Rapid7 Vulnerability & Exploit Database

TerraMaster TOS 4.2.15 or lower - RCE chain from unauthenticated to root via session crafting.

Back to Search

TerraMaster TOS 4.2.15 or lower - RCE chain from unauthenticated to root via session crafting.

Disclosed
12/24/2021
Created
06/09/2023

Description

Terramaster chained exploit that performs session crafting to achieve escalated privileges that allows an attacker to access vulnerable code execution flaws. TOS versions 4.2.15 and below are affected. CVE-2021-45839 is exploited to obtain the first administrator's hash set up on the system as well as other information such as MAC address, by performing a request to the `/module/api.php?mobile/webNasIPS` endpoint. This information is used to craft an unauthenticated admin session using CVE-2021-45841 where an attacker can self-sign session cookies by knowing the target MAC address and the user password hash. Guest users (disabled by default) can be abused using a null/empty hash and allow an unauthenticated attacker to login as guest. Finally, CVE-2021-45837 is exploited to execute arbitrary commands as root by sending a specifically crafted input to vulnerable endpoint `/tos/index.php?app/del`.

Author(s)

  • h00die-gr3y <h00die.gr3y@gmail.com>
  • n0tme

Platform

Linux,Unix

Architectures

cmd, x64, x86, aarch64

Development

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use exploit/linux/http/terramaster_unauth_rce_cve_2021_45837
msf exploit(terramaster_unauth_rce_cve_2021_45837) > show targets
    ...targets...
msf exploit(terramaster_unauth_rce_cve_2021_45837) > set TARGET < target-id >
msf exploit(terramaster_unauth_rce_cve_2021_45837) > show options
    ...show and set options...
msf exploit(terramaster_unauth_rce_cve_2021_45837) > exploit

Metasploit

Penetration testing software for offensive security teams.
Key Features
Free Metasploit Pro Trial View All Features

Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.

– Jim O’Gorman | President, Offensive Security

;