Company
Date Published
Author
-
Word count
2815
Language
English
Hacker News points
None

Summary

In a blog post detailing their participation in the 2021 Pwn2Own Austin security contest, CrowdStrike researchers describe how they successfully identified and exploited multiple vulnerabilities in the Lexmark MC3224i printer, leading to a $20,000 prize that was donated to charity. The researchers discovered vulnerabilities that allowed unauthenticated remote code execution and privilege escalation, which they exploited using a combination of authentication bypass, shell command injection, and manipulation of a root-owned SUID binary. The process involved resetting the printer's non-volatile memory to bypass password protection, injecting shell commands via the printer's web interface, and ultimately gaining root access to start an SSH daemon. The researchers shared their findings to enhance product security and encourage responsible disclosure practices, while also inviting readers to explore their other successful target, the Cisco RV340 router, during the same contest.