ps5-umtxdbg

メモ このバグは2020年12月上旬に発見された。発見者は私ではなく、fbsdを15分見ただけで即座にそれを見抜いた天才だ 🙇‍♂️。このC++実装は、ps5カーネルがヒープランダム化機能を追加した後に、エクスプロイトの信頼性を高める実験をしていた際に作られたものだ。 VMのセットアップ VMイメージを取得する root@kitploit: wget...

aircrack-ng

Aircrack-ng Badges GitHub CI...

The vulnerability of the ioctl request handler TIOCSCTTY in FreeBSD operating systems allows a attacker to increase their privileges.

The vulnerability of the ioctl request handler TIOCSCTTY in FreeBSD operating systems is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to increase their privileges...

The vulnerability of the ioctl request handler FIOSSHMLPGCNF in FreeBSD operating systems allows a hacker to increase their privileges.

The vulnerability of the ioctl request handler FIOSSHMLPGCNF in FreeBSD operating systems is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to increase their privileges...

The vulnerability of the LcpDecodeConfig() function in the operating system kernel of FreeBSD allows a hacker to trigger a service failure or execute arbitrary code.

The vulnerability of the LcpDecodeConfig function in the kernel of the FreeBSD operating system is related to improper handling of discrepancies in parameter length. Exploiting this vulnerability can allow a remote attacker to cause service failures or execute arbitrary code...

The vulnerability of the `execve` system call in FreeBSD’s kernel allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the execve system call in FreeBSD operating systems is related to improper verification of removed users. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of protected information...

The vulnerability of the mp_SetEnddisc() function in the operating system kernel of FreeBSD allows a hacker to trigger a service failure or execute arbitrary code.

The vulnerability of the mpSetEnddisc function in the kernel of FreeBSD is related to buffer overflow in dynamic memory. Exploiting this vulnerability can allow an attacker to cause a system failure or execute arbitrary code...

The vulnerability of the mp_Enddisc() function in the operating system kernels of FreeBSD allows a hacker to trigger a service failure or execute arbitrary code.

The vulnerability of the mpEnddisc function in the kernel of FreeBSD lies in the overflow of a buffer in dynamic memory. Exploiting this vulnerability can allow an attacker to cause service failures or execute arbitrary code...

CVE-2011-4862

CVE-2011-4862 Security and Privacy CS 600.443 の最終プロジェクト | 2018年秋 最初に、patch を作るために diff を使おうとしました。実際の patch を見る前に、自分が思う方法で patch を当てました。encrypt.patch は、その diff を使って作成した元の patch です。しかし、この patch を freeBSD に適用しようとしたところ、受け付けられませんでした。 代わりに、実際の patch を取得する必要がありました。そして、その patch...

freebsd_kernel_hacking

FreeBSD カーネルハッキング Joseph Kong 著 Designing BSD Rootkits の演習を、FreeBSD 11/12 向けに更新しました。 この書籍は出版から10年以上経過していますが、それでも強く推奨されます。なぜなら、現代のリリースで動作するように書籍のソースコードを更新するのは非常に難しいからです。 参考資料: learning-kernelhacking...

CVE-2020-7461

CVE-2020-7461 FreeBSD의 DHCP 취약점 NAME:WRECK에 대한 PoC 교육 목적으로만 사용하세요 환경 호스트: macOS 11.2.1 Vagrant: 2.2.15 피해자: FreeBSD 12.1-STABLE r364849 공격자: Ubuntu 20.04 면책 조항 이 PoC는 악용을 방지하기 위해 RCE 대신 DoS를 유발합니다. PoC VirtualBox에서 DHCP 서버 끄기 VM 실행 root@kitploit: $ cd victim $ vagrant up $ cd .. root@kitploit: $ ...

hershell

Hershell NOTE: the project has been forked on this repo, check there for any other developments. Hershell is a simple TCP reverse shell written in Go. It uses TLS to secure the communications, and provide a certificate public key fingerprint pinning feature, preventing from traffic interception...

decoder-plus-plus

Decoder++ Decoder++ is an extensible application designed for penetration testers, software developers, and anyone in between looking to effortlessly decode and encode data across various formats. It includes a wide range of preinstalled scripts and codecs, smart decoding and format identificatio...

krf

KRF KRF is a K ernelspace R andomized F aulter. It currently supports the Linux and FreeBSD kernels. What? Fault injection is a software testing technique that involves inducing failures "faults" in the functions called by a program. If the callee has failed to perform proper error checking and...

krf

KRF KRF는 K ernelspace R andomized F aulter입니다. 현재 Linux 및 FreeBSD 커널을 지원합니다. 무엇? 오류 주입Fault Injection은 프로그램이 호출하는 함수에 실패"오류"를 유도하는 소프트웨어 테스트 기법입니다. 호출된 함수가 적절한 오류 확인 및 처리를 수행하지 못한 경우, 이러한 오류는 신뢰할 수 없는 애플리케이션 동작이나 악용 가능한 취약점으로 이어질 수 있습니다. 많은 사용자 공간 오류 주입 시스템과 달리, KRF는 로드된 모듈을 통해 커널 공간에서 실행됩니다. 여기에...

research-cve-2025-68971

CVE 2025-68971 | Holloway Chew, Kean Ho의 지식 연구 2025년 12월 22일, 오픈소스 애플리케이션 Forgejo 13.0.3에서 보안 취약점 CVE 2025-68971 CVSS: 5.5/중간이 발견되었으며, 이는 FreeBSD14 운영 체제에서 처음 탐지되었습니다. 이 취약점으로 인해 운영 체제가 모든 시스템 애플리케이션과 서비스를 대량 종료Mass-killing하게 되었습니다. 원인은 Forgejo가 첨부 파일 업로드 조각을 임시로 저장하기 위해 운영 체제의 사용 가능한 모든 여유 메모리를...

CVE-2026-4747-

CVE-2026-4747: FreeBSD リモートカーネルRCE AIによって発見され、悪用された初のリモートカーネルエクスプロイト 📋 クイックサマリー...

CVE-2026-4747

root@kitploit: / /\ \ / / | | \ / \ \ \ \ | || | || || \ | | \ \ / /| | | | | | | \ \ | | / /| || | | | | \ V / | ||| / /| || / / \ \ | || | / / | |/ / | / | ||/| \ / // |||| CVE-2026-4747 — FreeBSD リモートカーネルRCE kgssapi.ko のスタックバッファオーバーフロー → 約4時間でルートシェル...

freebsd-CVE-2026-7270

Ref https://github.com/califio/publications/tree/main/MADBugs/freebsd-CVE-2026-7270 CVE-2026-7270 FreeBSD のexecargsadjustargs の OOB memmove によるローカル権限昇格 execargsadjustargs（sys/kern/kernexec.c、2013年から存在）の演算子優先順位のバグにより、sshd が動作しているデフォルトの FreeBSD インストールでは、任意のローカルユーザーが root に権限昇格できます。suid...

setcred

FreeBSD setcred2 — 研究資料 このサブディレクトリには、FreeBSD 14.x カーネルにおける setcred2 スタックバッファオーバーフローの解説記事と動作するエクスプロイトをまとめています。 脆弱性自体の詳細は setcred.txt に完全に記載されています。要旨は次のとおりです。 kernsetcredcopyinsuppgroups は、groups が gidt であるにも かかわらず sizeofgroups を使用しているため、固定サイズのカーネルスタック配列への copyin で 4 バイトではなく 8...