"Breaking Extreme Networks WingOS: How to own millions of..."

on YouTube ↗38m

" summary

Finds a dynamic RC4-derived root password in WingOS that can be computed from a stored file plus the device MAC and then made persistent, reverse engineers MIPS N32/Cavium Octeon code with Unicorn emulation, and builds custom mipsN32 shellcode. Discovers multiple pre-auth memory corruptions — including AF_MINT remote heap and stack overflows — and chains them into an over‑the‑air exploit using two devices (controller ↔ access point) to get a root reverse shell; affects aircraft APs, subway and hospital deployments.

AI-written summary · about

" chapters (13)

1. 0:00Intro
2. 1:10Intro to Wingos
3. 5:30Attack Surface & Scenarios
4. 9:35Hidden root shell backdoor
5. 17:13Remote pre-auth "global" denial of
6. 18:58What is Mint?
7. 22:11Creating Mint Client
8. 23:58Mint Vulnerabilities
9. 24:34Remote Pre-auth heap overflow (mint)
10. 26:39Remote Pre-auth heap overflow 2 (mint)
11. 28:03EXPLOIT
12. 30:09LIBC GADGETS
13. 30:34SHELLCODE

" related talks

• 29mFrom an URGENT/11 Vulnerability to a Full Take-Down of a Factory, Using a Single PacketDor Zusman, Barak Hadad · Black Hat Asia 2020
• 51mArm IDA and Cross Check: Reversing the Boeing 787's Core NetworkRuben Santamarta · Black Hat USA 2019
• 41mfirmWar: An Imminent Threat to the Foundation of ComputingVlad Babkin, Nate Warfield · Black Hat Asia 2023
• 54mSubverting Apple Graphics: Practical Approaches to Remotely Gaining RootMarco Grassi, Liang Chen, Qidan He, Yubin Fu · Black Hat USA 2016
• 45mOutside the box: pwning IoT devices through their applicationsAlexei Kojenov · Global AppSec US 2021 Virtual
• 36mChained to Hit: Discovering New Vectors to Gain Remote and Root Access in SAP Enterprise SoftwarePablo Artuso, Yvan Genuer · Black Hat USA 2023
• 25mAdventures & Findings in ISP HackingIan Foster · BSidesSF 2025
• 59mIf You Can't Open It, You Don't Own ItMatthew Butler · CppCon 2019