Journey to Command Injection with Rick Ramgattie | CypherCon 4.0

### Overview In this presentation at CypherCon 4.0, Rick Ramgattie, a senior security analyst at Independent Security Evaluators (ISE), demonstrates how to discover and chain multiple vulnerabilities on an embedded device to achieve full remote code execution as root. Focusing on the Lenovo ix4-300D network-attached storage (NAS) device, Ramgattie demystifies IoT hacking, explaining that compromising embedded systems does not always require hardware glitching or esoteric RF skills. Instead, practical attacks often rely on chaining standard web application vulnerabilities with embedded Linux implementation flaws.

### Key Topics - **Demystifying Embedded Exploitation**: Dispelling the misconception that IoT hacking strictly requires specialized hardware hacking tools, highlighting that many devices run stripped-down Linux environments vulnerable to conventional web application flaws. - **Threat Modeling for Embedded Devices**: Differentiating internal threats (local network access, cross-site request forgery) from external threats (direct internet exposure through port forwarding). - **Vulnerability Chaining**: Combining reflected cross-site scripting (XSS), cross-site request forgery (CSRF), and OS command injection to bypass authentication protections and obtain a remote root shell. - **Vendor Response & Device Lifecycle**: Discussing the security posture of end-of-life (EOL) devices and reporting disclosures to manufacturers.

### Technical Details Ramgattie demonstrates the step-by-step discovery and chaining process on a Lenovo ix4-300D NAS running BusyBox: 1. **Reflected Cross-Site Scripting (XSS)**: Analyzing the management web interface, the speaker found that the `cat` GET parameter on the security page reflected user input directly into an HTML `<a>` tag without proper sanitization. By injecting quotation marks and opening a `<script>` tag, arbitrary JavaScript execution in the context of the user's browser was achieved. 2. **Command Injection**: In the personal cloud configuration functionality, parameter values such as the password field were passed into an underlying shell command. While the application attempted to sanitize user input by stripping dollar signs, parentheses, and semicolons, it failed to filter backticks (`` ` ``). Using backtick command substitution, an attacker could execute arbitrary system commands. 3. **Payload Execution**: The embedded BusyBox distribution included a version of `netcat` compiled with the deprecated `-e` flag (`nc -l -p 9000 -e /bin/sh`). Injecting this command opened a listening root shell on port 9000. 4. **Overcoming Authentication Controls & Exploitation Chain**: - The target POST endpoint required an `iomega` cookie that had the `HttpOnly` flag enabled, preventing direct exfiltration via JavaScript. However, browsers automatically attach this cookie in cross-origin requests. - The endpoint also mandated a session token parameter (`c`) in the URL query string. The device stored this token (`iomega_user_cookie`) in the browser's `localStorage`. - Ramgattie chained the flaws: an authenticated victim is tricked into clicking a single malicious link pointing to the XSS vulnerability. The injected JavaScript retrieves the token from `localStorage` and triggers a cross-origin XMLHttpRequest POST containing the command injection payload to the personal cloud endpoint. When triggered, the device executes `netcat` with root privileges.

### Takeaways - **Privilege Discrepancy**: Device owners are restricted to sandboxed or non-root interfaces, yet successful exploitation yields a root shell because the internal web server runs with root permissions. - **Input Sanitization Pitfalls**: Blacklisting select shell characters (e.g., `;`, `$()`) rather than strictly validating input or using parameterized APIs leaves room for bypasses such as backtick command evaluation. - **Defense-in-Depth Importance**: Relying solely on `HttpOnly` cookies is insufficient if sensitive session identifiers are duplicated into client-side storage mechanisms like `localStorage` where XSS can access them.