THE KNOWLEDGE IS THE WORK.
Resources(82)
Windows 10 RS2/RS3 GDI data-only exploitation tales (OffensiveCon 2018)
Nikos Sampanis
Hello, I'm Nikos Sampanis, a security researcher working at CENSUS. On February 16th, 2018 I presented at OffensiveCon a talk with the title "Windows 10 RS2/RS3 GDI data-only exploitation tales". The presentation focused on a mitigation introduced in the Win32k component of Microsoft Windows to prevent the...
iOS kernel exploitation archaeology (34th Chaos Communication Congress)
Patroklos Argyroudis
On December 27th 2017 I presented at the 34th Chaos Communication Congress (34C3) a talk on the technical details and the process of reverse engineering and re-implementation of the evasi0n7 jailbreak's main kernel exploit, titled "iOS kernel exploitation archaeology". Actually, I gave the same talk at the WarCon...
The Linux kernel memory allocators from an exploitation perspective
Patroklos Argyroudis
In anticipation of Dan Rosenberg's talk on exploiting the Linux kernel's SLOB memory allocator at the Infiltrate security conference and because I recently had a discussion with some friends about the different kernel memory allocators in Linux, I decided to write this quick introduction. I will present some of the...
FreeBSD kernel NFS client local vulnerabilities
Patroklos Argyroudis
.3‑RELEASE, and 8.0Short description:** Two improper input‑validation flaws in the FreeBSD NFS client (versions 7.2‑RELEASE, 7.3‑RELEASE, and 8.0‑RELEASE) allow local unprivileged users to trigger kernel stack and kernel heap overflows through crafted arguments to the mount(2) and nmount(2) system calls when...
FreeBSD kernel exploitation mitigations
Patroklos Argyroudis
In my recent Black Hat Europe 2010 talk I gave an overview of the kernel exploitation prevention mechanisms that exist on FreeBSD. A few people at the conference have subsequently asked me to elaborate on the subject. In this post I will collect all the information from my talk and the various discussions I had in the...
Linux kernel SUNRPC off-by-two buffer overflow
Patroklos Argyroudis
An off‑by‑two stack buffer overflow in the Linux SUNRPC subsystem (kernel versions 2.6.32 through 2.6.32‑rc7) allows out‑of‑bounds writes in the function rpc_uaddr2sockaddr() when processing universal address strings of maximum length. Because the function writes two bytes past the end of a fixed‑size stack buffer, a...
CVE-2008-3531: FreeBSD kernel stack overflow exploit development
Patroklos Argyroudis
About four months ago I developed a reliable exploit for vulnerability CVE-2008-3531, which is also addressed in the advisory FreeBSD-SA-08:08.nmount. In this post I will use this vulnerability to provide an overview of the development process for FreeBSD kernel stack exploits.