tritoke🏳️‍🌈

Some idiot let me write code 😂...
🏳️‍🌈 he/they,
CTFing with @0rganizers

[OtterSec @osec_io]

The writeup is here. We achieved RCE in Minecraft Bedrock, turning a 4-byte heap overflow into complete client compromise.

@ryaagard details a universal, Bedrock-specific technique for bypassing ASLR and achieving arbitrary read / write primitives.

[tritoke🏳️‍🌈 @_tritoke]

@dynamicdyspatch @xpost1 @v4bel @grok I thought that too but grok did find the right part of the GitHub to paste back surprisingly...

[tritoke🏳️‍🌈 @_tritoke]

@RAHMANMEHDI1 @TrisH0x2A So it's actually used as the memcpy implementation in some languages such as go :) you can find many Duff's devices around their standard library!

[tritoke🏳️‍🌈 @_tritoke]

@MysteryHacker1 @badsectorlabs So this exploit effectively lets you change the page cache entry for a given file, so you can effectively change any file while it stays in the cache and have that write not persist to disk.

[annie @_annieversary]

what the Fuck https://t.co/jSWRRiEBQ5

[blackorbird @blackorbird]

Many Linux malware samples (notably BPFDoor and similar) hide using classic BPF (Berkeley Packet Filter) socket filters. These filters keep the malware dormant until it receives a very specific “magic packet” ,only then does it activate and reveal itself.
Manually reverse-engineering complex BPF programs (often 100–200+ instructions with heavy branching) to figure out the exact trigger packet used to take hours or even days. Cloudflare’s solution turns this into a process that runs in seconds.
https://t.co/p8tJ3mDucN
filterforge:
https://t.co/H7vdbLJFEb

[tritoke🏳️‍🌈 @_tritoke]

@popovicu94 Yea you can create sparse files which appear to be big but the kernel knows sections of them are empty :) https://t.co/PoKReGBjKg

[tritoke🏳️‍🌈 @_tritoke]

@popovicu94 Often if you are running on a system with journald you can view these without root with the -k flag :) journalctl -fkb should look most similar to normal dmesg output, still supports the level filtering other comments mentioned as well

[tritoke🏳️‍🌈 @_tritoke]

@shank_03 @davydog187 You can just cause an abort directly, std::process::abort :)
https://t.co/28l7KGVcni

[tritoke🏳️‍🌈 @_tritoke]

@BrodieOnLinux I use DWM and I haven't had the time / energy to try out DWL / give Wayland a proper shot, nothing against it just lack of energy :(

[Tavis Ormandy @taviso]

You can now jailbreak your AMD CPU! 🔥We've just released a full microcode toolchain, with source code and tutorials. https://t.co/4NYerRuFo1

[tritoke🏳️‍🌈 @_tritoke]

@teh_0xdeadbeef @_hyp3ri0n fwiw xxd can do a basic form of this with xxd -i :)

[tritoke🏳️‍🌈 @_tritoke]

@__phantomderp I've found IncludeIf to be quite helpful for working with this though it's a bit of a faff to configure :( https://t.co/8C30nzlLvD

[Universally Blocked 🟦🇮🇱🇺🇦☮️ @Moredumbtweets]

@jsrailton 🤔💭

[Giacomo 🪿 @isogenies]

This weekend I made xoflib with my friends Robin Jadoul and @_tritoke.

xoflib is a Python package for the Shake extendable-output functions (XOFs) written using pyO3 bindings to the sha3 Rust crate.

https://t.co/OSp5PcAsIf

[tritoke🏳️‍🌈 @_tritoke]

@DrawsMiguel @__phantomderp I've got similar by dereferencing an int by accident, via writing an int to an int*...

[tritoke🏳️‍🌈 @_tritoke]

@secundaa I love rust for having both! :D .rem_euclid ftw!

[tritoke🏳️‍🌈 @_tritoke]

@anaisbetts @fasterthanlime Wait is it not just the MSBs???

[tritoke🏳️‍🌈 @_tritoke]

@paulmillr @lukOlejnik @matthew_d_green They're speaking at RWC on Tuesday so I wonder if they will after that. I doubt it though a lot of academic attacks prefer to keep the source closed.

[tritoke🏳️‍🌈 @_tritoke]

@paulmillr @lukOlejnik @matthew_d_green I'm not sure I'd just assume these primitives are safe. The paper seems to have mentioned some examples but it certainly implies that this technique is not dependent on the type of cryptography used.