##############################################################################
# OpenVAS Vulnerability Test
# $Id$
#
# Loxone Default Login Credentials Vulenrability
#
# Authors:
# Tameem Eissa <tameem.eissa@greenbone.net>
#
# Copyright:
# Copyright (c) 2016 Greenbone Networks GmbH
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
###############################################################################



if (description)
{
 script_oid("1.3.6.1.4.1.25623.1.0.105756");
 script_version ("$Revision$");
 script_tag(name:"cvss_base", value:"7.5");
 script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:P/I:P/A:P");
 script_name("Loxone Smart Home Default Admin HTTP Login");

 script_tag(name: "impact" , value:"Attackers can exploit this issue to obtain sensitive information that may lead to further attacks.");
 script_tag(name: "vuldetect" , value:"Try to login with default credentials admin:admin");
 script_tag(name: "solution" , value:"Change the password");
 script_tag(name: "summary" , value:"The remote Loxone installation has default credentials set.");
 script_tag(name:"solution_type", value: "Workaround");

 script_tag(name:"qod_type", value:"remote_vul");

 script_tag(name:"last_modification", value:"$Date$");
 script_tag(name:"creation_date", value:"2016-08-31 13:18:59 +0200 (Wed, 31 Aug 2016)");
 script_summary("Try to login with admin:admin");
 script_category(ACT_ATTACK);
 script_family("Web application abuses");
 script_copyright("This script is Copyright (C) 2016 Greenbone Networks GmbH");
 script_dependencies("http_version.nasl");
 script_require_ports("Services/www", 12900);
 script_exclude_keys("Settings/disable_cgi_scanning");

 exit(0);
}

include("http_func.inc");
include("http_keepalive.inc");
include("host_details.inc");
include("misc_func.inc");


function newHandshakekey()
{
rand = rand_str( length:16, charset: "0123456789");
return base64( str: rand );

}

url = "";
Banner = "";
http_port = "";

## Get HTTP Port
http_port = get_http_port(default:80);



user = "admin";
pass = "admin";
host = get_host_name();

rand = rand_str( length:17, charset: "0123456789");


req = string("GET /jdev/sys/getkey?0.", rand, " HTTP/1.1\r\n",
               "Host: ", host,":",http_port, "\r\n",
               "Content-Type: application/x-www-form-urlencoded\r\n",
               "Content-Length: ", strlen(data), "\r\n"
               );
res = http_keepalive_send_recv( port:http_port, data:req, bodyonly:FALSE );
display ("req = ", req, "\n");
if ( res !~ "HTTP/1\.. 200"  || '{"LL": {' >!< res ) exit( 0 );
display ("res = ", res, "\n");
if ( res =~ '"LL": [{] "control": "dev/sys/getkey", "value": "([A-F0-9]+)", "Code": "200"}}') display ("success\n");

json_key = eregmatch (pattern: '"LL": [{] "control": "dev/sys/getkey", "value": "([A-F0-9]+)", "Code": "200"}}', string: res, icase:TRUE);
display ("json_key = ", json_key, "\n");
key = json_key[1];# it should be decoded from Hexadecimal
username = "admin";
password = "admin";
passphrase = "admin:admin";
#passphrase = "61646d696e3a61646d696e";
display ( "\npassphrase = " , passphrase, "\n");
#protocol = hmac.new(r.json()['LL']['value'].decode("hex"), LOX_USER+":"+LOX_PASS, digestmod=hashlib.sha1).digest().encode("hex")
#factory = WebSocketClientFactory("ws://"+LOX_ADDR+"/ws/",protocols = [protocol], debug=True)
#key = "4545453030304234303039452035343938393333383020323031362d30392d30352030383a34343a3139";
display ("key = ", key, "\n");
key = hex2str(key);
display ("key = ", key, "\n");
protocol = HMAC_SHA1(data: passphrase, key: key);
display ("protocol = ", protocol, "\n");
protocol1 =hexstr( protocol);
display ("protocol1 = ", protocol1, "\n");
protocol2 = hexstr (protocol1);
display ("protocol2 = ", protocol2, "\n");
websockey_key = newHandshakekey();# should be base64 encoded and then to string converted
display( "websockkey before = ", websockey_key, "\n");
websockkey_key1 = base64_decode ( str: websockey_key);
display( "websockkey after = ", websockkey_key1, "\n");

req2 = string ("GET /jdev/cfg/mac HTTP/1.1", "\r\n",
               "Host: 77.88.87.58", "\r\n",
               "User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0", "\r\n",
	       "Accept: */*", "\r\n",
		"Accept-Language: en-US,en;q=0.5", "\r\n",
 	        "Accept-Encoding: gzip, deflate", "\r\n",
		"X-Requested-With: XMLHttpRequest", "\r\n",
		"Referer: http://77.88.87.58/", "\r\n",
		"Connection: keep-alive", "\r\n",
		"\r\n");


display ("req2 = ", req2, "\n");

res2 = http_keepalive_send_recv( port:http_port, data:req2 );

display ("res2 ", res2, "\n");


req3 = string("GET /ws HTTP/1.1", "\r\n",
		"Host: ", host, "\r\n",
              "User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0\r\n",
	      "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n",
              "Accept-Language: en-US,en;q=0.5\r\n",
              "Accept-Encoding: gzip, deflate\r\n",
              "Sec-WebSocket-Version: 13\r\n",
              "origin: http://", host, "\r\n",
#	       "origin: http://77.88.87.58\r\n",
              "Sec-WebSocket-Protocol: ", protocol1, "\r\n",
              "Sec-WebSocket-Extensions: permessage-deflate\r\n",
              "Sec-WebSocket-Key: SxObjwIAylwW0O9U1FD4NQ==\r\n",
#              "Sec-WebSocket-Key: SxObjwIAylwW0O9U1FD4NQ==\r\n",
              "Connection: keep-alive, Upgrade\r\n",
              "Pragma: no-cache\r\n",
              "Cache-Control: no-cache\r\n",
              "Upgrade: websocket\r\n",
              "\r\n");


display ("req3 = ", req3, "\n");

res3 = http_keepalive_send_recv( port:http_port, data:req3 );




display ("res3 ", res3, "\n");

exit( 99 );