FaceSentry Access Control System 6.4.8 SSH Hardcoded Credentials & Privilege Escalation (ZSL-2019-5526)

Vulnerability Title: FaceSentry Access Control System 6.4.8 SSH Root Access Exploit ID: ZSL-2019-5526 Type: Local/Remote Impact: System Access Risk: 5/5 Release Date: June 30, 2019 Summary: FaceSentry 5AN is a revolutionary smart identity management device that provides entry via biometric facial recognition, contactless smart cards, employee ID, or QR code. The QR code upgrade allows you to share eKeys with guests and monitor all activities remotely using a web management tool, even when away from the office. Powered by standard PoE (Power over Ethernet), FaceSentry 5AN can be installed in minutes with just six screws. FaceSentry 5AN is a true enterprise-grade access control or time-attendance device. Description: The FaceSentry facial recognition visitor control system includes hard-coded weak credentials (wwwuser:123456) for SSH access on port 23445. Privilege escalation to root is achieved by exploiting an insecure sudoers entry file. Vendor: iWT Ltd. Affected Versions: - Firmware 6.4.8 build 264 (A16 algorithm) - Firmware 5.7.2 build 568 (A14 algorithm) - Firmware 5.7.0 build 539 (A14 algorithm) Tested On: - Linux 4.14.18-sunxi - Ubuntu 16.04.4 (Xenial Xerus) - Linux 3.4.113-sunxi - PHP 7.0.30-0ubuntu0.16.04.1 - PHP 7.0.22-0ubuntu0.16.04.1 - lighttpd 1.4.35 - Arduino 5.98 - Sunxi Linux (sun8i) - Orange Pi PC+ Vendor Status: - May 28, 2019: Vulnerability discovered - May 29, 2019: Vendor contacted - June 12, 2019: No response from vendor - June 13, 2019: Vendor contacted again - June 27, 2019: No response from vendor - June 28, 2019: Vendor contacted again - June 29, 2019: No response from vendor - June 30, 2019: Public security advisory released Proof of Concept (PoC): facesentry_ssh.py Author: Gjoko Krsnic References: - https://www.exploit-db.com/exploits/47067 - https://exchange.xforce.ibmcloud.com/vulnerabilities/163186 - https://packetstormsecurity.com/files/153493 Change Log: - June 30, 2019: Initial release - July 4, 2019: Added references 1, 2, and 3

Goal Reached Thanks to every supporter — we hit 100%!

FaceSentry Access Control System 6.4.8 SSH Hardcoded Credentials & Privilege Escalation (ZSL-2019-5526)