Rapid7 Vulnerability & Exploit Database

QNAP Q'Center change_passwd Command Execution

Back to Search

QNAP Q'Center change_passwd Command Execution

Disclosed
07/11/2018
Created
07/25/2018

Description

This module exploits a command injection vulnerability in the `change_passwd` API method within the web interface of QNAP Q'Center virtual appliance versions prior to 1.7.1083. The vulnerability allows the 'admin' privileged user account to execute arbitrary commands as the 'admin' operating system user. Valid credentials for the 'admin' user account are required, however, this module also exploits a separate password disclosure issue which allows any authenticated user to view the password set for the 'admin' user during first install. This module has been tested successfully on QNAP Q'Center appliance version 1.6.1075.

Author(s)

  • Ivan Huertas
  • bcoles <bcoles@gmail.com>

Platform

Linux

Architectures

x86, x64

Development

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use exploit/linux/http/qnap_qcenter_change_passwd_exec
msf exploit(qnap_qcenter_change_passwd_exec) > show targets
    ...targets...
msf exploit(qnap_qcenter_change_passwd_exec) > set TARGET < target-id >
msf exploit(qnap_qcenter_change_passwd_exec) > show options
    ...show and set options...
msf exploit(qnap_qcenter_change_passwd_exec) > exploit

Metasploit

Penetration testing software for offensive security teams.
Key Features
Free Metasploit Pro Trial View All Features

Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.

– Jim O’Gorman | President, Offensive Security

;