#exploitdevelopment — Public Fediverse posts

Exploiting Reversing (ER) series: article 09 | Exploitation Techniques: CVE-2024-30085 (part 03)

Today I am releasing the nineth article in the Exploiting Reversing Series (ERS). In “Exploitation Techniques | CVE-2024-30085 (Part 09)” I provide a 106-page deep dive and a comprehensive roadmap for vulnerability exploitation:

https://exploitreversing.com/2026/04/28/exploiting-reversing-er-series-article-09/

Key features of this edition:

[+] Dual Exploit Strategies: Two distinct exploit editions built on the cldflt.sys heap overflow.
[+] PreviousMode Edition: Exploit cldflt.sys via WNF OOB + Pipe Attributes + ALPC + _KTHREAD.PreviousMode flip: elevation of privilege of a regular user to SYSTEM.
[+] PPL Bypass Edition: Exploit cldflt.sys via WNF OOB + PreviousMode flip + _EPROCESS.Protection strip + MiniDumpWriteDump: elevation of regular user to SYSTEM.
[+] Solid Reliability: Two complete, stable exploits, including a multi-step cleanup phase that restores the corrupted pipe attribute Flink and _KTHREAD.PreviousMode before process exit, preventing crash on cleanup.

This article guides you through two additional techniques for exploiting the CVE-2024-30085 Heap Buffer Overflow. While demonstrated here, these methods can be adapted as exploitation techniques for many other kernel targets.

I hope this serves as a definitive resource for your research. If you find it helpful, please feel free to share it or reach out with your feedback!

The following articles will continue the miniseries about iOS and Chrome, which are my areas of research.

Enjoy the reading and have an excellent day.

#exploit #exploitdevelopment #windows #exploitation #vulnerability #minifilterdriver #kernel #heapoverflow

The eighth article of the Exploiting Reversing Series (ERS) is now live. Titled “Exploitation Techniques | CVE-2024-30085 (Part 02)” this 91-page technical guide offers a comprehensive roadmap for vulnerability exploitation:

https://exploitreversing.com/2026/03/31/exploiting-reversing-er-series-article-08/

Key features of this edition:

[+] Dual Exploit Strategies: Two distinct exploit versions leveraging the I/O Ring mechanism.
[+] Exploit ALPC + WNF OOB + Pipe Attributes + I/O Ring: elevation of privilege of a regular user to SYSTEM.
[+] Replaced ALPC one-shot write with Pipe Attribute spray for I/O Ring RegBuffers corruption: more reliable adjacency control.
[+] Exploit WNF OOB + I/O Ring Read/Write: elevation of privilege of a regular user to SYSTEM.
[+] Pure I/O Ring primitive: eliminated ALPC dependency entirely. WNF overflow directly corrupts I/O Ring RegBuffers for arbitrary kernel read/write.
[+] Solid Reliability: Two complete, stable exploits, including an improved cleanup stage.

This article guides you through two additional techniques for exploiting the CVE-2024-30085 Heap Buffer Overflow. While demonstrated here, these methods can be adapted as exploitation techniques for many other kernel targets.

I hope this serves as a definitive resource for your research. If you find it helpful, please feel free to share it or reach out with your feedback!

Enjoy the read and have an excellent day.

#exploit #exploitdevelopment #windows #exploitation #vulnerability #minifilterdriver #kernel #heapoverflow #ioring

34 zero-days in one day—hackers at Pwn2Own Ireland 2025 broke records and left no stone unturned, from browsers to mobile devices. Are our digital defenses ready for what’s coming?

https://thedefendopsdiaries.com/pwn2own-ireland-2025-record-breaking-day-one-showcases-34-zero-day-exploits/

#pwn2own2025
#zeroday
#cybersecurity
#vulnerabilityresearch
#infosec
#ethicalhacking
#securitytrends
#exploitdevelopment
#bugbounty

🇧🇪 Belgian Roots. Global Impact. 🌍

Corelan is more than just 🍟, 🍺 & 👶🏼🚿.

We offer world-class Exploit Development Training for Windows:
🔹 Stack-based Exploit Dev
🔹 Heap Exploit Development Masterclass

Crafted in 🇪🇺, respected worldwide 🌐.

Built by a researcher, for researchers 🧠.

Support European excellence in cybersecurity!

🎯 Sign up here → https://bit.ly/corelan-training

#CyberSecurity #ExploitDevelopment #Corelan #InfoSec #InvestInEurope #MadeInBelgium #Heap #Stack #Windows

New Encoding Technique Jailbreaks ChatGPT-4o To Write Exploit Codes https://cybersecuritynews.com/encoding-technique-jailbreaks-chatgpt-4o/ #CyberSecurityResearch #CybersecurityTrends #ExploitDevelopment #CyberSecurityNews #cybersecuritynews #CyberSecurity #AISecurity #Exploit

Here’s a collection of the #SecurityAdvisories that I’ve published over the years:

https://github.com/0xdea/advisories

If you’re interested in #VulnerabilityResearch and #ExploitDevelopment, on @github and on the @hnsec blog you can also find a trilogy of talks on these topics that I delivered between 2019 and 2021:

https://github.com/0xdea/raptor_infiltrate19

https://github.com/0xdea/raptor_infiltrate20

https://github.com/0xdea/raptor_romhack21

I hope you’ll enjoy them!

I implemented Ken Thompson’s Reflections on Trusting Trust (1984 Turing Award Lecture) compiler #backdoor for the GNU Compiler Collection (GCC). The backdoor maintains persistence by re-injecting itself to any new versions of the compiler built. The secondary payload modifies a test application by adding a backdoor password to allow authentication bypass:

$ cat testapp.c
#include <string.h>
#include <stdio.h>
#include <stdlib.h>

int main(int argc, char **argv)
{
if (argc == 2 && !strcmp(argv[1], "secret"))
{
printf("access granted!\n");
return EXIT_SUCCESS;
}
else
{
printf("access denied!\n");
return EXIT_FAILURE;
}
}
$ gcc -Wall -O2 -o testapp.c -o testapp
$ ./testapp kensentme
access granted!
$

I spent most time (around two hours) writing the generalized tooling that produces the final quine version of the malicious payload. Now that this is done, the actual code can be adjusted trivially to exploit more target code without any need to adjust the self-reproducing section of the code. This method of exploitation could be extended to target various binaries: SSH Server, Linux Kernel, Setuid binaries and similar. While itself written in C, the secondary payloads can target any programming languages supported by GCC.

It should be noted that GCC build checks for malicious compiler changes such as this. This check can – of course – also be bypassed. However, most serious projects have measures in place to avoid hacks of this nature.

Some links:
- Ken Thompson's "Reflections on Trusting Trust" paper: https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf
- David A. Wheeler: "Fully Countering Trusting Trust through Diverse Double-Compiling (DDC) - Countering Trojan Horse attacks on Compilers" https://dwheeler.com/trusting-trust/

#hacking #exploitdevelopment #kenthompson #infosec #cybersecurity @vegard

I have an #exploit that takes 4 hours to trigger, with no obvious way to speed it up. Oh well, at least it should still give me #privesc to local SYSTEM. #infosec #hacking #exploitdevelopment

💻 A Noob's Guide To ARM Exploitation

https://ad2001.gitbook.io/a-noobs-guide-to-arm-exploitation/introduction-to-stack-buffer-overflows

👉 ARM Basics
👉 Buffer overflows
👉 Integer overflows
👉 Rop chains
👉 Heap exploitation
👉 ARM64 exploitation and much more.

#infosec #exploitation #binaryexploitation #ExploitDevelopment #reverseengineering

DirtyCred Remastered: how to turn an UAF into Privilege Escalation

Articles:
https://exploiter.dev/blog/2022/CVE-2022-2602.html

https://blog.hacktivesecurity.com/index.php/2022/12/21/cve-2022-2602-dirtycred-file-exploitation-applied-on-an-io_uring-uaf/

Poc:
https://github.com/LukeGix/CVE-2022-2602

Credits: @kiks7_7 @LukeGix

#exploitdevelopment #infosec #binaryexploit
#kernelexploit #privilegeescalation #linux

Lessons on Linux kernel exploit development:

https://breaking-bits.gitbook.io/breaking-bits/exploit-development/linux-kernel-exploit-development

https://lkmidas.github.io/posts/20210123-linux-kernel-pwn-part-1/

#exploitdevelopment #infosec #exploit #exploitation
#kernelexploit #ring0 #privilegeescalation #linux