Add QNAP NAS/NVR administrator hash disclosure

[wvu]

msf auxiliary(qnap_backtrace_admin_hash) > info 

       Name: QNAP NAS/NVR Administrator Hash Disclosure
     Module: auxiliary/gather/qnap_backtrace_admin_hash
    License: Metasploit Framework License (BSD)
       Rank: Normal
  Disclosed: 2017-01-31

Provided by:
  bashis
  wvu <wvu@metasploit.com>
  Donald Knuth

Available actions:
  Name       Description
  ----       -----------
  ARM        ARM target
  Automatic  Automatic targeting
  x86        x86 target

Basic options:
  Name          Current Setting  Required  Description
  ----          ---------------  --------  -----------
  OFFSET_END    5000             yes       Ending offset (no backtrace)
  OFFSET_START  2000             yes       Starting offset (backtrace)
  Proxies                        no        A proxy chain of format type:host:port[,type:host:port][...]
  RETRIES       10               yes       Retry count for the attack
  RHOST                          yes       The target address
  RPORT         443              yes       The target port (TCP)
  SSL           true             no        Negotiate SSL/TLS for outgoing connections
  VHOST                          no        HTTP server virtual host

Description:
  This module exploits combined heap and stack buffer overflows for 
  QNAP NAS and NVR devices to dump the admin (root) shadow hash from 
  memory via an overwrite of __libc_argv[0] in the HTTP-header-bound 
  glibc backtrace. A binary search is performed to find the correct 
  offset for the BOFs. Since the server forks, blind remote 
  exploitation is possible, provided the heap does not have ASLR.

References:
  http://seclists.org/fulldisclosure/2017/Feb/2
  https://en.wikipedia.org/wiki/Binary_search_algorithm

msf auxiliary(qnap_backtrace_admin_hash) > 

[busterb]

I've seen this in action, nice module @wvu !

[busterb]

I don't think print_debeug is a thing. If we want to bring back the actual print_debug, I'm fine with it.

[busterb]

Also, module docs please, and then I think this is landable.

[busterb]

LTGM, thanks for the updates!

[busterb]

Release Notes

The QNAP NAS/NVR Administrator Hash Disclosure exploit has been added to the framework. It exploits combined heap and stack buffer overflows for QNAP NAS and NVR devices to dump the admin (root) shadow hash from memory.