01 Alessandro Sgreccia / rainpwn
02 How I work
Almost entirely ZYXEL network appliances: USG/ZyWALL and ATP firewalls, USG FLEX and FLEX H, access points and security routers. Firmware from ZLD 5.35 to 5.41, and uOS 1.31.
Reading the management interface against the CLI it drives, then against the services and binaries underneath. That means comparing what one layer claims to enforce with what the layer below actually checks.
Every issue is reported to the vendor and published after a fix ships. Every CVE here is on NVD with a matching vendor advisory.
03 CVE timeline
One bar per CVE, height is the CVSS score.
Authentication bypass in the CGI program and a reflected XSS. CVE-2022-0342 scored 9.8, still the highest.
Command injection through the administration shell, two buffer overflows in CLI functions, and file and token access from limited accounts.
Privilege escalation on access points, further CLI command injection, and authentication token theft on the FLEX H series.
PostgreSQL permissions on uOS firmware, code execution over an SSH tunnel, and an authorization bypass in zysh-cgi.
A field in the DDNS profile configuration reaching command execution with root privileges on ATP and USG firewalls.
04 Featured research
An unsanitised parameter in the DDNS profile configuration reaches command execution with root privileges on ATP and USG firewalls.
A low-privileged, semi-authenticated attacker reaches the device configuration through zysh-cgi without completing the second factor.
On FLEX H uOS firmware, a PostgreSQL service reachable through an SSH tunnel accepts commands, and the account running it holds more permissions than it needs.
Prompt injection testing against the Nebula AI assistant, checking whether instructions placed in the data it reads change what it discloses.
05 Depth
The layers of a ZYXEL appliance, from the unauthenticated surface down to uid=0.
01Surface
What the device exposes before authentication.
02Web
The CGI programs that turn an HTTP request into a system action.
03Auth
Login, session tokens and the second factor.
04CLI
zysh, the administration shell, and the parameters it accepts.
05Services
Processes listening on the device that the management interface doesn't cover.
06Binary
Memory handling in the compiled CLI functions.
07Firmware
uOS and ZLD, where service permissions are set.
08Privilege
What separates limited-admin, guest and admin accounts.
09Root
Command execution as uid=0.
06 Output
07 Writeups
08 Lab
Experiments, tooling and notes that stay here.
How a chatbot embedded in a network management console behaves when instructions arrive in the data rather than from the user. First note published on Nebula AI.
Python proof-of-concepts: token theft, RCE through web-auth, 2FA bypass, RCE through DDNS, and an unauthenticated PostgreSQL service over an SSH tunnel.
Reversing challenges solved and documented step by step, working from the binary alone.
A flawed upload mechanism in the Configuration Migration Tool allowed arbitrary PHP upload and execution.
67 system owns · 68 user owns · 34 challenges · Dante 27/27
09 About
Alessandro Sgreccia, online as rainpwn. Part of the Hackerhood team since July 2023.