u/ChoiceGrapefruit0in r/ReverseEngineering • Recommends
How We Hacked a TP-Link Router and Took Home $55.000 in Pwn2Own
0:00 / 0:00
How We Hacked a TP-Link Router and Took Home $55,000 in Pwn2Own
Flashback Team
71K subscribers • 5 videos on Hallway
- Recommended by 2 people: 1 on Lobsters and 1 in engineering communities.
Intermediate. Assumes working knowledge.
427K views5 years ago2 recommendations
SecurityHardwareExploits and vulnerabilitiesReverse engineeringEmbedded systems
Flashback Team explains how they found and exploited a chain of vulnerabilities in a TP-Link Archer router to achieve remote code execution.
Learn tricks and techniques like these, with us, in our amazing training courses! hzed.flashback.sh/ flashback.sh/training In this video we will show you how we found and exploited a chain of vulnerabilities in the TP-Link Archer AC1750 to win $5,000 in Pwn2Own Tokyo 2019. We bagged a total of $55,000 hacking routers in this competition! Intro Finding debug interface Finding the vulnerability Vulnerability details Exploit demo Outro For in-depth details, refer to our advisories: flashback.sh/blog/lao-bomb-tplink-archer-lan-rce flashback.sh/blog/minesweeper-tplink-archer-lan-rce The two advisories complement each other. The first one describes the process we used to pwn this router in 2019, and the second one how we found in 2020 that TP-Link improperly patched the command injection. We used that knowledge to improve the exploit so that it works on old and newer "patched" firmware. The command injection described in this video is the improved one. The vulnerabilities exploited in this video are: - CVE-2020-10882 - CVE-2020-10883 - CVE-2020-10884 - CVE-2020-28347 All vulnerabilities have been fixed by TP-Link in current firmware versions. Intro material comes from the ZDI YouTube channel under CC-BY. Did you enjoy this video? Then follow us on Twitter, and subscribe to our channel for more awesome hacking videos. ~ Flashback Team flashback.sh twitter.com/FlashbackPwnWhy it's here
2 people recommend thisWhat people say. Recommended as a great walkthrough of finding and chaining vulnerabilities in embedded devices.
u/ChoiceGrapefruit0in r/netsec • Recommends
How We Hacked a TP-Link Router and Took Home $55.000 in Pwn2Own
u/Dramatic-Inspector57in r/ReverseEngineering • Mentions
What's the next step? Reverse Engineering a TP-Link router for vulnerabilities.
I am currently trying to find any vulnerabilities in a TP-Link router bu don't know what my next step is. I have experience with reverse engineering different types of binaries in CTFs but reversing the firmware of a router seems like a whole different beast.
I was very fortunate to acquire a TP-Link router that is almost identical to the router used in this video by the Flashback Team ( Check them out if you haven't already they are really good at explaining the basics of UART serial communication and other cool reverse engineering projects ). They are very experienced an have written scripts that automatic…