Back in 2015, I have published a blog post titled " Pwning a thin client in less two minutes " which attracted a lot of curiosity from the Internet and which was also featured in the HACKADAY blog. Today, together with Vincent Hutsebaut ( @vhutsebaut ), we are releasing a further technique to pwn the same thin client and get a root shell without authentication, in less than one minute! The attack detailed below is a typical kiosk attack which consists in a local privilege escalation which affects different versions of HP Thin Pro OS (HP ThinPro 4.4, HP ThinPro 5.0, HP ThinPro 5.1, HP ThinPro 5.2, HP ThinPro 5.2.1, HP ThinPro 6.0, HP ThinPro 6.1). The vulnerability (CVE-2016-2246) has been patched by HP and a technical bulletin has been published . HP stated that they have fixed the issue before our report was sent to them and were on the way to publish a security bulletin when we contacted them. Since the patch is out, let's dive into the vulnerability, which i...
Security research, divulgations and food for thought.