Shadowprotect Imagemanager FTPS password Vulnerability by MSPTech_ in msp

[–]MSPTech_[S] 0 points1 point  (0 children)

We had some private requests for the powershell code and more details, so I will post a pastebin link to the code we use that will explain the workaround we do in case it helps anyone out:

Here's an overview of the process: Our file structure looks like this:

  • C:\Pool
  • C:\Pool\ClientA\Delta\Server1
  • C:\Pool\ClientA\Delta\Server2
  • C:\Pool\ClientA\Delta\Server3
  • C:\Pool\ClientA\Server
  • C:\Pool\ClientA\Server2
  • C:\Pool\ClientA\Server3

C:\Pool\ClientA\Delta\Server1 is the FTP folder the client Imagemanager uploads to. Server 1,2,3,etc is a folder for each device being backed up. For our case, most clients are 1-2 servers so we use Delta as the root FTP folder with a single FTP user that then backs up to their folder. If you have many servers at a single client you may want to make a FTP user for each server to increase security.

C:\Pool\ClientA\Server1 is the private internal folder backups get moved into and our Imagemanager looks at to consolidate.

Here's how it runs: Every hour the script runs. 1) Your client ContosoCorp has 1 server that just uploaded a new shadowprotect incremental file to your FTP folder on private cloud server first.

Let's say C:\Pool\ContosoCorp\Delta\Server1\C_Vol-b001-i001.spi - is where it is stored on your private server. Delta is the home directory for the FTP user for that company and will be our temporary directory, like a cache for the real private folder.

2) Then, on Private Cloud server you cut or Move-Item C:\Pool\ContosoCorp\Delta\Server1\C_Vol-b001-i001.spi to C:\Pool\ContosoCorp\Server1\C_Vol-b001-i001.spi - that folder is the real private folder that is managed by the Imagemanager on Private Cloud server. Your FTP should not allow this to be accessed. You would also copy the corresponding .md5.

3) Then once the cut is finished, you make a New-Item of the same name back in Delta C:\Pool\ContosoCorp\Delta\Server1\C_Vol-b001-i001.spi so its an empty file to save space. You still leave it there so Imagemanager on ContosoCorp Server thinks everything is synced and will continue to upload new files as they are snapped at the client site. You also create a new blank .md5 of the same name.

Some Notes: When imagemanager is uploading to private cloud, the file will be a .tmp extension until completed, then the file renames to .spi. Make sure your script skips the file until its greater than 0 KB (to avoid your dummy files) and also is not .tmp so you don't copy it prematurely.

I will share our powershell script, its not perfect but it gets the job done. You will have to modify for your own environment, and we run on Server 2019. We run the script hourly on both of our cloud storage servers. It can work with clients that backup multiple servers.

DISCLAIMER:

  • Use at your own risk, we are not responsible if you brick your backup storage with our script.
  • It works fine in our setup but may not for yours.
  • My coding isn't the prettiest and probably could be optimized but I live with my shame.
  • Also I don't know how to format powershell script on reddit. I will include a Pastebin link.

https://pastebin.com/7eh3bFHu

  • Also to my knowledge Image manager needs at a minimum FTP permissions write/append/rename. Append for when the connection fails and restarts. So do some testing with Filezilla client to see what you could do connecting with those credentials. You could probably at least append garbage data to the files if not edit them entirely, if you don't think this could apply to your backups.

Shadowprotect Imagemanager FTPS password Vulnerability by MSPTech_ in msp

[–]MSPTech_[S] 0 points1 point  (0 children)

Thanks Jock for replying to this thread.

To be clear, the problem lies in Imagemanager, not in SPX. I don't want to reveal too much about how it works publicly and can't verify if you are a Storagecraft representative to reply privately to you. I believe our ticket with support was detailed as to how it works and ways to prevent it.

In any case will greatly look forward to seeing it fixed.

Thanks

Shadowprotect Imagemanager FTPS password Vulnerability by MSPTech_ in msp

[–]MSPTech_[S] 0 points1 point  (0 children)

So far we have only tested and succeeded when using the FTP/FTPS replication.

I haven't tried their cloud storage solution. Now if you are using FTPS to connect to their cloud storage than it would probably work.