Journey to Command Injection: Hacking the Lenovo ix4-300d

No ratings

Presented at BSidesPhiladephia 2019 by

Ian Sinderman

Fully comprising an embedded device isn’t always as easy as sending a GET request with ad- min=true. Sometimes, owning an embedded device takes multiple different vulnerabilities, creativity, and a little finesse. In this live demo, we show how we were able to chain multiple vulnerabilities in the Lenovo ix4-300d network attached storage (NAS) device into a remote exploit that can be executed with little user interaction. In the talk we cover how we first identified command injection, then used cross-site scripting (XSS) and cross-site request forgery (CSRF) to build an exploit that would hijack values stored in the victim’s browser storage, issue a malicious request on the user’s behalf, and issue an OS command to open a remotely accessible operating system shell.