Rapid7 Vulnerability & Exploit Database

TerraMaster TOS 4.2.15 or lower - RCE chain from unauthenticated to root via session crafting.

Back to Search

TerraMaster TOS 4.2.15 or lower - RCE chain from unauthenticated to root via session crafting.



Terramaster chained exploit that performs session crafting to achieve escalated privileges that allows an attacker to access vulnerable code execution flaws. TOS versions 4.2.15 and below are affected. CVE-2021-45839 is exploited to obtain the first administrator's hash set up on the system as well as other information such as MAC address, by performing a request to the `/module/api.php?mobile/webNasIPS` endpoint. This information is used to craft an unauthenticated admin session using CVE-2021-45841 where an attacker can self-sign session cookies by knowing the target MAC address and the user password hash. Guest users (disabled by default) can be abused using a null/empty hash and allow an unauthenticated attacker to login as guest. Finally, CVE-2021-45837 is exploited to execute arbitrary commands as root by sending a specifically crafted input to vulnerable endpoint `/tos/index.php?app/del`.


  • h00die-gr3y <h00die.gr3y@gmail.com>
  • n0tme




cmd, x64, x86, aarch64


Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use exploit/linux/http/terramaster_unauth_rce_cve_2021_45837
msf exploit(terramaster_unauth_rce_cve_2021_45837) > show targets
msf exploit(terramaster_unauth_rce_cve_2021_45837) > set TARGET < target-id >
msf exploit(terramaster_unauth_rce_cve_2021_45837) > show options
    ...show and set options...
msf exploit(terramaster_unauth_rce_cve_2021_45837) > exploit

Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.

– Jim O’Gorman | President, Offensive Security