Главная
Study mode:
on
1
Intro
2
Ruckus Networks Equipment
3
echo SUSER
4
R510 Unleashed
5
Firmware
6
Dockerized QEMU
7
Server Web Directory
8
Fetching rpmkey
9
CLI Jailbreak
10
Retrieving functions names
11
Web interface - authentication mechanism
12
Web interface - Session check
13
Standard ajax request
14
Unauth ajax request
15
Exploitation
16
What about command injection?
17
sys_wrapper.sh
18
Weird stuff
19
Session needed
20
Zap to the rescue
21
Arbitrarily file write
22
Zapd server
23
Zap command
24
Chained vulnerabilities
25
Conclusions
26
Post Research
27
Final thoughts
Description:
Explore vulnerability research conducted on Ruckus access points and Wi-Fi controllers, revealing three pre-authentication remote code execution exploits. Delve into the exploitation of various vulnerabilities, including information leaks, authentication bypasses, command injections, path traversals, stack overflows, and arbitrary file read/write operations. Examine the 10 confirmed CVEs filed for this research and learn about the framework used, including a Ghidra script and dockerized QEMU full system emulation for cross-architecture research. Gain insights into the extensive testing of 33 different access point firmware and Wi-Fi controllers, all found to be vulnerable. Discover the speaker's background in vulnerability research and embedded systems, as well as their interests outside of cybersecurity.

Don't Ruck Us Too Hard - Owning All of Ruckus AP Devices

nullcon
Add to list
0:00 / 0:00