Breaking the BeeStation Inside Our Pwn2Own 2025 Exploit Jour...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://www.synacktiv.com/en/publications/breaking-the-beestation-inside-our-pwn2own-2025-exploit-journey.html
• Blog Title: Breaking the BeeStation: Inside Our Pwn2Own 2025 Exploit Journey
• Suggested Section: 🎯 Binary Exploitation -> Stack Overflow (add a subsection about fork-based crash-oracle bruteforce of canaries/pointers and Base64/JSON-structured stack overflows, referencing this Synology BeeStation case as an example)

🎯 Content Summary

This article documents end-to-end exploitation of a pre-authenticated stack-based buffer overflow in Synology BeeStation Plus (BST170-8T), assigned CVE-2025-12686, used as a winning entry at Pwn2Own Ireland 2025. The target device runs BSM OS, with firmware distributed as encrypted archives (SPK, PAT, etc.) that must be decrypted using Synacktiv’s open-source tool synodecrypt before anal...

🔧 Technical Details

1. Exploiting fixed-size stack buffers via attacker-controlled Base64 output length
The core trick is to exploit a Base64 decode helper that takes an input buffer, a decoded output buffer, and a pointer to the output length. In ParseAuthInfo, the code incorrectly sets the decoded size (decoded_len) to the attacker-controlled length of the Base64 string (auth_info->len) even though the destination buffer is a fixed 4096-byte stack array. Any situation where *decoded_len is not bounded to the actual buffer size can be abused: send a Base64 string long enough that the decoder overflows the stack, overwriting the canary, saved registers, and return address. Always look for APIs where a length parameter is reused across encoded/decoded representations without validation.

2. Combining Base64 + JSON parsing with embedded null bytes for structured overflows
Because the input is Bas...

🤖 Agent Actions

Summary:

• Extended src/binary-exploitation/stack-overflow/README.md with a new real-world example detailing Synacktiv’s BeeStation exploit, focusing on the Base64/JSON-structured overflow, fork-based crash-oracle bruteforcing of canaries/pointers, the ensuing ROP/write-what-where primitive, and the mitigation lessons.
• Added illustrative payload and oracle-snippet code blocks plus discussion of the multi-threaded brute-force optimization and SLIBCExecl-based RCE chain.
• Updated the References section to cite the Synacktiv blog post.

Tests: Not run (documentation-only change).

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://www.synacktiv.com/en/publications/breaking-the-beestation-inside-our-pwn2own-2025-exploit-journey.html

Content Categories: Based on the analysis, this content was categorized under "🎯 Binary Exploitation -> Stack Overflow (add a subsection about fork-based crash-oracle bruteforce of canaries/pointers and Base64/JSON-structured stack overflows, referencing this Synology BeeStation case as an example)".

Repository Maintenance:

• MD Files Formatting: 913 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0

[carlospolop]

merge