Synology Nas Hacking Method. Questions

[ts2068]

Hello Everybody,

First of all I want to say that I am impressed by the excellent work you do on this forum.

leakbase.io is absolutely great.

I'm analyzing the results of Chucky last Synology post (X140 Good_Synology) and I'm wondering if there is a way to access the tool or method used to hack those Synology Nas servers accounts.

I could do a scan with Nmap of ports 5000 and 5001 and then try to bruteforce users and passwords, but looking at the logs that he posted, I understand that having such varied users, ports, and passwords, that should not be a manual method.
At least there would have to be an exploit that exploits some other type of vulnerability.

Could anyone guide me or help me with any clue or information regarding this.

Thanks in advance for your time.

TS2068

 

[nnn444ooo]

I guess all that comes from logs stealers. Just try find "quickconnect" in logs.

 

[ts2068]

I guess all that comes from logs stealers. Just try find "quickconnect" in logs.

I had not thought of it.

The problem with leaks and combos that come from Logs is that they are targets that are already raped in every possible way.

Thank you very much for your answer.