From an URGENT/11 Vulnerability to a Full Take-Down of a Factory, Using a Single Packet
summary
Claims a single crafted packet exploiting an URGENT/11 IP‑options overflow triggers a stack smash that yields control of Rockwell and Schneider PLCs, then uses ROP gadgets to write shellcode into a writable executable code cave and persist without crashing the device. Setup uses a hidden VxWorks debugger activated via a “magic” IP, assert logs, Wireshark captures and on‑device firmware analysis, with seven dwords of controlled stack state and a compact ROP chain; demos include LED Morse SOS, motor reversal and max‑speed change, and a broadcast crash that stops motors until physical reboot.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 7:15What is Urgent 11
- 11:50What is Reverse ARP
- 12:44What is IP Options Overflow
- 13:52What is SR Option
- 16:05Code Flow
- 17:55Development
- 19:40Mitigations
- 23:52Demos
related talks
46mNakatomi Space: Lateral Movement as L1 Post-exploitation in OT
44mCritical Zero Days Remotely Compromise the Most Popular Real-Time OS
39mNight of the living vulnerabilities
29mBackdooring of Real Time Automotive OS Devices
45mOutside the box: pwning IoT devices through their applications
38m"Breaking Extreme Networks WingOS: How to own millions of..."
39mBackdooring Hardware Devices by Injecting Malicious Payloads on Microcontrollers
44mExposing Critical Threats In Millions Of Connected Devices