CVE-2022-24989

This module exploits an unauthenticated remote code execution vulnerability in TerraMaster TOS 4.2.29 and lower by chaining two existing vulnerabilities, CVE-2022-24990 "Leaking sensitive information" and CVE-2022-24989, "Authenticated remote code execution". Exploiting vulnerable endpoint `api.php?mobile/webNasIPS` leaking sensitive information such as admin password hash and mac address, the attacker can achieve unauthenticated access and use another vulnerable endpoint `api.php?mobile/createRaid` with POST parameters `raidtype` and `diskstring` to execute remote code as root on TerraMaster NAS devices.

msf > use exploit/linux/http/terramaster_unauth_rce_cve_2022_24990
msf exploit(terramaster_unauth_rce_cve_2022_24990) > show targets
    ...targets...
msf exploit(terramaster_unauth_rce_cve_2022_24990) > set TARGET < target-id >
msf exploit(terramaster_unauth_rce_cve_2022_24990) > show options
    ...show and set options...
msf exploit(terramaster_unauth_rce_cve_2022_24990) > exploit