that appeal to a global customer base in underserved and underpenetrated markets.” “Ubiquiti Networks develops high-performance networking technology for service providers and enterprises.
0 kommentar(er)
