May or may not install distcc on your coffee machine
Joined February 2021
- Tweets61
- Following465
- Followers1.3K
- Likes6.6K
Pinned Tweet
Exciting news! 🚀 Just dropped my blogpost unveiling the universal Linux kernel LPE PoC for CVE-2024-1086 (working on v5.14 - v6.7) used for pwning Debian, Ubuntu, and KernelCTF Mitigation instances, including novel techniques like Dirty Pagedirectory 🧵
pwning.tech/nftables
Hi everybody! I did a talk today about pagetable exploitation techniques on x64 Linux. I uploaded the slides to Github
I loved meeting everybody :)
github.com/Notselwyn/blogpos…
Lau retweeted
The award-winning Qualys Threat Research Unit (TRU) has discovered a critical vulnerability in OpenSSH, designated CVE-2024-6387 and aptly named "regreSSHion." This Remote Code Execution bug grants full root access, posing a significant exploitation risk. blog.qualys.com/vulnerabilit…
Was nice knowing y'all 🫡
securityonline.info/cisa-war…
Lau retweeted
Iconv, set the charset to RCE: in the first blog post of this series, @cfreal_ will show a new exploitation vector to get RCE in PHP from a file read primitive, using a bug in iconv() (CVE-2024-2961) ambionics.io/blog/iconv-cve-…
They don't know I wrote cve-2024-1086 exploit
Thank you to everyone who showed up tonight! 💚
First talk is at 10:00, so good night and sober up fast :)
Good luck to all Lobbycon attendees, we hope to still see you tomorrow ;) 🥃
#GeckoParty #Offensivecon24
@offensive_con
Lau retweeted
Your NVMe Had Been Syz’ed: Fuzzing NVMe-oF/TCP Driver for Linux with Syzkaller
An article by @Alon_Z4 about externally fuzzing the NVMe-over-TCP packet parsing paths with syzkaller.
cyberark.com/resources/threa…
Lau retweeted
auth bypass confirmed!
> INFO:paramiko.transport:Authentication (password) successful!
mm_keyallowed_backdoor cmd 1 allows to override the response for mm_answer_authpassword with a custom one. if you set it to { u32(9), u8(13), u32(1), u32(0) } you can login with any pass 🤓
Lau retweeted
I've been reverse engineering the xz backdoor this weekend and have documented the payload format and written a proof-of-concept exploit for the RCE. The payloads are signed with an ED448 key, so I patched my own key into the backdoor for testing. :-)
github.com/amlweems/xzbot
To keep up with recent trends, I show how I managed to make the exploit fully fileless 🕵️♂️👻
By setting modprobe_path to an executable memfd (like "/proc/<exploit_pid>/fd/<privesc_script_fd>"), I can execute the privilege escalation script without writing it to a disk
ALT Image of psuedo-C code, describing the workflow for fileless privilege escalation with modprobe_path.
Finally, to land the root shell and namespace escape, I also take a fileless approach 🔎
By hijacking the exploit's stdout and stdin fd's to a root shell from the modprobe_path-based privesc script, we finally get the beloved '#' 🏆
ALT Image of a user shell being escalated to a root shell using the CVE-2024-1086 Proof-of-Concept exploit, including exploit logs.
Goals for 2023:
- OSED
- Get more experience with obfuscation
- Start doing Linux kernel exploit dev
- Start learning Windows internals
- Learn Rust and Webasm
I wrote a new blogpost about adding ksmbd (SMB server in the Linux kernel) fuzzing functionality to Syzkaller.
Feel free to send a DM if you have any questions :-)
pwning.tech/ksmbd-syzkaller/
#syzkaller #linux #ksmbd #vr #vulnres #fuzzing #zeroday #exploit
