newbieからバイナリアンへ

newbie dive into binary

昨日は海を見に行きました

race condition

【pwn 60.0】Fire of Salvation - CoRCTF2021 (kernel exploit)

keywords kernel exploit / msg_msg / msg_seg / userfault_fd / cred walk / kmalloc-4k / shm_file_data / load_msg 1: TL;DR 2: イントロ 3: static lysithea module overview 4: vulnerability 5: FGKASLR 6: kernel .data leak rough plan to leak data…

【pwn 56.0】Stonks Socket - Hack.lu CTF 2021 (kernel exploit)

keywords kernel exploit / race w/o uffd / shellcode 1: イントロ 2: overview / analysis static module overview 3: vulns 4: race 5: LPE 6: exploit 7: アウトロ 8: 参考 1: イントロ 最近はどうも気分が沈みがちで、そんな楽しくない日々を送っており…

【pwn 51.0】nutty - Union CTF 2021 [maybe not intended sol] (kernel exploit)

keywords kernel exploit / race without uffd / SLOB / seq_operations / tty_struct / bypass SMAP via kROP on kheap 1: イントロ 2: static basic module 3: Vuln kUAF / double fetch invalid show size 4: leak kernbase race via userfaultfd (FAIL) …

【pwn 48.0】hashbrown - Dice CTF 2021 (kernel exploit)

keywords kernel exploit / FGKASLR / slab / race condition / modprobe_path / shm_file_data / kUAF / shmem_vm_ops 1: イントロ 2: static basic Module 3: FGKASLR 4: Vuln: race to kUAF 5: leak and bypass FGKASLR via shm_file_data なんでseq_oper…

You can cite code or comments in my blog as you like basically.
There are some exceptions.
1. When the code belongs to some other license. In that case, follow it.
2. You can't use them for evil purpose.
I don't take any responsibility for using my code or comment.
If you find my blog useful, I'll appreciate if you leave comments.

This website uses Google Analytics.It uses cookies to help the website analyze how you use the site. You can manage the functionality by disabling cookies.