Lau (@notselwyn) / X

Lau

60 posts

Lau

@notselwyn

May or may not install distcc on your coffee machine

Joined February 2021

Pinned
Lau
@notselwyn
Mar 26, 2024
Exciting news! 🚀 Just dropped my blogpost unveiling the universal Linux kernel LPE PoC for CVE-2024-1086 (working on v5.14 - v6.7) used for pwning Debian, Ubuntu, and KernelCTF Mitigation instances, including novel techniques like Dirty Pagedirectory 🧵
Flipping Pages: An analysis of a new Linux vulnerability in nf_tables and hardened exploitation...
From pwning.tech
115K
Lau
@notselwyn
Sep 16, 2023
I wrote a new blogpost about adding ksmbd (SMB server in the Linux kernel) fuzzing functionality to Syzkaller. Feel free to send a DM if you have any questions :-) pwning.tech/ksmbd-syzkalle… #syzkaller #linux #ksmbd #vr #vulnres #fuzzing #zeroday #exploit
Tickling ksmbd: fuzzing SMB in the Linux kernel
From pwning.tech
17K
Lau
@notselwyn
May 11, 2024
They don't know I wrote cve-2024-1086 exploit
Binary Gecko
@Binary_Gecko
May 11, 2024
Thank you to everyone who showed up tonight! 💚 First talk is at 10:00, so good night and sober up fast :) Good luck to all Lobbycon attendees, we hope to still see you tomorrow ;) 🥃 #GeckoParty #Offensivecon24 @offensive_con
4.5K
Lau
@notselwyn
Mar 26, 2024
Replying to @notselwyn
In the blogpost, I explain the sourcecode (linked below) for the proof-of-concept exploit with background information and diagrams 🔬💾 In this X/Twitter thread I'm going to share some exploit snippets 📝
GitHub - Notselwyn/CVE-2024-1086: Universal local privilege escalation Proof-of-Concept exploit for...
From github.com
3.2K
Lau
@notselwyn
Mar 26, 2024
Replying to @notselwyn
To keep up with recent trends, I show how I managed to make the exploit fully fileless 🕵️‍♂️👻 By setting modprobe_path to an executable memfd (like "/proc/<exploit_pid>/fd/<privesc_script_fd>"), I can execute the privilege escalation script without writing it to a disk
2.8K
Lau
@notselwyn
Mar 26, 2024
Replying to @notselwyn
Finally, to land the root shell and namespace escape, I also take a fileless approach 🔎 By hijacking the exploit's stdout and stdin fd's to a root shell from the modprobe_path-based privesc script, we finally get the beloved '#' 🏆
2.5K
Lau
@notselwyn
Dec 3, 2023
(∩^o^)⊃━☆ﾟ.*･｡ﾟ
00:00
1.4K
Lau
@notselwyn
Mar 16, 2024
Replying to @notselwyn
did some tweaking, exploit works universally between v5.14 and v6.6.. 99% success rate on v6.4 with hardened config (excl auto init for v6.4>) lol blogpost soon
1.7K
Lau
@notselwyn
Mar 26, 2024
Replying to @notselwyn
In the blogpost I reveal several novel techniques such as Dirty Pagedirectory 📂 Dirty Pagedirectory is a new KSMA technique used to R/W to all physical memory pages in a Linux system, from userland I use this to overwrite modprobe_path, which is in a read-only kernel page
1.9K
Lau
@notselwyn
Jun 19, 2024
Replying to @Lemonitup
github poc when
11K
Lau
@notselwyn
Feb 1, 2024
Replying to @notselwyn
blogpost & proof of concept soon... root + namespace escape on kernelctf mitigation instance 👀
cvedetails.com
CVE-2024-1086 : A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables compon
CVE-2024-1086 : A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_v
317
Lau
@notselwyn
May 31, 2024
Was nice knowing y'all 🫡
CISA Warns of Actively Exploited Linux Kernel and Check Point Gateway Vulnerabilities
From securityonline.info
1.3K
Lau
@notselwyn
Mar 27, 2024
Replying to @bl4sty
Thanks 🙌 I utilized draw.io. I've written a bit about this on the infra page pwning.tech/infra
765
Lau
@notselwyn
Dec 24, 2023
Replying to @notselwyn
Goals for 2024: - Contribute mind boggling research to the community - Experiment with Rust in the Linux kernel - Learn Android VR - Learn Browser VR
896