Printer Hacking Adventures
summary
Extracts RSA keys from a Lexmark binary to decrypt FLS firmware blobs with a custom FLS decrypt tool, then chains a WS‑Print SOAP callback -> SSRF -> Fox Service command smuggling -> copy to a world‑writable FIFO -> auto-fw-debug command injection to get root (more than 100 Lexmark models affected). For Canon, leverages a Basic auth Base64 stack overflow and a WS‑Print lowercase overflow, builds UTF‑8‑aware ROP to create an arbitrary write and a framebuffer takeover to show proof, and ships a GDB‑over‑serial debugger via MW memory pokes; live demo works intermittently.
AI-written summary · about
chapters (13)
- 0:00Introduction to printer hacking
- 1:09Talk agenda and printer setup
- 2:14Lexmark firmware extraction
- 6:08Finding bugs in Lexmark
- 9:41Exploiting server-side request forgery
- 13:58Automated firmware debug chain
- 17:11Pwn2Own competition experience
- 18:15Canon printer architecture
- 20:04Canon buffer overflow exploit
- 24:42WS Print vulnerability on Canon
- 35:00Live demo attempt
- 38:24Building a Canon debugger
- 43:02Key takeaways and closing
related talks
30mCommSec D1 - How to Find and Exploit Bugs in IoT Devices
42m"Vulnerabilities from a grave. Forever dead or maybe alive..."
02h 27mHow hacking works (Workshop edition)
48mEverybody be Cool, This is a Robbery!
55mHow hacking works
01h 01mCory Doctorow -
01h 06mHow hacking works
22mSOK: 3D Printer Firmware Attacks on Fused Filament Fabrication