-
Zombie COTables: Resurrecting Freed Memory to Escape VirtualBox
Excited to share this! Zombie COTables: Resurrecting Freed Memory to Escape VirtualBox. This blog post describes the exploitation process of a use-after-free vulnerability in the SVGA subsystem to achieve code execution on the Linux host machine. Enjoy! 🙂 You can find the post on the Exodus blog page.
-
Windows Sockets: From Registered I/O to SYSTEM Privileges
I published a post in collaboration with Exodus Intelligence describing the exploitation process for CVE-2024-38193, a use-after-free vulnerability in the afd.sys Windows driver. Hope you enjoy it! 🙂 Link to the article
-
VirtualBox is collapsing: a n-day story
Hi everyone! It’s been a while 🙂 This year I’ve worked on a project for the thesis for my bachelor’s degree regarding hypervisor exploitation. This was my first time looking at hypervisor exploitation, so I decided to start with a known vulnerability without a public exploit available. TL;DR: I managed…
-
DirtyCred Remastered: how to turn an UAF into Privilege Escalation
Background A few weeks ago, @kiks and I started to search for some recent CVEs in order to pratice our kernel exploitation skills. We chose CVE-2022-2602 as our target for two reasons: In the end, we were able to create a functional exploit using two different techniques: userfaultfd and inode locking. FUSE exploit coming…
-
Fuse for Linux Exploitation 101
During the past few weeks, my friend @kiks and I started to develop an exploit for CVE-2022-2602: it’s an io_uring UAF. We already completed the exploit using the userfaultfd technique to pause a kernel thread. Unfortunately, this technique is dead (thank you, vm.unprivileged_userfaultfd :/ ), so we started searching a good replacement for userfaultfd. While reading @chompie’s blogpost about io_uring, I stumbled…