# Pwn2Own

Published articles for Pwn2Own.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Competing in Pwn2Own ICS 2022 Miami: Exploiting a zero click remote memory corruption in ICONICS Genesis64

DevFeed: [Competing in Pwn2Own ICS 2022 Miami: Exploiting a zero click remote memory corruption in ICONICS Genesis64](<https://devfeed.tech/articles/competing-in-pwn2own-ics-2022-miami-exploiting-a-zero-click-remote-memory-corruption-in-iconics-genesis64-39716.md>)

Original publisher: [Read original article](<https://doar-e.github.io/blog/2023/05/05/competing-in-pwn2own-ics-2022-miami-exploiting-a-zero-click-remote-memory-corruption-in-iconics-genesis64/>)

Author: Axel "0vercl0k" Souchet

Published: 2023-05-05T15:00:00Z

Content type: article

Language: en

Sources: [Diary of a reverse-engineer](<https://devfeed.tech/sources/diary-of-a-reverse-engineer.md>)

Topics: [Exploit](<https://devfeed.tech/topics/exploit.md>), [vulnerability](<https://devfeed.tech/topics/vulnerability.md>), [infosec](<https://devfeed.tech/topics/infosec.md>), [Windows](<https://devfeed.tech/topics/windows.md>)

Tags: [0-click-remote-code-execution](<https://devfeed.tech/tags/0-click-remote-code-execution.md>), [cve-2022-33318](<https://devfeed.tech/tags/cve-2022-33318.md>), [exploit](<https://devfeed.tech/tags/exploit.md>), [exploitation](<https://devfeed.tech/tags/exploitation.md>), [genbroker64-exe](<https://devfeed.tech/tags/genbroker64-exe.md>), [genesis64](<https://devfeed.tech/tags/genesis64.md>), [iconics](<https://devfeed.tech/tags/iconics.md>), [iconics-genesis64](<https://devfeed.tech/tags/iconics-genesis64.md>), [ics](<https://devfeed.tech/tags/ics.md>), [icsa-22-202-04](<https://devfeed.tech/tags/icsa-22-202-04.md>), [memory](<https://devfeed.tech/tags/memory.md>), [memory-corruption](<https://devfeed.tech/tags/memory-corruption.md>), [paracosme](<https://devfeed.tech/tags/paracosme.md>), [pwn2own](<https://devfeed.tech/tags/pwn2own.md>), [pwn2own-2022](<https://devfeed.tech/tags/pwn2own-2022.md>), [pwn2own-miami](<https://devfeed.tech/tags/pwn2own-miami.md>), [remote](<https://devfeed.tech/tags/remote.md>), [zdi-22-1041](<https://devfeed.tech/tags/zdi-22-1041.md>), [zero-click](<https://devfeed.tech/tags/zero-click.md>)

### AI overview

A participant recounts preparing for and demonstrating a winning zero-click remote entry at the 2022 Pwn2Own ICS competition in Miami. The article focuses on exploiting a memory-corruption vulnerability in ICONICS Genesis64 software running on Windows.

### Source excerpt

🧾 Introduction After participating in Pwn2Own Austin in 2021 and failing to land my remote kernel exploit Zenith (which you can read about here), I was eager to try again. It is fun and forces me to look at things I would never have looked at otherwise. The one thing I ...

## PwnAgent: A One-Click WAN-side RCE in Netgear RAX Routers with CVE-2023-24749

DevFeed: [PwnAgent: A One-Click WAN-side RCE in Netgear RAX Routers with CVE-2023-24749](<https://devfeed.tech/articles/pwnagent-a-one-click-wan-side-rce-in-netgear-rax-routers-with-cve-2023-24749-39683.md>)

Original publisher: [Read original article](<https://mahaloz.re/2023/02/25/pwnagent-netgear.html>)

Published: 2023-02-25T00:00:00Z

Content type: article

Language: en

Sources: [mahaloz.re](<https://devfeed.tech/sources/mahaloz-re.md>)

Topics: [bug](<https://devfeed.tech/topics/bug.md>), [Exploit](<https://devfeed.tech/topics/exploit.md>), [Hacking](<https://devfeed.tech/topics/hacking.md>), [nginx](<https://devfeed.tech/topics/nginx.md>), [Logging](<https://devfeed.tech/topics/logging.md>)

Tags: [bug-hunting](<https://devfeed.tech/tags/bug-hunting.md>), [cve](<https://devfeed.tech/tags/cve.md>), [exploit](<https://devfeed.tech/tags/exploit.md>), [firmware](<https://devfeed.tech/tags/firmware.md>), [hacking](<https://devfeed.tech/tags/hacking.md>), [nginx](<https://devfeed.tech/tags/nginx.md>), [pwn2own](<https://devfeed.tech/tags/pwn2own.md>), [rce](<https://devfeed.tech/tags/rce.md>), [routers](<https://devfeed.tech/tags/routers.md>)

### AI overview

A technical breakdown of CVE-2023-24749, a remotely accessible command-injection vulnerability in some Netgear RAX routers. The article explains how the bug can enable WAN-side remote code execution, potentially with root access, and discusses its discovery and firmware status.

### Source excerpt

A breakdown of a bug SEFCOM T0 and I exploited to achieve a WAN-side RCE in some Netgear RAX routers for pwn2own 2022. The bug is a remotely accessible command injection due to bad packet logging, cataloged as CVE-2023-24749.

## Pwn2Own 2021 Canon ImageCLASS MF644Cdw writeup

DevFeed: [Pwn2Own 2021 Canon ImageCLASS MF644Cdw writeup](<https://devfeed.tech/articles/pwn2own-2021-canon-imageclass-mf644cdw-writeup-39715.md>)

Original publisher: [Read original article](<https://doar-e.github.io/blog/2022/06/11/pwn2own-2021-canon-imageclass-mf644cdw-writeup/>)

Author: Nicolas "NK" Devillers & Jean-Romain "JRomainG" Garnier & Raphaël "\_trou\_" Rigo

Published: 2022-06-11T15:00:00Z

Content type: article

Language: en

Sources: [Diary of a reverse-engineer](<https://devfeed.tech/sources/diary-of-a-reverse-engineer.md>)

Topics: [Printer](<https://devfeed.tech/topics/printer.md>), [Embedded Software Dev](<https://devfeed.tech/topics/embedded-software-dev.md>), [Load Balancing](<https://devfeed.tech/topics/load-balancing.md>), [macOS](<https://devfeed.tech/topics/macos.md>)

Tags: [canon](<https://devfeed.tech/tags/canon.md>), [cve-2022-24674](<https://devfeed.tech/tags/cve-2022-24674.md>), [exploitation](<https://devfeed.tech/tags/exploitation.md>), [firmware](<https://devfeed.tech/tags/firmware.md>), [imageclass](<https://devfeed.tech/tags/imageclass.md>), [macos](<https://devfeed.tech/tags/macos.md>), [memory-corruption](<https://devfeed.tech/tags/memory-corruption.md>), [mf644cdw](<https://devfeed.tech/tags/mf644cdw.md>), [printers](<https://devfeed.tech/tags/printers.md>), [pwn2own](<https://devfeed.tech/tags/pwn2own.md>), [pwn2own-austin](<https://devfeed.tech/tags/pwn2own-austin.md>), [research](<https://devfeed.tech/tags/research.md>), [writeup](<https://devfeed.tech/tags/writeup.md>), [zdi-22-516](<https://devfeed.tech/tags/zdi-22-516.md>)

### AI overview

A technical writeup of research targeting the Canon ImageCLASS MF644Cdw printer for Pwn2Own Austin 2021. It describes analyzing the printer's firmware, obtaining firmware downloads, and investigating Canon's firmware URL structure and version availability.

### Source excerpt

Introduction Pwn2Own Austin 2021 was announced in August 2021 and introduced new categories, including printers. Based on our previous experience with printers, we decided to go after one of the three models. Among those, the Canon ImageCLASS MF644Cdw seemed like the most interesting target: previous research was limited (mostly targeting ...

## Competing in Pwn2Own 2021 Austin: Icarus at the Zenith

DevFeed: [Competing in Pwn2Own 2021 Austin: Icarus at the Zenith](<https://devfeed.tech/articles/competing-in-pwn2own-2021-austin-icarus-at-the-zenith-39714.md>)

Original publisher: [Read original article](<https://doar-e.github.io/blog/2022/03/26/competing-in-pwn2own-2021-austin-icarus-at-the-zenith/>)

Author: Axel "0vercl0k" Souchet

Published: 2022-03-26T15:00:00Z

Content type: opinion

Language: en

Sources: [Diary of a reverse-engineer](<https://devfeed.tech/sources/diary-of-a-reverse-engineer.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [Ghidra](<https://devfeed.tech/topics/ghidra.md>), [Hardware](<https://devfeed.tech/topics/hardware.md>), [Network](<https://devfeed.tech/topics/network.md>), [Code](<https://devfeed.tech/topics/code.md>)

Tags: [archer-c7](<https://devfeed.tech/tags/archer-c7.md>), [competition](<https://devfeed.tech/tags/competition.md>), [cve-2022-24354](<https://devfeed.tech/tags/cve-2022-24354.md>), [exploitation](<https://devfeed.tech/tags/exploitation.md>), [firmware](<https://devfeed.tech/tags/firmware.md>), [ghidra](<https://devfeed.tech/tags/ghidra.md>), [memory-corruption](<https://devfeed.tech/tags/memory-corruption.md>), [netusb](<https://devfeed.tech/tags/netusb.md>), [network](<https://devfeed.tech/tags/network.md>), [pwn2own](<https://devfeed.tech/tags/pwn2own.md>), [pwn2own-austin](<https://devfeed.tech/tags/pwn2own-austin.md>), [remote-kernel](<https://devfeed.tech/tags/remote-kernel.md>), [reverse](<https://devfeed.tech/tags/reverse.md>), [router](<https://devfeed.tech/tags/router.md>), [routers](<https://devfeed.tech/tags/routers.md>), [security](<https://devfeed.tech/tags/security.md>), [tp-link](<https://devfeed.tech/tags/tp-link.md>), [tp-link-archer-c7-v5](<https://devfeed.tech/tags/tp-link-archer-c7-v5.md>), [zenith](<https://devfeed.tech/tags/zenith.md>)

### AI overview

A personal account of preparing for and entering the Pwn2Own 2021 Austin competition. The author describes reverse-engineering consumer router firmware, selecting a router target with teammates, and working toward participation in the contest.

### Source excerpt

Introduction In 2021, I finally spent some time looking at a consumer router I had been using for years. It started as a weekend project to look at something a bit different from what I was used to. On top of that, it was also a good occasion to play ...