We open sourced PathAuditor: a tool for Linux that
@rozek_marta
and I worked on this summer.
Tl;dr: you can use it to instrument root daemons and find insecure file access patterns like CVE-2019-3461.
Check out the code:
Blog post:
We just released the challenges of this year's
#GoogleCTF
finals together with a short write up of the intended solutions:
If anything is not clear, feel free to DM me and I can share more details about the challenges.
Here are the slides from my
#Zer0con2019
talk about TurboFan (Chrome's javascript compiler).
If you have any questions, please leave a comment in the slides and I'll try to explain it in the speaker's notes.
We just released v1.0 of kCTF our kubernetes based infrastructure for CTF competitions.
Check it out here:
With kCTF we tried to address to issues we often heard about:
* no experience with k8s
* worry about introducing security issues
(1/3)
We just started the
#v8CTF
: a new exploit bounty program for v8!
* $10,000
* N-day vulnerabilities are in scope, but limited to first submission per deployed v8 version
* unlimited for self-found bugs (on top of regular VRP)
More info here:
We just announced a new bug bounty on a hardened kubernetes cluster.
The fun part: 1days are explicitly in scope!
Want to exploit a public
#syzkaller
bug that hasn't been patched in our cluster yet? That's fair game.
More info here:
The exploit for my Chrome/v8 challenge from the
#GoogleCTF
finals is now public. You can find it here: .
You had to exploit an JIT optimization pass that would turn 1+1 into 2.
#GoogleCTF
is on and we have challenges related to hardware, crypto, reversing, web, sandbox and of course pwnables. Every category comes with an easy challenge aimed at beginners.
Check it out here:
The first
#v8CTF
submission is now public:
Note that the current flag is still up for grabs, maybe M118 is unhackable? ;P
You should also check out
@madstacks3
's excellent writeup at
Looks like I'll be in vegas this summer
@BlackHatEvents
:).
I'm going to present about some logic bugs I found in Mojo and how they affected Chrome's sandbox.
This was one of the most complicated exploits I've ever written, looking forward to talk about it.
#BHUSA
I prepared 2 challenges for the
#GoogleCTF
this year:
1) sendbox: a user namespace jail
2) ipcz: a challenge based on a new IPC protocol that you can find in the chromium sources
You can find both challenges and solutions at
🧵
I'm excited (and also a little sad) to announce that after 3 fantastic years with Project Zero, it's time for me to try something new. So starting this month, I'll be building up and leading a new V8 security team at Google!
The Google CTF is happening again this year (June 23rd/24th). We promise to have some easier challenges this time so make sure to check it out even if you're new to CTFs.
The recording of my
#OffensiveCon20
talk is up in which I demo a Chrome sandbox escape using RIDL:
The exploit is still working as of today.
PS: I would love some feedback! I don't give many talks but prepared a lot for this: so what worked/didn't work?
Patch-gapping Chrome became much harder as
@_2can
and
@sherl0ck__
just showed in their amazing blog post. Easy mode is to target embedded browsers instead since those are usually ancient.
Case in point, here's an RCE for Steam on Linux:
Really cool talk by
@tjbecker_
on his Chrome sandbox escape:
Exploiting a UaF in the browser process without any info leak since Windows maps libraries at the same address in different processes.
Thanks to osmocombb and the whole osmocom GSM network stack components I was able to build my own GSM phone for a
#35c3ctf
challenge. Any similarity with previous commercial phones is a pure coincidence. If you want to hack this thing, check out newphonewhodis and identitytheft.
For
#WCTF
this year we prepared two browser challenges.
In the first one you had to get code execution in the renderer and the second was accessing a cross-origin website from a compromised renderer with site isolation in place. (1/n)
I couldn't find a working RIDL exploit on the internet so I made it a challenge at the
#GoogleCTF
. 5/10 teams solved it in under 24h. I heard at least
@dsredford
will publish an exploit soon, stay tuned ;)
And here are the writeups for my challenges.
krautflare:
@anbiondo
made a really amazing writeup with in detail description of v8 turbofan's inner workings:
namespaces: chroot escape + ptracing the supervisor
1/2
The
#35c3ctf
started and I some challenges:
krautflare: write an exploit for
namespaces: a linux user namespaces sandbox
filemanager: a web challenge
logrotate: exploit my logrotate(8) config to get a root shell
And if you're at
#35c3
come and say hi!
Cool, another public Spectre exploit in JavaScript:
It's using type confusion in Chrome, similar to .
If you own a website with multiple subdomains, make sure to follow to protect against these attacks.
I gave a lightning talk at the
#36c3
on PathAuditor:
The main point I tried to make is that this bug class is fun to research and easy to find.
If you've watched it, I'd love some feedback:
If you liked my logrotate
#35c3ctf
challenge, check out this bug in tmpreaper: .
The vulnerable pattern was:
rename("/tmp/foo", "/tmp/foo/X")
Though I didn't write a full exploit I believe this should give you a root shell.
A blast from the past. The first vulnerability I ever found and the stars aligned to make it exploitable:
* spoof localhost ipv6 packets
* bruteforce a weak password
* a bss buffer overflow into a pointer
* bruteforce libc since OS X did ASLR at boot
Felt like a CTF challenge :)
This is another old (7+ years) P0 post that I had missed. This time it’s an amazing xdev writeup by
@_tsuro
:
Finding and exploiting ntpd vulnerabilities
I love the direction of
@RealWorldCTF
and I would like to see more real world targets in other CTFs as well.
In particular, some beginner friendly challenges would be nice since most of these were really tough :).
Ghostbuster is the sole challenge of the Donjon CTF which remained unsolved, but not unexplained. The exploit and the writeup are now public: . Lesson learned: CPUs are tricky! 👻
#spectre
Make sure to check out while you're at it. I spent a lot of time on those anmiations ;).
tl;dr: we access a cache line once and keep it in L1 indefinitely while probing the other elements. This allows us to inflate the timing difference for measurement.
Cloudflare seems to have a very different risk perception than me. It sounds like they spent a lot of time thinking about how to mitigate Spectre in this platform but they don't care much for v8 0days / 1days.
Here's my exploit for my heap challenge (300) of the
#34c3ctf
. I solved it by overwriting (older) libc's check_action variable using a corrupted unsorted bin. This disables abort on error and gives a write-what-where primitive.
My weekend project: a small webapp to translate manga for me. It's using the Google Cloud Vision API for OCR and then a iframe to show translations. Next feature will be to automatically add the words to flash cards.
Hardest part was the CSS :)
The
#35c3ctf
started and I some challenges:
krautflare: write an exploit for
namespaces: a linux user namespaces sandbox
filemanager: a web challenge
logrotate: exploit my logrotate(8) config to get a root shell
And if you're at
#35c3
come and say hi!
I was curious and installed the messenger app:
Chrome 83. --no-sandbox.
Do electron apps with an up to date Chrome exist or is js exec always RCE by design?
Everyone is talking about the virus but how is the preauth RCE still not patched?
The vendor was probably like: requires physical proximity? => Low risk, won't fix
I wrote an optimization pass that replaced x + 1 + 1 with x + 2 in v8 for the
#GoogleCTF
finals. Bummed that nobody solved it. Can someone at least trigger a crash? :)
security concerns:
* we believe the infrastructure provides a reasonable level of security for CTF competitions
* if you're able to break it, you can get up to $10k in our VRP!
* that includes public bugs, you don't have to find a 0day :)
*
(3/3)
Here's my exploit for the duktype interpreter (used in a challenge in this year's
#defconctf
). tl;dr: the DUK_OP_SETALEN doesn't do any type checks and it gives you an easy arbitrary write.
4th part of my series on Chrome Browser Exploitation is out. This part focuses on Turbofan, topics covered include:
1. Sea of Nodes Graph Representation
2. Turbolizer
3. Various Optimization Passes
Here's a fun bug in bubblewrap (in rare configs only):
If you're bored, this would have made a fun CTF challenge similar to my usual namespace challenges :). Just assume it's suid and unpriv user ns is available.
cc
@pastenctf
@boryspop
@adam_iwaniuk
I am so excited , finally, I got 2nd blood of v8ctf, wait to comfirm, my exp need to brute, but i will write a writeup to prove I can increase its success rate!
If you played the
#GoogleCTF
this weekend please give us feedback at .
I heard some challenges were guessy so it will be very helpful if you can share details on which and why. Thanks!
I just upgraded to Ubuntu 19.10 and noticed that they enable -fcf-protection by default in gcc which adds an endbr64 instruction in every function prologue. This seems strange for two reasons:
filemanager: xs-search by abusing chrome's xss auditor as an oracle. Write-up from
@l4wio
here:
logrotate: if you configure logrotate to touch user-controlled directories, you can race it to get a root shell:
My exploit code for `filemanager` challenge
#35c3CTF
(just had time to do 1 challenge)
It's about XS-Search abusing XSS Auditor.
Thanks
@_tsuro
for such fun challenge.
E.g. it seems their approach for v8 bugs is mitigations + detection and hoping that their customer data is not valuable enough for attackers to use a 1day v8 bug for?
So every high risk v8 bug is now a critical bug for Cloudflare?