氷 菓

Introduction This is my first pwn attempt on d8 engine. Write a blog to log the debugging process. Vulnerability Analysis According to the diff files given in the challenge, we can find it removes the length check of fill function of TypedArray. A simple script can trigger the crash TypeArray Internal To analyse the internal […]

Introduction Write a post to log the necessary steps for Linux Kernel pwn challenges in CTF. Extracting Files Usually a compressed file is given in challenges containing the following files: bzImage: the bootable image of the linux kernel rootfs.cpio: the file system used in the challenge shart.sh: the shell script to run qemu on the […]

Introduction After almost one and half year AFK, play CTF again. Vulnerability The vulnerability is easy to locate as given below. Function alloca alloccates 4*n bytes on stack, but the long-type number inserted on stack is 8-byte long. And it is easy to detect that there is something wrong. Since the variables from top to […]

因为工作的原因，今后无法更新linux上或android上的博客。最近都在学习做饭，在这里晒晒。以后要是找不到工作就去当个厨子试试。 烧黄花鱼 蒸鲈鱼 蒸扇贝 胡萝卜烧牛肉 土豆烧牛肉 蒸开边虾 萝卜肉丝 胡萝卜炒鸡胸肉 肉末烧豆角 肉末烧花菜 土豆烧豆角 粉丝蒸排骨 虾仁蒸蛋 剁椒鱼头 虾仁烧豆腐

Introduction I’d like to talk about the ret2usr attack in Linux kernel exploitation and the corresponding Supervisor Mode Execution Prevention (SMEP). Rather than detailing the exploitation details in control flow hijacking, this post will explain what is ret2usr attack and what is the expected behaviour from SMEP. ret2usr attack ret2usr (return-to-user) attack exploits the truth […]

Introduction This is a paper published in ACSAC 2018. In this paper, the author introduces a method to automatically generate exploitation primitives during the web browser exploitation. In this paper, the author uses CVE-2016-9079 as an example to demonstrate their work, which happens to be analysed in my post before. In this post, I’d like […]

Introduction This paper was published in CCS 2015. With the introduction of the various mitigation deployed in the user space, especially sandbox, the vulnerability in the linux kernel has become a target of the attacker. However, the memory space in the kernel is hard to predict since the kernel space are used by various tasks. […]

Introduction I will continue to talk about the exploitation of CVE-2017-7308. In this post, I will discuss the implementation details of buddy allocator and SLUB allocator in Linux-4.10.6. I will show how to put the victim object (struct packet_sock in this post) next adjacent to the vulnerable buffer (packet rv_ring buffer in previous post). In […]

Introduction These days I think there is still necessity to write a tutorial series on Linux Kernel exploitation and hope to summarize the kernel exploitation techniques as following: (1) Kernel Debugging (2) Return-oriented-Programming in Kernel (3) Kernel Mitigation: KASLR, SMEP, SMAP (4) Kernel Space Memory Allocator: SLAB Allocator In this post, I will introduce how […]

Introduction A few days ago, I happened to know that this is a simplified version of Keen Team’s exploit on Hua Wei baseband. Therefore, I decide to take this as a practice for ARM exploitation. This post is based on the write-up from 217[3] and KeenTeam[4]. I will add more reversing engineering details in this […]