Josh

1.5K posts

Josh banner
Josh

Josh

@boredpentester

Embedded device security researcher / VR / Pwn2Own

Katılım Eylül 2018
783 Takip Edilen1.2K Takipçiler
Sabitlenmiş Tweet
Josh
Josh@boredpentester·
The story of how I almost pwned the Lexmark Postscript stack for Pwn2Own 2025... And I would have gotten away with it too, if it hadn't been for those meddling firmware updates! boredpentester.com/pwn2own-2025-p…
English
2
29
114
15.2K
Josh
Josh@boredpentester·
@alexjplaskett No. I have a personal account and used the org ID from that account
English
0
0
1
245
Josh
Josh@boredpentester·
🎉
Josh tweet media
QME
2
0
11
3.2K
Alex Plaskett
Alex Plaskett@alexjplaskett·
@boredpentester What did you need to fill in for this? I see OpenAI’s one but not Anthropics?
English
1
0
0
1.6K
Josh
Josh@boredpentester·
'You're absolutely right...'
Josh tweet media
English
1
0
4
492
Josh
Josh@boredpentester·
@h0mbre_ Windows 11 is only $30k I think as well...
English
0
0
2
563
h0mbre
h0mbre@h0mbre_·
kvm at pwn2own is only $50k, that is surprising to me. maybe im just ignorant, but seems like a super hard target
English
6
1
117
12.4K
Josh
Josh@boredpentester·
@HaifeiLi How did I miss this! Was it recorded?
English
0
0
0
270
LiveOverflow 🔴
LiveOverflow 🔴@LiveOverflow·
After a long pause, a new video coming today! Part 1 of small documentary about Pwn2Own…
LiveOverflow 🔴 tweet media
English
12
41
515
24.2K
Josh
Josh@boredpentester·
@thedawgyg @devs_lyfe May I ask, how much time was spent on this in terms of initial setup, bug finding, triage, and exploit development? Just trying to get a feel for how much time investment it takes to find a bug (first part) and then demonstrate exploitably (second part)
English
1
0
0
54
dawgyg - WoH
dawgyg - WoH@thedawgyg·
@devs_lyfe yea i spent significantly more time on this than i normally do on a bug for any bounty program, so my ROI here is very far from the ~$1000/hr I try to maintain when hacking.
English
1
0
8
1K
dawgyg - WoH
dawgyg - WoH@thedawgyg·
$18,000 for my first ever Google bounties isn't bad I suppose... but the amount of work it took for these 2 specific issues, it deff feels like its lower than it should have been. Gonna ask for some clarity on the reasoning behind the amounts and see what they say.
English
11
2
217
8.8K
Josh
Josh@boredpentester·
If like me , you're reading a blog post and sometimes struggle to fully grasp how the heap overflow is achieving its primitives, ask Claude to produce you a JAX diagram to visualise it for you! Here's Claude walking through Synacktiv's recent LFH strategy when escaping VMWare:
Josh tweet media
English
0
4
61
2.3K
Josh
Josh@boredpentester·
@alexjplaskett It is very similar but with target specific guidance, verifiers, tools and usage guidance adapted towards ARM and emulation, as opposed to JS bugs. I've been running it against bugs I've written exploits for in the past and it's doing OK so far!
English
0
0
1
75
Josh
Josh@boredpentester·
ChatGPT 5.2 versus a known (fixed) JBIG2 bug in Lexmark. I gave it no PoC file, just well RE'd code, struct layouts, high-level guidance and RCA. It has got most of this right, and achieved the primitive I asked for having overwritten a function pointer.
Josh tweet media
English
2
0
12
1.3K
Josh
Josh@boredpentester·
@alexjplaskett Yes, this is a single agent running in a Docker container with access to the target rootfs, pwndbg, qemu-user etc, as well as vulnerability details, a verifier and an export of the vulnerable library from IDA (post RE) via a custom exporter I built. No initial trigger file.
English
1
0
1
74
Josh
Josh@boredpentester·
For clarity, the image above is the LLM's analysis output, not my input.
English
0
0
0
212
Josh
Josh@boredpentester·
As above, I did have to give it high quality code decompilation, including structure layout, target specific guidance in terms of how to run, robust verification scripts (otherwise it absolutely will solve the wrong problem) and detailed tool usage instructions.
English
1
0
0
218
Josh
Josh@boredpentester·
However; The LLM didn't need the 2-4 hours I did to learn about the JBIG2 format, the different segment headers and their meaning. My token use was 9M tokens (approx $3.50).
English
1
0
0
220