@_bcoles
 ` rm -rf /* `
github.com/bcoles
Joined January 2011
  • Tweets217
  • Following644
  • Followers763
35Media
Open source projects are usually welcoming of pull requests. Don't let your dreams be dreams.
2
8
1
39
Повну емуляцію апаратної платформи Nokia 6600 (NHL-10) у QEMU завершено. GSM-зв’язок працює end-to-end: Відправка та прийом СМС ARM → DSP → IQ → Osmocom → IQ → DSP → ARM
81
386
25
3,849
176,903
KASLD v0.4.0 released. Linux #KASLR derandomization tool. Memory regions now carry a certainty rating: "guaranteed" proven values/ranges, and "likely" narrower guesses that can be wrong (from heuristics/side-channels). +18 leak components (120 total). github.com/bcoles/kasld
KASLD recovered the kernel virtual base address on an Ubuntu 26.04 system.

ALT KASLD recovered the kernel virtual base address on an Ubuntu 26.04 system.

KASLD recovered the kernel virtual base address on a Debian 13 system.

ALT KASLD recovered the kernel virtual base address on a Debian 13 system.

KASLD recovered the kernel virtual base address on a Fedora 44 system.

ALT KASLD recovered the kernel virtual base address on a Fedora 44 system.

KASLD recovered the kernel virtual base address on a CachyOS 260426 system.

ALT KASLD recovered the kernel virtual base address on a CachyOS 260426 system.

4
27
150
7,784
A few of the new components: alsa_seq_ext_ptr - ALSA leaked a kernel heap pointer to desktop users since v2.6.12 (fixed in v7.2) avx_maskload - x86-64 AVX side-channel; needs KPTI off (AMD by default) arm64_tlb_fault_timing - first arm64 side-channel component; needs KPTI off.
1
78
KASLD v0.3.0 released. Unprivileged Linux #KASLR derandomization tool that gathers leaks & side-channels and fuses them through a constraint solver into one sound answer for the kernel base — exact where a leak allows, smallest residual window otherwise. github.com/bcoles/kasld
1
4
121
bcoles retweeted
V4bel
@v4belMay 7
💥 Introducing "Dirty Frag" A universal Linux LPE chaining two vulns in xfrm-ESP and RxRPC. A successor class to Dirty Pipe & Copy Fail. No race, no panic on failure, fully deterministic. ~9 years latent. Ubuntu / RHEL / Fedora / openSUSE / CentOS / AlmaLinux, and more. Even if you've applied the "Copy Fail" mitigation, your Linux is still vulnerable to "Dirty Frag". Apply the Dirty Frag mitigation. Details: dirtyfrag.io
41
691
143
2,056
540,899
KASLD v0.1.0 released. New orchestrator runs and cross-correlates leak components to map kernel memory layout. Computes #KASLR slide, entropy bits, and renders virtual/physical memory maps. Now includes prefetch side-channel. github.com/bcoles/kasld
6
20
1,718
New tool: envex — extract and analyze environment variables from running Linux processes. Flags secrets and credentials across all processes using name heuristics, value pattern matching, and entropy analysis. No ptrace or special capabilities required. github.com/bcoles/envex
1
1
1
147
New tool: auth-log-scraper — search Linux auth logs for usernames that look like accidentally typed passwords. 100+ service-specific parsers (SSH, databases, web servers, monitoring, etc.), JSON/CSV output. Vibe coded, so YMMV. github.com/bcoles/auth-log-s…
1
1
115
bcoles retweeted
Qualys@qualysMar 12
Qualys Threat Research Unit (TRU) discovered CrackArmor: 9 AppArmor flaws impacting 12M+ Linux systems since 2017. These enable root access & container breakouts. Patch your kernels now! Details: bit.ly/4s2c3O4 #Linux #Cybersecurity #CrackArmor"
3
20
1
34
7,477
bcoles retweeted
Calif
@calif_ioMar 3
A Race Within A Race: Exploiting CVE-2025-38617 in Linux Packet Sockets. A step-by-step guide to exploiting a 20-year-old bug in the Linux kernel to achieve full privilege escalation and container escape, plus a cool bug-hunting heuristic. open.substack.com/pub/calif/…

A Race Within A Race: Exploiting CVE-2025-38617 in Linux Packet Sockets

A step-by-step guide to exploiting a 20-year-old bug in the Linux kernel to achieve full privilege escalation and container escape, plus a cool bug-hunting heuristic.

blog.calif.io
3
59
4
208
27,305
🎅mongobleed - poc for CVE-2025-14847. Leaks data from mongodb instances due to flaw in zlib message decompression. Reminiscent of heartbleed ❤️
16
141
11
702
125,495
If you're using #Hexstrike Server, be aware that it binds to all interfaces by default (which allows unauth remote command execution). github.com/0x4m4/hexstrike-a…
91
Local Privilege Escalation in Fedora Linux (CVE-2025-12744). Red Hat has made this public, but patches aren't out yet. Reliable root for any local user. Mitigation: sudo systemctl disable --now abrtd Writeup + PoC: initblog.com/2025/abrt-root/

Privilege Escalation in Fedora Linux: Exploiting ABRT for Root

In October 2025, I discovered CVE-2025-12744, a local privilege escalation affecting Fedora Linux. This post details how I chained a 12-byte command injection in the ABRT daemon into a three-stage...

initblog.com
10
21
2,483
I've released Rootkit Signal Hunter - a simple tool which detect rootkits which use signals to elevate process privileges. github.com/bcoles/rootkit-si…
1
1
9
854
Easily detects public rootkits like Singularity and Diamorphine. Not a novel approach. lsrootkit performs similar checks, but is abandoned (since 2018), doesn't compile, and requires root privileges.
105
Here is our 0day for kernelCTF🩸 - 82k bounty - quickest submission ever - all instances pwned😎 syst3mfailure.io/rbtree-fami… Disclaimer: We apologize for abusing the red black tree family. Turning grandparents against grandchildren is only acceptable in the context of pwn😤

[CVE-2025-38001] Exploiting All Google kernelCTF Instances And Debian 12 With A 0-Day For $82k: An...

CVE-2025-38001 is a Use-After-Free vulnerability in the Linux network packet scheduler, specifically in the HFSC queuing discipline. When the HFSC qdisc is utilized with NETEM and NETEM packet...

syst3mfailure.io
Crusaders of Rust@cor_ctf23 Jun 2025
Exploit write-ups for our 🚨latest 0-day🚨and the tragedy that swept the red black tree family dropping soon 👀 Here is a tiktok style video for those of you with no attention span thanks to slop and social media. Turn on the audio!!!
74
2
304
40,246
An introduction to Software Defined Radios. A thread for beginners on: 1. What a SDR is 2. What you can do with SDRs 3. How it plays a role in the security/hacking world 4. How it’s used in ham radio. 5. How to choose/buy one 6. Link to more reading material 0/21
24
268
18
2,137
161,908
Big new feature in kernel-hardening-checker: now it supports checking the Linux kernel security parameters for RISC-V ⚡️ (in addition to X86_64, ARM64, X86_32, and ARM). I've spent many weekends on this. Thanks to @_bcoles for the contribution ⭐️ github.com/a13xp0p0v/kernel-…

GitHub - a13xp0p0v/kernel-hardening-checker: A tool for checking the security hardening options of...

A tool for checking the security hardening options of the Linux kernel - a13xp0p0v/kernel-hardening-checker

github.com
2
33
1
128
7,410
Too Subtle to Notice: Investigating Executable Stack Issues in Linux Systems huhong789.github.io/papers/y…
6
22
2,197
KernelSnitch: Side-Channel Attacks on Kernel Data Structures Paper by Lukas Maar et al. about using a timing side-channel for leaking addresses of exploitation-relevant kernel structures. lukasmaar.github.io/papers/n…
1
72
2
276
26,929
Load more