The Line-Up
// one single track.

What do you do when your exploit burns hours before you're on stage? When the target gets patched, your config was different, or you actually don't even have a bug yet - and the clock is already ticking?

For Team DDOS, the answer was simple: you find another way in.

This talk tells the story of three Pwn2Own entries across all three event flavors of the last year - all developed after the draw, all under impossible time constraints. A QNAP NAS rooted in 48 hours starting from zero bugs. An automotive charger fully compromised in 24 hours with no prior exploit - add-on prize included. A Firefox exploit rebuilt from scratch in 72 hours after a last-minute patch burned the original chain.

Three targets, three ticking clocks, three full exploit chains delivered under pressure that turns most entries into withdrawals. We'll walk through the discovery, analysis, and exploitation of each target - revealing the approach that makes post-draw exploitation repeatable, not lucky.

Because at Pwn2Own, the hardest target has always been time.