CVE-2017-5227

HIGH

QNAP QTS < 4.2.4 - Unauthenticated Sensitive Information Exposure via uLinux.conf

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2017-5227. PoCs published by Pasquale Fiorillo.

AI-analyzed exploit summary The writeup describes a privilege escalation vulnerability in QNAP QTS where a world-readable configuration file exposes weakly encrypted Microsoft Domain Administrator credentials. The exploit involves decoding a XOR-encrypted password stored in the file.

Description

QNAP QTS before 4.2.4 Build 20170313 allows local users to obtain sensitive Domain Administrator password information by reading data in an XOR format within the /etc/config/uLinux.conf configuration file.

Exploits (1)

exploitdb WRITEUP VERIFIED

by Pasquale Fiorillo · textlocalhardware

https://www.exploit-db.com/exploits/41745

View Code ZIP pw:eip

The writeup describes a privilege escalation vulnerability in QNAP QTS where a world-readable configuration file exposes weakly encrypted Microsoft Domain Administrator credentials. The exploit involves decoding a XOR-encrypted password stored in the file.

Classification

Writeup 100%

Attack Type

Info Leak

Complexity

Trivial

Reliability

Reliable

Target: QNAP QTS < 4.2.4

Auth required

Prerequisites: Local access to the QNAP device · NAS joined to a Microsoft Active Directory domain

MITRE ATT&CK