Bonfee

Security researcher | CTF @aboutblankets

[Marco Bonelli @mebeim]

Pwners in Paris

[ECSC2024 @ecsc2024]

Hi @discord! We are hosting @ecsc2024 right now and we have our IP banned, we opened a ticket without answers, can you please write us? DM or [email protected] ⚠️

[mhackeroni @mhackeroni]

New faces + old faces, playing DEF CON CTF and @hack_a_sat in parallel. Proud of us. 🍝

[Bonfee @Bonfee1]

Cool kernel pwn challenge from corCTF 2023, CVE-2023-0461 + kCFI + limited set of available syscalls

[Bonfee @Bonfee1]

Qualified for DEFCON Finals with @aboutblankets and @mhackeroni

[Bonfee @Bonfee1]

🚩

[Marco Bonelli @mebeim]

O boi this year we have to play 2 events at the same time :O see you in Vegas! @mhackeroni (🚫🍍)

[Bonfee @Bonfee1]

Lets go 🔥 awesome sleep deprivation weekend 😂

[Marco Bonelli @mebeim]

GG WP! 2nd place at @hack_a_sat 4 w/ @mhackeroni and @aboutblankets ❤️🇮🇹🛰️ now onto hacking a real satellite I guess :')

[Bonfee @Bonfee1]

@hexacon_fr was amazing, congrats to the organizers :)

[Bonfee @Bonfee1]

The challenge was awesome, especially the Hyper-V VM escape part
See you in Paris 😄

[Hexacon @hexacon_fr]

Since we are on the home stretch, we will close the challenge on the 7/10/2022 at 20:00 GMT so you'd better hurry😊

We also have our first winner in the student category: @Bonfee1! A big shout out to him, he won fair and square his entry to Hexacon and hotel stay!

#HEXACON2022

[Bonfee @Bonfee1]

The bug was assigned CVE-2022-0995. Here is the exploit: https://t.co/zwQ20QOSJH.
1 bit oob write is all it takes :)

[Bonfee @Bonfee1]

@BruteBee It's not that one :)

[Bonfee @Bonfee1]

Another Ubuntu 21.10 LPE :)
This bug doesn't even have a CVE yet. To pwn it I used the same technique described here: https://t.co/zSl67mBPm9.
I'll clean the code just a bit, before releasing it

[Bonfee @Bonfee1]

@alexjplaskett 👀

[Bonfee @Bonfee1]

@alexjplaskett Nope :)

[Bonfee @Bonfee1]

@clubby789 yep, it was introduced in 5.x

[Bonfee @Bonfee1]

( Just to be clear, this is not a 0 day, i only saw the commit fixing the bug and developed the exploit for it. )

[Bonfee @Bonfee1]

@raesene @Terenceliqiang With the proper ropchain yes. If you are talking specifically about google kctf, then no because the kernel is compiled without the required CONFIG_ :(

[Bonfee @Bonfee1]

CVE-2022-25636 exploit - LPE on Ubuntu 21.10, using the FUSE technique ( which i first saw from @cor_ctf ).
I also developed an exploit which is not using FUSE, but for now: https://t.co/dK1FowNcOG.
I'll soon publish a writeup with the exploitation details.

[Bonfee @Bonfee1]

It finally arrived :)

[Bonfee @Bonfee1]

#nohat @nohatcon