Collaborate Disseminate
I’m trying to learn exploitdev for fun. While researching cve-2023-20938 (android binder uaf), I encountered a barrier. I need to create binder_node in my process and get handle for that binder_node in order to send malicious transactions…. Continue reading Get Handle for Binder_node through in Android [closed]
I am trying to write a mitmproxy addon that allows me to automatically intercept a TLS connection from a client by using the hostname and then on-the-fly generate a new certificate (with pyOpenSSL and cryptography) and serve that certifica… Continue reading Intercepting a TLS connection and serving a different certificate based on hostname
I am researching kernel exploit mitigations and their bypasses—specifically focusing on how the physmap interacts with SMAP.
I am trying to determine if the physmap is currently mapped with execution permissions ($RWX$) or if it is restric… Continue reading How to check if physmpa is executable in linux kernel
I was trying to write exploit for cve-2017-11176, but at the final stage of exploit, I need to use ROP chain to disable SMEP. Sooo, I think explanation is not necessary here.
So simply I have ROP CHAIN like this:
// To save 32bits of RSP t… Continue reading XCHG instruction changes RSP and RIP in ROP-Chain exploit
I’m using Ropper to find ROP gadgets in CTF challenges or real-world exploit dev stuff. Is there any way to exclude some instruction from Ropper output? For example, I need mov rcx, rbp gadgets but I don’t want to see results. Those includ… Continue reading Exclude results that contains some instructions in Ropper output