DHCPwned: Owning Cameras One Lease at a Time
summary
Pwn2Own entry achieves an unauthenticated RCE via DHCP domain-name JSON injection against an Ubiquiti AI Bullet camera by abusing UDHCPC_CB, which broadcasts unescaped JSON to other processes. The exploit combines ARP spoofing + rogue DHCP server to deliver a crafted option 15 that injects a “reboot to defaults” function name; after reset the script logs in with default SSH creds and drops payloads. Reverse engineering, nmap, IPC monitoring and local fuzzing find and verify the flaw; the exploit runs reliably within the contest lease window.
AI-written summary · about
chapters (10)
- 0:00Introduction to Pwn2Own
- 1:30Pwn2Own competition rules
- 3:53Targeting Ubiquiti AI bullet camera
- 8:29Analyzing DHCP implementation
- 15:14Exploit logic and demo
- 19:56Preparing for the contest
- 22:02Pwn2Own competition results
- 23:07Key takeaways from the experience
- 24:52Pwn2Own Automotive attempt
- 25:15Resources and closing
related talks
45mOutside the box: pwning IoT devices through their applications
37mCDPwn: Taking Over Millions of Enterprise-Things with Layer 2 Zero-Days
38mHacking Demos, Dirty Secrets, Dangerous Lies, Asset Intelligence
51mSteering Clear of Danger: Decrypting the Realities of Remote Car Hacking
40mSomething Rotten in the State of Data Centers
42mCloudy With a Chance of Exploits: Compromising Critical Infrastructure Through IIoT Cloud Solutions
35mLCDPwn: Breaking Enterprise-Things with Layer 2 Discovery Protocol Vulnerabilities Again
45mMCPwned: Hacking MCP Servers with One Skeleton Key... (Jonathan Leitschuh)