Alarm.DISARM - Remotely Exploiting & Disarming Popular Physical Security System from Public Internet
summary
Two RCEs (CVE-2020-25189 and CVE-2020-25185) exist in a Paradox IP150 internet module’s lwIP-based web login: unsafe strcpy and hex-decoding loops allow buffer overflows. An exploit uses an ROP-style gadget chain to run shellcode that hijacks the fs open descriptor and returns in-memory credentials — a password dumper — over the same HTTP GET. A follow-up payload swaps the management service from port 10000 to 80, then the Paradox API (PAI) is used with the leaked password to remotely disarm zones.
AI-written summary · about
chapters (11)
- 0:00Intro
- 2:41Lab equipment
- 4:42Step 1 - Firmware updates
- 7:34Reverse Engineering
- 10:47Network Protocol
- 11:29Packet Header
- 15:28Looking for vulnerabilities - IP150 Login Page
- 17:08CVE-2020-25189
- 21:09Solution - ROP Chain
- 26:18Shellcode [1] - memory dumper
- 27:43Shellcode [2] - Switch Ports
related talks
45mOutside the box: pwning IoT devices through their applications
46mNakatomi Space: Lateral Movement as L1 Post-exploitation in OT
36mWhen The Front Door Becomes a Backdoor: The Security Paradox of OSDP
51mSteering Clear of Danger: Decrypting the Realities of Remote Car Hacking
39mNight of the living vulnerabilities
29mFrom an URGENT/11 Vulnerability to a Full Take-Down of a Factory, Using a Single Packet
26mHacking buildings: Security flaws in embedded building control systems
44m"Attacking industrial remote controllers for fun and profit"