Bonfee

Pwners in Paris

Hi @discord! We are hosting @ecsc2024 right now and we have our IP banned, we opened a ticket without answers, can you please write us? DM or info@ecsc2024.it ⚠️

New faces + old faces, playing DEF CON CTF and @hack_a_sat in parallel. Proud of us. 🍝

Cool kernel pwn challenge from corCTF 2023, CVE-2023-0461 + kCFI + limited set of available syscalls

Qualified for DEFCON Finals with @aboutblankets and @mhackeroni

🚩

Lets go 🔥 awesome sleep deprivation weekend 😂

@hexacon_fr was amazing, congrats to the organizers :)

The challenge was awesome, especially the Hyper-V VM escape part See you in Paris 😄

The bug was assigned CVE-2022-0995. Here is the exploit: github.com/Bonfee/CVE-202…. 1 bit oob write is all it takes :)

@BruteBee It's not that one :)

@Bonfee1 It does, CVE-2022-27666 :)

Another Ubuntu 21.10 LPE :) This bug doesn't even have a CVE yet. To pwn it I used the same technique described here: google.github.io/security-resea…. I'll clean the code just a bit, before releasing it

@alexjplaskett 👀

@Bonfee1 Heh does the commit hash fixing the bug end in 2?

@alexjplaskett Nope :)

@Bonfee1 Nice one! Your vuln object is on the kmalloc-2k cache? Interested to know if I know this bug 😂

@clubby789 yep, it was introduced in 5.x

@Bonfee1 Nice one - is this another bug that was introduced in 5.x, or does it go back further?

( Just to be clear, this is not a 0 day, i only saw the commit fixing the bug and developed the exploit for it. )

@raesene @Terenceliqiang With the proper ropchain yes. If you are talking specifically about google kctf, then no because the kernel is compiled without the required CONFIG_ :(

@Bonfee1 @Terenceliqiang Nice! Does this one do container breakout like 2021-22555 ?

CVE-2022-25636 exploit - LPE on Ubuntu 21.10, using the FUSE technique ( which i first saw from @cor_ctf ). I also developed an exploit which is not using FUSE, but for now: github.com/Bonfee/CVE-202…. I'll soon publish a writeup with the exploitation details.

It finally arrived :)

#nohat @nohatcon