PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Our Pwn2Own journey against time and randomness (part 1)

blog.quarkslab.com | research | #reverse-engineering | #firmware | #vulnerability | #netgear | #pwn2own | #router
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Part one of Quarkslab's Pwn2Own Toronto 2022 journey: how the team picked targets for the router category, and its vulnerability research on the Netgear RAX30's WAN interface.
Published
Collected

Related coverage

research · blog.quarkslab.com
Our Pwn2Own journey against time and randomness (part 2)
Part two of Quarkslab's Pwn2Own Toronto journey: LAN-side vulnerabilities in the Netgear RAX30 — a soap_serverd buffer overflow (CVE-2023-27368), a DoS flaw and a firmware signature bypass.
research · github.com
Infinity Core: Linux Kernel Core Subsystems LPE and Container Escape Research
Unlike most modern Linux kernel exploits that depend on networking, eBPF, or unprivileged user namespaces, these vulnerabilities reside in fundamental kernel core subsystems, rendering standard container sandboxes and Android application domain restrictions ineffective against local privilege escalation.
blog · blog.viettelcybersecurity.com
The first step to PWN2OWN - A sad one
A researcher's first find: LAN-side command injection in the NETGEAR RAX30 UPnP service via a malicious SOAPACTION header embedded into a logger command; patched just before Pwn2Own Toronto 2022.
vulnerability · blog.viettelcybersecurity.com
NETGEAR R6700v3: 1day Analysis (CVE-2021-34982) Buffer Overflow RCE Vulnerability
The author traces CVE-2021-34982 on NETGEAR R6700v3 to Create_Hashtable() in the httpd String File Table Upload handler: unvalidated gui_region overflows a stack buffer, enabling pre-auth root RCE.
research · blog.quarkslab.com
Reverse Engineering a VxWorks OS Based Router
A reverse engineering walkthrough of a TP-Link TL-WR543G router running VxWorks: firmware extraction, binary analysis, memory layout and the pitfalls encountered along the way.
research · blog.quarkslab.com
TCP backdoor 32764 or how we could patch the Internet (or part of it ;))
The 32764 router backdoor: unauthenticated remote shell and credential dumping, a scan finding it open on about a million IPv4 hosts, and a way to permanently remove it from Linksys WAG200G routers.
Back