Journey to Command Injection: Hacking the Lenovo ix4-300d
summary
Lenovo ix4-300d firmware contains a chainable remote exploit: a command injection in share and personal-cloud fields plus a reflected XSS on the security page allow theft of browser-stored tokens and forced requests via CSRF token theft, which injects a payload that opens a bind shell on port 9000. Demo uses a web proxy, URL double‑decoding, a simple Python HTTP server to host JS, and a listener to prove a fully remote shell; the chain works end‑to‑end.
AI-written summary · about
chapters (11)
- 0:00Introduction to vulnerability chains
- 3:05Understanding the Lenovo ix4-300d
- 6:42Exploring the admin interface
- 8:46Finding command injection in shares
- 10:17Discovering second command injection
- 12:25Building the exploit payload
- 15:39Exploiting authentication tokens
- 18:04Leveraging XSS for remote access
- 20:30Executing the full remote exploit
- 21:55Mitigation and vendor response
- 24:24Q&A and closing remarks
related talks
42mCloudy With a Chance of Exploits: Compromising Critical Infrastructure Through IIoT Cloud Solutions
51mSteering Clear of Danger: Decrypting the Realities of Remote Car Hacking
42m"Vulnerabilities from a grave. Forever dead or maybe alive..."
45mOutside the box: pwning IoT devices through their applications
42mModern web application bugs
39mHow to think like a hacker
40mHow hacking works; Web edition
38mHacking Demos, Dirty Secrets, Dangerous Lies, Asset Intelligence