4 ms·
Good job writing this up! Quick question: for "post"-exploitation, once you had a KSMA-like primitive why would you choose to still do the modprobe_path dance,
by rfoo 3y ago
Good job writing this up!
Quick question: for "post"-exploitation, once you had a KSMA-like primitive why would you choose to still do the modprobe_path dance, and introduce a pid bruteforce for fileless :(, instead of e.g. patching kernel .text with a short shellcode to become root & break out of namespaces?
- Unroll0201 3y agoI'm a bit late, but it's because I wanted my exploit to be universal. When patching kernel .text I'd need know: - know the offset to the patched instructions (memory scanning will not work) - know the architecture-compatible instructions to replace it with