Tagged
#exploitation
3 posts
A Remote Pwn Target
Turning the toy kernel into a real remote CTF: a unique flag that lives only in one server's RAM, and the far harder half — building a blast chamber where strangers can detonate exploits at me without taking the house down. The bug was an afternoon; the isolation was the month.
ReadAttacking the Lies About Disk Layout
A flag hidden in the RAM disk with no name, a crafted directory entry that reads it right out, and the one-field fix that turns 'in the image' into 'in the data.' A bounds check is only as trustworthy as the bound it compares against.
ReadThe confused deputy
I planted a flag on a kernel-only page and wrote a ring-3 program to steal it. The CPU stopped the direct read cold — then my own syscall handed the flag over the moment it dereferenced a caller-chosen pointer. The one door the hardware cannot guard for you.
Read