Kernel exploitation – r0 to r3 transitions via KeUserModeCallback – j00ru//vx tech blog
Kernel exploitation – r0 to r3 transitions via KeUserModeCallback I have recently came across (well, not entirely by myself… cheers Nahuel!) a fairly (un)common problem related to performing ring0-to-ring3 transitions, after a successful kernel vulnerability exploitation. As I have managed to come up with a bunch of possible solutions, and even write example code for some of these, today I would l
Windows CSRSS Write Up: Inter-process Communication (part 2/3) – j00ru//vx tech blog
Windows CSRSS Write Up: Inter-process Communication (part 2/3) A quick beginning note: My friend d0c_s4vage has created a technical blog and posted his first text just a few days ago. The post entry covers a recent, critical libpng vulnerability discovered by this guy; the interesting thing is that, among others, the latest Firefox and Chrome versions were vulnerable. Feel free to take a minute an
Windows CSRSS Write Up: Inter-process Communication (part 1/3) – j00ru//vx tech blog
Windows CSRSS Write Up: Inter-process Communication (part 1/3) In the second post of the Windows CSRSS Write Up series, I would like to explain how the practical communication between the Windows Subsystem and user’s process takes place under the hood. Due to the fact that some major improvements have been introduced in Windows Vista and later, the entire article is split into two parts – the firs
Windows CSRSS write up: the basics – j00ru//vx tech blog
The following post entry opens a series of CSRSS-oriented articles, aiming at describing the uncovered CSRSS mechanism internals, present in the Windows OS for more than fifteen years now. Although some great research has already been carried out by a few curious guys (check out the references), no thorough case study is available until now. In this series, I am going to cover both the very basic
“Descriptor tables in kernel exploitation” – a new article – j00ru//vx tech blog
Not so long (a few weeks, actually) ago, me together with Gynvael Coldwind had a chance to carry out a research regarding the Global and Local Descriptor Tables being used as a write-what-where target, while exploiting ring-0 vulnerabilities on 32-bit Microsoft Windows NT-family systems. The result of our work is a small article, describing the actual steps taken in order to escalate the privilege
1
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
Windows CSRSS cross-version API Table – j00ru//vx tech blog
Controlling Windows process list – j00ru//vx tech blog
Windows X86 WIN32K.SYS System Call Table (NT/2000/XP/2003/Vista/7/8/10)
x86 Kernel Memory Space Visualization (KernelMAP v0.0.1) – j00ru//vx tech blog