Davide Ornaghi

A pentester doing security research while dumping NTDS

[Davide Ornaghi @TurtleARM97]

LPE for CVE-2023-0179 is live! Compatibility with other versions should be just a matter of offsets. It was nice not having to deal with stack offset randomization.
https://t.co/DvqIyXaerr

[Davide Ornaghi @TurtleARM97]

Here is a more up-to-date syz description of your favorite subsystem nftables, happy fuzzing!

https://t.co/Nz6QYWDn2g

[No Hat Con @nohatcon]

🎫 No hat Computer Security Conference 2024 tickets are NOW AVAILABLE on https://t.co/4nkC2GPjGk 🎫
See you in Bergamo, Italy on Oct 19th! #NoHat #Computer #Security #Conference #Community #Cybersecurity #NoHat2024

[Davide Ornaghi @TurtleARM97]

While testing and fixing a couple of NPDs in nftables, I found that reusing the subsystem after crashing triggers a UAF read on the previously freed task_struct when reacquiring the commit mutex, maybe worth a look?

https://t.co/Nr4ZoeRbsK

[Davide Ornaghi @TurtleARM97]

Syzkaller being mad about my custom grammar

[Davide Ornaghi @TurtleARM97]

I've written my first blog post on exploiting the Linux kernel, with bonus digressions on internals and rabbit holes.
Hope you enjoy the fancy graphics!

https://t.co/8yZ0yrjCCP
https://t.co/AmMjrvIKF2

[Lau @notselwyn]

Exciting news! 🚀 Just dropped my blogpost unveiling the universal Linux kernel LPE PoC for CVE-2024-1086 (working on v5.14 - v6.7) used for pwning Debian, Ubuntu, and KernelCTF Mitigation instances, including novel techniques like Dirty Pagedirectory 🧵

https://t.co/zFimVzjgYB

[Davide Ornaghi @TurtleARM97]

Added two less known PE payloads to the project:

core_pattern overwrite and syscall hooking (inspired by CVE-2022-0435)!
https://t.co/Tz58TGEbgS

[Davide Ornaghi @TurtleARM97]

Experimenting with mappable zero pages and privesc techniques for my DECnet vuln, still a WIP
https://t.co/GP3xPnFgAW

[Davide Ornaghi @TurtleARM97]

CVE-2023-3338 represents a series of issues I found in the Linux DECnet Layer (a 20-year-old protocol) that caused it to be removed from all LTS releases, the most obvious one being this NPD
https://t.co/Jao0NkzRX2

[Davide Ornaghi @TurtleARM97]

Quick gdb tip to access per-cpu variables in case lx_per_cpu doesn't work:

x __per_cpu_offset[$lx_current().cpu] + (unsigned long) var

[Davide Ornaghi @TurtleARM97]

Great opportunity to have fun with Linux pwning in the beautiful Bergamo!

[No Hat Con @nohatcon]

Do you wanna know more about vulnerability research and exploitation in the Linux Kernel? Join @TurtleARM97 workshop at #nohat2023!

[Davide Ornaghi @TurtleARM97]

Spent hours trying to mask timer interrupts on gdb to prevent LAPIC events when all I had to do was update QEMU

[HITBSecConf @HITBSecConf]

#HITB2023AMS #VIDEO #COMMSEC D2 - The Return of Stack Overflows in the Linux Kernel - Davide Ornaghi - https://t.co/yLWs4xFMB8

[Davide Ornaghi @TurtleARM97]

Writing CodeQL queries that actually do what you expect feels like magic

[Davide Ornaghi @TurtleARM97]

When your UAF read reallocation isn't behaving

[Davide Ornaghi @TurtleARM97]

@pimskeks @planetbeing @kernelpool @p0sixninja @Helthydriver @onlyxwings @embyte @bl4sty @l33tdawg @LinusHenze @EranShimony @OmerTsarfati @alexjplaskett @tihmstar It was awesome finally meeting you in person! Thanks again for making hacking even more fun

[Davide Ornaghi @TurtleARM97]

Why is SystemTap so hard to run on custom kernels ☹️

[Nikias Bassen @pimskeks]

I will be at @HITBSecConf #HITB2023AMS this week, if you are around, pull up, they have a free CommSec track too!

[HITBSecConf @HITBSecConf]

#HITB2023AMS COMMSEC: The Return of Stack Overflows in the Linux Kernel - Davide Ornaghi - https://t.co/yLWs4xFMB8

[Davide Ornaghi @TurtleARM97]

Looks like I’ll be speaking at @HITBSecConf about kernel (in)security and other exciting stuff!