New Isn't Always Novel: Grep Your Way to $20K at Pwn2Own
Security researchers demonstrate how simple grep heuristics uncovered a universal remote command injection vulnerability in Lexmark enterprise printers at Pwn2Own.
Summary
Applying the Hacker Mindset to Pwn2Own
Competing in major vulnerability research contests like Pwn2Own often appears daunting, but enterprise hardware firmware frequently harbors surprisingly elementary software flaws.
Auditing Lexmark Embedded Printer Firmware
The authors analyze the embedded Linux firmware powering commercial Lexmark office printers, examining legacy web management interfaces and device services.
Uncovering Universal Command Injection via Grep
Bypassing complex static analysis suites, targeted source grep queries uncovered an unauthenticated command injection flaw that allowed executing arbitrary root commands across dozens of printer models.
Releasing Exploitation and Credential Dumping Tooling
The presenters demonstrate their winning Pwn2Own exploit chain alongside post-exploitation scripts for extracting cached Active Directory credentials from compromised printers.
Related talks
Main Stage·44 min
Noam Moshe · Sharon Brizinov
Claroty Team82 reveals how cloud connectivity features in Western Digital and Synology NAS devices allow remote compromise and full RCE across millions of devices.
Main Stage·41 min
Ting-Yu 'NiNi' Chen
DEVCORE researcher NiNi Chen discloses a 9-year-old pre-authentication remote code execution zero-day in MikroTik RouterOS affecting over 3 million devices.
CODE BLUE·35 min
Hacking Printers at Pwn2Own
Security researchers examine technical aspects of [CB22]Your Printer is not your Printer ! - Hacking Printers at Pwn2Own.