1. IT-Security >
  2. IT Security Tools >
  3. Synology DiskStation Manager smart.cgi Remote Command Execution

ArabicEnglishFrenchGermanGreekItalianJapaneseKoreanPersianPolishPortugueseRussianSpanishTurkishVietnamese

Synology DiskStation Manager smart.cgi Remote Command Execution


IT Security Tools vom | Direktlink: packetstormsecurity.com Nachrichten Bewertung

This Metasploit module exploits a vulnerability found in Synology DiskStation Manager (DSM) versions prior to 5.2-5967-5, which allows the execution of arbitrary commands under root privileges after website authentication. The vulnerability is located in webman/modules/StorageManager/smart.cgi, which allows appending of a command to the device to be scanned. However, the command with drive is limited to 30 characters. A somewhat valid drive name is required, thus /dev/sd is used, even though it does not exist. To circumvent the character restriction, a wget input file is staged in /a, and executed to download our payload to /b. From there the payload is executed. A wfsdelay is required to give time for the payload to download, and the execution of it to run....

Externe Webseite mit kompletten Inhalt öffnen



https://packetstormsecurity.com/files/157807/synology_dsm_smart_exec_auth.rb.txt

Team Security Social Media

➤ Weitere Beiträge von Team Security | IT Sicherheit

Team Security Diskussion über Synology DiskStation Manager smart.cgi Remote Command Execution