0Dr3f

Vulnerability Research & Exploit Development 💻

[0Dr3f @0Dr3f]

Created a blog post explaining physical memory primitives, how they can be exploited and how we can abuse the address translation mechanism to access any memory on a system as well as inject code into any process.

https://t.co/OHcTR1Ocvy

[0Dr3f @0Dr3f]

@richinseattle @offensive_con Looking forward to it

[0Dr3f @0Dr3f]

@kaotickjay @netsoftsoltnstn @TheHackersNews B-but.. tracking!

[0Dr3f @0Dr3f]

@yarden_shafir @33y0re Is there a reason they didn't include the 'normal' syscall table and just the win32k one? Or is this also in there.

[0Dr3f @0Dr3f]

@anio57208 Thanks!

Because I was looking for ways to find the system CR3, I started searching physical memory for the CR3 value on a debugger machine. Thats how I noticed this static value/offset. I have not taken the time to further figure out why it's there.

[0Dr3f @0Dr3f]

Created a blog post explaining physical memory primitives, how they can be exploited and how we can abuse the address translation mechanism to access any memory on a system as well as inject code into any process.

https://t.co/OHcTR1Ocvy

[0Dr3f @0Dr3f]

@chompie1337 Every exploit dev has once in their life lost some hairs over this. (Atleast I have)

[0Dr3f @0Dr3f]

@mrexodia @ptracesecurity Thanks

[0Dr3f @0Dr3f]

@sixtyvividtails The translation results in the PTE for VA 0 yes. But the PML4E of MmPteBase points to it's PML4 Table, thus is a self ref entry. You can literally see it in the debugger..

[0Dr3f @0Dr3f]

@sixtyvividtails In my post I'm referring to self reference entries and why the MmPteBase can be mapped the way it is. It actually points to a self reference entry. You're right no table is technically "skipped", PML4 just traverses twice. I'll change the wording to avoid confusion. Thanks!

[POC_Crew @POC_Crew]

Pew, just came back to work from the long journey.
Thanks everyone for making another great success on #Zer0Con2024! Wish you all safe travel back home and most importantly take a good rest!
We will be around at the @offensive_con, if you are there, let's grab a drink 🙌

[0Dr3f @0Dr3f]

Arrived at #Zer0Con, see you guys there!

[0Dr3f @0Dr3f]

@FuzzySec @CalypsoLabs @vector35 Ayy Congrats dude! Content look great 🔥

[0Dr3f @0Dr3f]

I'll be over at #Zer0Con2024 the upcoming month. If anyone wants to talk windows kernel, security in general, or just hang out let me know!

[0Dr3f @0Dr3f]

@FuzzySec @POC_Crew Cool! Yea I'll be there too 🤘🏻

[0Dr3f @0Dr3f]

@matterpreter So you're the reason why my report was a duplicate 🫠. Beat me to it by about a month, nice work!

[0Dr3f @0Dr3f]

@netero_1010 @offsectraining @Blomster81 @_sickn3ss_ Def is :)

[0Dr3f @0Dr3f]

Finally managed to retrieve all the flags and pass the #OSEE exam! Thanks @offsectraining, @Blomster81, and @_sickn3ss_ for this great learning opportunity and fun (but exhausting) exam!

[0Dr3f @0Dr3f]

@0xsu3ks @offsectraining @Blomster81 @_sickn3ss_ Thanks!

[0Dr3f @0Dr3f]

@th31nitiate @offsectraining @Blomster81 @_sickn3ss_ There are certain challenges that allow you to earn a challenge coin. If you complete both, you get 2 :)

[0Dr3f @0Dr3f]

And that wraps up AWE from @offsectraining. Thanks @Blomster81 and @_sickn3ss_ for this amazing training. Time to continue this journey towards becoming an #OSEE.

[0Dr3f @0Dr3f]

@w4fz5uck5 @offsectraining @Blomster81 @_sickn3ss_ Thanks!