Security Alert Microsoft's Windows 10, Exchange, and Teams hacked at Pwn2Own

Gandalf_The_Grey

Level 45
Verified
Trusted
Content Creator
Apr 24, 2016
3,439
During the first day of Pwn2Own 2021, contestants won $440,000 after successfully exploiting previously unknown vulnerabilities to hack Microsoft's Windows 10 OS, the Exchange mail server, and the Teams communication platform.

On the second day, Pwn2Own competitors will also target Google Chrome, Microsoft Edge (Chromium), Zoom Messenger, while others will try their hand at exploiting other new bugs in Microsoft Exchange, Windows 10, Ubuntu Desktop, and Parallels Desktop.

After the vulnerabilities are exploited and disclosed during Pwn2Own, software and hardware vendors are given 90 days to develop and release security fixes for all vulnerabilities reported.
 

Gandalf_The_Grey

Level 45
Verified
Trusted
Content Creator
Apr 24, 2016
3,439
Live blog:
The results till now:

Tuesday, April 6
Miss any of the attempts? You can watch the full replay of Day One here.
1000 - Jack Dates from RET2 Systems targeting Apple Safari in the Web Browser category
SUCCESS - Jack used an integer overflow in Safari and an OOB Write to get kernel-level code execution. In doing so, he wins $100,000 and 10 Master of Pwn points.
1130 - Devcore targeting Microsoft Exchange in the Server category
SUCCESS - The Devcore team combined an authentication bypass and a local privilege escalation to complete take over the Exchange server. They earn $200,000 and 20 Master of Pwn points.
1300 - The researcher who goes by OV targeting Microsoft Teams in the Enterprise Communications category
SUCCESS - OV combined a pair of bugs to demonstrate code execution on Microsoft Teams. In doing so, we earns himself $200,000 and 20 points towards Master of Pwn
1430 - Team Viettel targeting Windows 10 in the Local Escalation of Privilege category
SUCCESS - The team used an integer overflow in Windows 10 to escalate from a regular user to SYSTEM privileges. This earns them $40,000 and 4 points towards Master of Pwn.
1530 - The STAR Labs team of Billy, Calvin and Ramdhan targeting Parallels Desktop in the Virtualization category
FAILURE - The STAR Labs team could not get their exploit to work within the time allotted.
1630 - Ryota Shiga of Flatt Security Inc targeting Ubuntu Desktop in the Local Escalation of Privilege category
SUCCESS - Ryota used an OOB access bug to go from a standard user to root on Ubuntu Desktop. He earns $30,000 and 3 Master of Pwn points in his Pwn2Own debut.
1730 - The STAR Labs team of Billy, Calvin and Ramdhan Oracle VirtualBox in the Virtualization category
FAILURE - The STAR Labs team could not get their exploit to work within the time allotted.
 
Last edited:

Gandalf_The_Grey

Level 45
Verified
Trusted
Content Creator
Apr 24, 2016
3,439
Wednesday, April 7
0900 -
Jack Dates from RET2 Systems targeting Parallels Desktop in the Virtualization category
SUCCESS - Jack combined three bugs - an uninitialized memory leak, a stack overflow, and an integer overflow to escape Parallels Desktop and execute code on the underlying OS. He earns $40K and 4 more Master of Pwn points. His two day total is now $140,000 and 14 points.
1000 - Bruno Keith (@bkth_) & Niklas Baumstark (@_niklasb) of Dataflow Security (@dfsec_it) targeting Google Chrome and Microsoft Edge (Chromium) in the Web Browser category
SUCCESS - The team used a Typer Mismatch bug to exploit the Chrome renderer and Microsoft Edge. Same exploit for both browsers. They earn $100,000 total and 10 Master of Pwn points.
1130 - Team Viettel targeting Microsoft Exchange in the Server category
PARTIAL - Team Viettel successfully demonstrated their code execution on the Exchange server, but some of the bugs they used in their exploit chain had been previously reported in the contest. This counts as a partial win but does get them 7.5 Master of Pwn points.
1300 - Daan Keuper and Thijs Alkemade from Computest targeting Zoom Messenger in the Enterprise Communications category
SUCCESS - Daan Keuper and Thijs Alkemade from Computest used a three bug chain to exploit Zoom messenger and get code execution on the target system - all without the target clicking anything. They earn themselves $200,000 and 20 Master of Pwn points.
Zero clicks needed to pop calc

Zero clicks needed to pop calc
1430 - Tao Yan (@Ga1ois) of Palo Alto Networks targeting Windows 10 in the Local Escalation of Privilege category
SUCCESS - Tao Yan used a Race Condition bug to escalate to SYSTEM on the fully patched Windows 10 machine. He earns himself $40,000 and 4 points towards Master of Pwn.
1530 - Sunjoo Park (aka grigoritchy) targeting Parallels Desktop in the Virtualization category
SUCCESS - Sunjoo Park (aka grigoritchy) used a logic bug to execute code on the underlying operating system through Parallels Desktop. He wins $40,000 and 4 points towards Master of Pwn.
1630 - Manfred Paul targeting Ubuntu Desktop in the Local Escalation of Privilege category
SUCCESS - Manfred used an OOB Access bug to escalate to a root user on Ubuntu Desktop. The Pwn2Own veteran earns himself $30,000 and 3 points towards Master of Pwn.
1730 - The researcher known as z3r09 targeting Windows 10 in the Local Escalation of Privilege category
SUCCESS - z3r09 used an integer overflow to escalate his permissions up to NT Authority\SYSTEM. His impressive display nets him $40,000 and 4 points towards Master of Pwn.
 

Gandalf_The_Grey

Level 45
Verified
Trusted
Content Creator
Apr 24, 2016
3,439
Now that the first 2 days are finished, and I have updated the results in the previous posts the last days results will be posted here:

Thursday, April 8
0900 -
Benjamin McBride from L3Harris Trenchant targeting Parallels Desktop in the Virtualization category
SUCCESS - Ben used a memory corruption bug to successfully execute code on the host OS from within Parallels Desktop. He earns $40,000 and 4 Master of Pwn points.
1000 - Steven Seeley of Source Incite targeting Microsoft Exchange in the Server category
PARTIAL - Although Steven did use two unique bugs in his demonstration, this attempt was a partial win due to the Man-in-the-Middle aspect of the exploit. It's still great research though, and he earns 7.5 Master of Pwn points.
1130 - The STAR Labs team of Billy targeting Ubuntu Desktop in the Local Escalation of Privilege category
PARTIAL - Although Billy was able to successfuolly escalate privileges to root, the bug he used was known to the vendor and will be patched soon. The demonstration does earn him 2 additional Master of Pwn points.
1230 - Fabien Perigaud of Synacktiv targeting Windows 10 in the Local Escalation of Privilege category
PARTIAL - Despite the excellent use of ASCII art during his demonstration, it turns out Microsoft was aware of the bug he used. He still earns 2 Master of Pwn points for the partial win.
1330 - Alisa Esage targeting Parallels Desktop in the Virtualization category
PARTIAL - Despite the great demonstration (replete with ASCII art), the bug used by Alisa had been reported to the ZDI prior to the contest, making this a partial win. It's still great work, and we're thrilled she broke ground as the 1st woman to participate as an independent researcher in Pwn2Own history. Her efforts do result in two points towards Maser of Pwn.
1430 - Vincent Dehors of Synacktiv targeting Ubuntu Desktop in the Local Escalation of Privilege category
SUCCESS - Despite admiting this was the first exploit he had written for Linux, Vincent had no issues escalating to root through a double free bug. He earns himself $30,000 and 3 Master of Pwn points.
1530 - Da Lao targeting Parallels Desktop in the Virtualization category
SUCCESS - The researcher known as Da Lao used an OOB Write to successfully complete his guest-to-host escape in Parallels. He earns $40,000 and 4 points towards Master of Pwn.
1630 - Marcin Wiazowski targeting Windows 10 in the Local Escalation of Privilege category
SUCCESS - Marcin used a Use After Free (UAF) bug to escalate to SYSTEM on Windows 10. He wins himself $40,000 and 4 Master of Pwn points.

Thanks again to our partners Tesla, Zoom, and Adobe as well as our sponsor VMware. Thanks also to the researchers who participate and to the vendors for providing fixes for what’s discovered during the contest. As a reminder, vendors have 90 days to produce a fix for all vulnerabilities reported.
 
Last edited:
Top