Please Do Not Hack Me - The Tale of a TeamSpeak Use-After-Free
A walkthrough of the root-cause analysis behind the TeamSpeak 3 server use-after-free, and why reliable RCE turned out not to be possible. ...
Blog
No Leak, No Problem - Bypassing ASLR with a ROP Chain to Gain RCE
Following a previous post on ARM exploitation, this post walks through extracting and analyzing modern IoT firmware to discover a previously unknown vulnerability. We then construct an ARM ROP chain that bypasses ASLR without an address leak to achieve unauthenticated RCE. ...
ROPing our way to RCE
From vulnerability to exploit - this post explores the journey of developing an ARM ROP chain to exploit a buffer overflow in uc-http. ...
A Journey to the House of Tangerine
A couple of weeks ago my friend Sir_X told me about a heap challenge he was working on. Since I still have much to learn in this area, I decided to join him. Like most challenges of this kind, the journey was challenging but ultimately rewarding. ...
Exploring CVE-2023-2163: My Intro to Kernel Hacking
Ever since I got into security, kernel exploitation has fascinated me. So for my bachelor’s thesis, I finally decided to take a first dive into this deep and complex field - one that always seems to have more layers to uncover. ...