Rapid7 Vulnerability & Exploit Database

QNAP NAS/NVR Administrator Hash Disclosure

Back to Search

QNAP NAS/NVR Administrator Hash Disclosure

Disclosed
01/31/2017
Created
05/30/2018

Description

This module exploits combined heap and stack buffer overflows for QNAP NAS and NVR devices to dump the admin (root) shadow hash from memory via an overwrite of __libc_argv[0] in the HTTP-header-bound glibc backtrace. A binary search is performed to find the correct offset for the BOFs. Since the server forks, blind remote exploitation is possible, provided the heap does not have ASLR.

Author(s)

  • bashis
  • wvu <wvu@metasploit.com>
  • Donald Knuth

Development

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use auxiliary/gather/qnap_backtrace_admin_hash
msf auxiliary(qnap_backtrace_admin_hash) > show actions
    ...actions...
msf auxiliary(qnap_backtrace_admin_hash) > set ACTION < action-name >
msf auxiliary(qnap_backtrace_admin_hash) > show options
    ...show and set options...
msf auxiliary(qnap_backtrace_admin_hash) > run

Metasploit

Penetration testing software for offensive security teams.
Key Features
Free Metasploit Pro Trial View All Features

Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.

– Jim O’Gorman | President, Offensive Security

;