DEF CON 33 - DisguiseDelimit: Exploiting Synology NAS with Delimiters and Novel Tricks - Ryan Emmon

Ryan Emmens of Rapid 7 details an unauthenticated exploit for Synology NAS that won the Pwn2Own Ireland competition, targeting approximately one million internet-facing devices 1:01-1:063:27-3:35.

Key Takeaways:
• Research began by monitoring the login process with BPF traces and Vue.js tampering, revealing that unauthenticated requests write user data to environment variables for root processes 17:31-20:24.
• To weaponize this, Emmens created a novel Linux technique using LD_DEBUG and LD_DEBUG_OUTPUT to force the linker to write formatted output into a controllable file path 31:49-33:07.
• The final exploit combines the environment variable injection with the custom file writing capability to create a malicious cron job, which executes a reverse shell as root after one minute 37:46-38:53.

This work underscores the significant risk to default configurations on Synology DiskStation Manager OS 3:27-3:35.

Sources:

• 1:01-1:06 Project goals and Pwn2Own context
• 3:27-3:35 Device footprint and impact analysis
• 17:31-20:24 Discovery of unauthenticated environment variable injection
• 31:49-33:07 Development of the LD_DEBUG output technique
• 37:46-38:53 Final exploit demonstration and results