Escaping a Restricted Shell on a MIPS Router: VerSprite at Ekoparty 2026

At Ekoparty 2026 in Buenos Aires, VerSprite Security Consultant Matias Ramires presented research on escaping the restricted shell of an Argentinian ISP-provided router. The talk, “Escapando de una Restricted Shell a los golpes: MIPS, Syscalls y Kernel Panics,” ran on October 8, 2026, in the Hardware Hacking Space (Sala C3).

Talk at a glance

Title: Escaping a Restricted Shell the Hard Way: MIPS, Syscalls and Kernel Panics

Speaker: Matias Ramirez, Security Consultant, VerSprite

Date: Thursday, October 8, 2026

Room: Hardware Hacking Space, Sala C3

What the research set out to test

ISP routers often give users a restricted shell: a command line that exposes a short list of approved commands and blocks the rest. The question Matias studied was whether that restriction actually holds on a real device, or whether it only hides the operating system underneath. A restricted shell is a policy layer, not a security boundary, unless the commands it allows are themselves safe.

How the work progressed

The path ran through three layers, each harder than the last.

1. The restricted shell. The first step is finding a way out: an allowed command that takes unsafe input, spawns a subprocess, or reads and writes files it shouldn’t.

2. MIPS and syscalls. Once outside the shell, the device has to be worked on its own terms. MIPS uses different calling conventions and syscall numbering than x86 or ARM, and many router builds strip the usual userland tools. That means talking to the kernel more directly.

3. Kernel panics. Pushing an embedded kernel produces crashes and reboots, each wiping the session. Panics slow the work down, but they also show where input reaches code that wasn’t built to handle it.

Why ISP router research matters

ISP-provided routers sit at the edge of millions of home and small-business networks, and users rarely control their firmware or update schedule. A restricted shell that can be escaped turns a configuration interface into a foothold on the device. Research on a single model often applies to others that share the same firmware base or vendor SDK.

Read the full Ekoparty 2026 recap

The Ekoparty 2026 recap on the VerSprite blog covers the rest of the week: the CTF the team ran at its high table, the winning teams, and what the team took away from the conference.

About Ekoparty 2026

Ekoparty is Latin America’s longest-running hacking conference, held in Buenos Aires since 2001. The 2026 edition ran October 7–9 at the CEC, alongside the Red Team Space in its seventh year, a DevSecOps Space, and a new Startup Zone. Banco Galicia and YesWeHack ran a Live Hacking Event from October 7 to 9, and Ekoparty added a Miami edition earlier in the year, on May 21–22.

VerSprite and Ekoparty

VerSprite researchers have presented at Ekoparty before. At Ekoparty 2018, the team covered abusing insecure Windows Communication Foundation (WCF) endpoints.

Frequently Asked Questions

What was VerSprite’s Ekoparty 2026 talk about? VerSprite Security Consultant Matias Ramires presented research on escaping the restricted shell of an ISP-provided router used in Argentina. The talk, “Escapando de una Restricted Shell a los golpes: MIPS, Syscalls y Kernel Panics,” ran on October 8, 2026, in Ekoparty’s Hardware Hacking Space (Sala C3).

How do attackers escape a restricted shell on a router? Most escapes abuse a command the shell already allows. Common routes include a permitted command that passes unsanitized input to the system, spawns a subprocess, or reads and writes files outside its intended scope. Once one of those works, the attacker reaches the underlying operating system.

What can someone do after escaping a router’s restricted shell? An escape typically exposes the router’s underlying Linux system. From there an attacker may read configuration and credentials, change routing or DNS settings, or persist on the device, depending on the privileges the escaped process holds.

Why do syscalls matter in embedded device research? Many router firmware builds strip standard command-line tools, so researchers interact with the kernel through system calls directly. On MIPS, syscall numbers and calling conventions differ from x86 and ARM, so exploits and tooling have to be written for the architecture.

Why do kernel panics happen during router testing? A kernel panic happens when the operating system hits an error it cannot recover from, and on a router it usually forces a reboot. During research, panics often mark the point where crafted input reaches kernel code that wasn’t built to handle it.

Why are ISP-provided routers a research target? ISP routers sit at the edge of many home and small-business networks, and users rarely control their firmware or updates. A weakness in one model can apply across devices that share the same firmware base.