From WAN to NAS: A Pwn2Own Journey Through the SOHO Attack Surface
summary
A complete Pwn2Own chain demonstrates remote compromise of a QNAP router and pivot to a TrueNAS Mini X, using seven distinct attack steps that include UART debugging, firmware analysis, and MITM DNS spoofing. The firmware is decrypted with password "QHora", a gRPC/HTTP service triggered by a spoofed AAAA lookup for localhost parses attacker-controlled JSON leading to a shell via a Python-backed pipeline, and TrueNAS is escalated by serving a malicious tar that exploits IO Cage’s extractall to overwrite the web UI user database so shell via web UI after tampering TrueNAS package fetch is achieved; heap-shaping attempts against a JSON overflow prove flaky and discarded.
AI-written summary · about
chapters (18)
- 0:00Pwn2Own introduction
- 2:52Pwn2Own and SOHO Smash Hub
- 6:42Targeting TrueNAS Mini X
- 8:47TrueNAS attack surface
- 12:54TrueNAS path traversal exploit
- 13:59Switching to QNAP router
- 15:22QNAP firmware analysis
- 17:27QNAP connections and services
- 22:25Testing state changes
- 26:21DNS to localhost discovery
- 28:04DM agent heap overflow
- 33:42Heap shaping attempt
- 37:31gRPC service parsing
- 41:23gRPC code execution
- 43:05Exploit chain validation
- 44:08Competition day insights
- 45:56Live exploit demo
- 47:00Q&A
related talks
39mA Pain in the NAS: Exploiting Cloud Connectivity to PWN Your NAS
56mNetwork Attached Shell: N.A.S.ty Systems that Store Network Accessible Shells
43mA 3-Year Tale of Hacking a Pwn2Own Target: The Attacks, Vendor Evolution, and Lesson Learneds
52mNetwork Attached Shell: N.A.S.ty Systems that Store Network Accessible Shells
30mTales of Red Teaming
45mOutside the box: pwning IoT devices through their applications
46mNakatomi Space: Lateral Movement as L1 Post-exploitation in OT
51mSteering Clear of Danger: Decrypting the Realities of Remote Car Hacking