Tools libslub - heap analysis tool

[weaver]

[OffensiveCon 2023] Exploit Engineering – Attacking the Linux Kernel​

Over the last year the Exploit Development Group (EDG) at NCC Group found and exploited three different 0-day Linux kernel local privilege escalation vulnerabilities (CVE-2022-0185, CVE-2022-0995, CVE-2022-32250) against fully patched OSs with all mitigations enabled. The most recent vulnerability was patched against versions of the kernel going back 6 years affecting most stable Linux distributions.

Unlike developing proof of concepts, our exploits need to be ultra-reliable and support many different OS variations and kernel versions so they can be used by our security assessment consultants or Red Teams. This calls for a much more rigorous engineering process to be followed.

In this talk, we start with an overview of our bug hunting processes and approach to rapidly find high impact vulnerabilities within the Linux kernel. The talk will then describe key vulnerability details, discuss the challenges of reliable exploitation across multiple targets and describe the exploitation techniques used (and what is appropriate in 2023). We discuss rigorous exploit engineering approaches – including tooling which we have developed for heap analysis (libslub) and automation for mining, creation, deployment and scaling across many different environments (TargetMob). Finally, we will conclude with our thoughts on areas where more strategic hardening and attack surface reduction can be introduced to hinder against advanced attackers using 0-days in the Linux kernel. We will leave you with a release of our tooling for heap analysis (libslub) and the knowledge to go out there and find, analyse and exploit your own Linux kernel vulnerabilities!

slides

https://research.nccgroup.com/wp-content/uploads/2023/05/exploit-engineering-linux-kernel.pdf

libslub - heap analysis tool

GitHub - nccgroup/libslub

Contribute to nccgroup/libslub development by creating an account on GitHub.

github.com

video
youtube.com/watch?v=9wgHENj_YNk&list=PLYvhPWR_XYJmh-qBNKUrlyjQYKBpCDZzB

 

[varwar]

Теперь понятно почему Седрик целый год выпуск курса откладывал.