Exciting news! 🚀 Just dropped my blogpost unveiling the universal Linux kernel LPE PoC for CVE-2024-1086 (working on v5.14 - v6.7) used for pwning Debian, Ubuntu, and KernelCTF Mitigation instances, including novel techniques like Dirty Pagedirectory 🧵

pwning.tech/nftables

Hi everybody! I did a talk today about pagetable exploitation techniques on x64 Linux. I uploaded the slides to Github

I loved meeting everybody :)

github.com/Notselwyn/blog…

The award-winning Qualys Threat Research Unit (TRU) has discovered a critical vulnerability in OpenSSH, designated CVE-2024-6387 and aptly named "regreSSHion." This Remote Code Execution bug grants full root access, posing a significant exploitation risk. blog.qualys.com/vulnerabilitie…

Was nice knowing y'all 🫡

securityonline.info/cisa-warns-of-…

Iconv, set the charset to RCE: in the first blog post of this series, @cfreal_ will show a new exploitation vector to get RCE in PHP from a file read primitive, using a bug in iconv() (CVE-2024-2961) ambionics.io/blog/iconv-cve…

They don't know I wrote cve-2024-1086 exploit

Your NVMe Had Been Syz’ed: Fuzzing NVMe-oF/TCP Driver for Linux with Syzkaller

An article by @Alon_Z4 about externally fuzzing the NVMe-over-TCP packet parsing paths with syzkaller.

cyberark.com/resources/thre…

auth bypass confirmed!

> INFO:paramiko.transport:Authentication (password) successful!

mm_keyallowed_backdoor cmd 1 allows to override the response for mm_answer_authpassword with a custom one. if you set it to { u32(9), u8(13), u32(1), u32(0) } you can login with any pass 🤓

I've been reverse engineering the xz backdoor this weekend and have documented the payload format and written a proof-of-concept exploit for the RCE. The payloads are signed with an ED448 key, so I patched my own key into the backdoor for testing. :-)

github.com/amlweems/xzbot

To keep up with recent trends, I show how I managed to make the exploit fully fileless 🕵️‍♂️👻

By setting modprobe_path to an executable memfd (like "/proc/<exploit_pid>/fd/<privesc_script_fd>"), I can execute the privilege escalation script without writing it to a disk

Finally, to land the root shell and namespace escape, I also take a fileless approach 🔎

By hijacking the exploit's stdout and stdin fd's to a root shell from the modprobe_path-based privesc script, we finally get the beloved '#' 🏆

(∩^o^)⊃━☆ﾟ.*･｡ﾟ

did some tweaking, exploit works universally between v5.14 and v6.6.. 99% success rate on v6.4 with hardened config (excl auto init for v6.4>) lol

blogpost soon

^with nftables and unpriv userns enabled. no biggie folks :^)

Goals for 2022:
- Top #300 on tryhackme
- OSCP
- Start doing CTFs and challenges on HTB
- Get an IT related job
- Get more experience with C, C++ and reverse engineering
- Learn Linux internals better

Goals for 2023:
- OSED
- Get more experience with obfuscation
- Start doing Linux kernel exploit dev
- Start learning Windows internals
- Learn Rust and Webasm

Goals for 2024:
- Contribute mind boggling research to the community
- Experiment with Rust in the Linux kernel
- Learn Android VR
- Learn Browser VR

I wrote a new blogpost about adding ksmbd (SMB server in the Linux kernel) fuzzing functionality to Syzkaller.

Feel free to send a DM if you have any questions :-)

pwning.tech/ksmbd-syzkalle…

#syzkaller #linux #ksmbd #vr #vulnres #fuzzing #zeroday #exploit