Rapid7 Vulnerability & Exploit Database

QNAP NAS/NVR Administrator Hash Disclosure

Back to Search

QNAP NAS/NVR Administrator Hash Disclosure



This module exploits combined heap and stack buffer overflows for QNAP NAS and NVR devices to dump the admin (root) shadow hash from memory via an overwrite of __libc_argv[0] in the HTTP-header-bound glibc backtrace. A binary search is performed to find the correct offset for the BOFs. Since the server forks, blind remote exploitation is possible, provided the heap does not have ASLR.


  • bashis
  • wvu <wvu@metasploit.com>
  • Donald Knuth


Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use auxiliary/gather/qnap_backtrace_admin_hash
msf auxiliary(qnap_backtrace_admin_hash) > show actions
msf auxiliary(qnap_backtrace_admin_hash) > set ACTION < action-name >
msf auxiliary(qnap_backtrace_admin_hash) > show options
    ...show and set options...
msf auxiliary(qnap_backtrace_admin_hash) > run 

Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.

– Jim O’Gorman | President, Offensive Security