corpus.blog
56,966 blogs · 4,417,066 posts Claim your blog
Record · corpus.blog/posts/01a087e8-e816-72ab-bf84-ad71fba3a9e6

[corCTF 2022] CoRJail: From Null Byte Overflow To Docker Escape Exploiting poll_list Objects In The Linux Kernel

syst3mfailure.io · published 17 August 2022

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at syst3mfailure.io Wayback capture
1blogs citing
First cited
17 Aug 2022
Most recent
17 Aug 2022
Rank this month
not ranked
Links from this post
54
Words captured
12,672

Cited by

Blog
In the post
Date
willsroot.io
Reviving Exploits Against Cred Structs - Six Byte Cross Cache Overflow to Leakless Data-Oriented Kernel Pwnage Read at the source ↗
17 Aug 2022

Links from this post

Link
Host
https://ctftime.org/event/1656
ctftime.org
https://google.github.io/kctf/vrp.html
google.github.io
https://github.com/google/nsjail
github.com
https://cloud.google.com/container-optimized-os/docs
cloud.google.com
https://ctftime.org/event/1364
ctftime.org
https://www.willsroot.io/2021/08/corctf-2021-fire-of-salvation-writeup.html
willsroot.io
[corCTF 2021] Wall Of Perdition: Utilizing msg_msg Objects For Arbitrary Read And Arbitrary Write In The Linux Kernel Read at the source ↗
syst3mfailure.io
https://elixir.bootlin.com/linux/v5.10.127/source/include/linux/msg.h
elixir.bootlin.com
https://www.kernel.org/doc/html/latest/admin-guide/mm/userfaultfd.html
kernel.org
https://www.kernel.org/doc/html/latest/filesystems/fuse.html
kernel.org
Reviving Exploits Against Cred Structs - Six Byte Cross Cache Overflow to Leakless Data-Oriented Kernel Pwnage Read at the source ↗
willsroot.io
https://github.com/moby/moby/blob/master/profiles/seccomp/default.json
github.com
https://linux.die.net/man/2/msgget
linux.die.net
https://linux.die.net/man/2/msgsnd
linux.die.net
https://linux.die.net/man/2/msgrcv
linux.die.net
https://linux.die.net/man/2/add_key
linux.die.net
https://linux.die.net/man/2/keyctl
linux.die.net
https://www.kernel.org/doc/html/v4.13/security/keys/core.html
kernel.org
https://github.com/Crusaders-of-Rust/corCTF-2022-public-challenge-archive/blob/master/pwn/corjail/task/build/coros/files/docker/seccomp.json
github.com
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/snapshot/linux-5.10.127.tar.gz
git.kernel.org
https://github.com/Crusaders-of-Rust/corCTF-2022-public-challenge-archive/blob/master/pwn/corjail/task/build/kernel/patch
github.com
https://lwn.net/Articles/896474/
lwn.net
https://kernel.dk/io_uring.pdf
kernel.dk
https://wiki.nftables.org/wiki-nftables/index.php/What_is_nftables%3F
wiki.nftables.org
https://github.com/smallkirby/kernelpwn/blob/master/technique/modprobe_path.md
github.com
https://github.com/Crusaders-of-Rust/corCTF-2022-public-challenge-archive/tree/master/pwn/corjail
github.com
https://linux.die.net/man/2/unshare
linux.die.net
https://elixir.bootlin.com/linux/v5.10.127/source/fs/select.c
elixir.bootlin.com
https://linux.die.net/man/3/poll
linux.die.net
https://elixir.bootlin.com/linux/v5.10.127/source/include/linux/xattr.h
elixir.bootlin.com
https://elixir.bootlin.com/linux/v5.10.127/source/include/keys/user-type.h
elixir.bootlin.com
https://elixir.bootlin.com/linux/v5.10.127/source/security/keys/user_defined.c
elixir.bootlin.com
https://elixir.bootlin.com/linux/v5.10.127/source/fs/xattr.c
elixir.bootlin.com
https://linux.die.net/man/2/sched_setaffinity
linux.die.net
https://elixir.bootlin.com/linux/v5.10.127/source/include/linux/seq_file.h
elixir.bootlin.com
https://elixir.bootlin.com/linux/v5.10.127/source/fs/seq_file.c
elixir.bootlin.com
https://elixir.bootlin.com/linux/v5.10.127/source/fs/proc/base.c
elixir.bootlin.com
https://linux.die.net/man/4/ptmx
linux.die.net
https://elixir.bootlin.com/linux/v5.10.127/source/include/linux/tty.h
elixir.bootlin.com
https://elixir.bootlin.com/linux/v5.10.127/source/include/linux/tty_driver.h
elixir.bootlin.com
https://elixir.bootlin.com/linux/v5.10.127/source/include/linux/pipe_fs_i.h
elixir.bootlin.com
https://elixir.bootlin.com/linux/v5.10.127/source/fs/pipe.c
elixir.bootlin.com
https://elixir.bootlin.com/linux/v5.10.127/source/kernel/cred.c
elixir.bootlin.com
https://elixir.bootlin.com/linux/v5.10.127/source/kernel/pid.c
elixir.bootlin.com
https://elixir.bootlin.com/linux/v5.10.127/source/kernel/nsproxy.c
elixir.bootlin.com
https://linux.die.net/man/2/setns
linux.die.net
https://elixir.bootlin.com/linux/v5.10.127/source/fs/fs_struct.c
elixir.bootlin.com
https://elixir.bootlin.com/linux/v5.10.127/source/include/linux/fs_struct.h
elixir.bootlin.com
https://syst3mfailure.io//assets/files/exploit.c
syst3mfailure.io
https://kylebot.net
kylebot.net
https://www.man7.org/linux/man-pages/man7/xattr.7.html
man7.org
https://www.starlabs.sg/blog/2022/06-io_uring-new-code-new-bugs-and-a-new-exploit-technique/
starlabs.sg
https://elixir.bootlin.com/linux/v5.10.127/source/include/linux/fs.h
elixir.bootlin.com
About Read at the source ↗
syst3mfailure.io