diff options
| author | Andrey Konovalov | 2019-09-27 18:47:44 +0200 |
|---|---|---|
| committer | GitHub | 2019-09-27 18:47:44 +0200 |
| commit | e8fb6a713c3e158b055e26efeb17d0a69be3149f (patch) | |
| tree | 8976d87d53205a56f4adc98e4d1b5f19bd5c475c | |
| parent | 35c1eb49bb610997870d808859a3798d256a2ac0 (diff) | |
Update README.md
| -rw-r--r-- | README.md | 20 |
1 files changed, 19 insertions, 1 deletions
| @@ -79,6 +79,8 @@ Pull requests are welcome. | |||
| 79 | 79 | ||
| 80 | [2012: "The Linux kernel memory allocators from an exploitation perspective" by Patroklos Argyroudis](https://argp.github.io/2012/01/03/linux-kernel-heap-exploitation/) [article] | 80 | [2012: "The Linux kernel memory allocators from an exploitation perspective" by Patroklos Argyroudis](https://argp.github.io/2012/01/03/linux-kernel-heap-exploitation/) [article] |
| 81 | 81 | ||
| 82 | [2012: "The Stack is Back" by Jon Oberheide](https://jon.oberheide.org/files/infiltrate12-thestackisback.pdf) [slides] | ||
| 83 | |||
| 82 | [2012: "Stackjacking" by Jon Oberheide and Dan Rosenberg](https://www.slideshare.net/scovetta/stackjacking) [slides] | 84 | [2012: "Stackjacking" by Jon Oberheide and Dan Rosenberg](https://www.slideshare.net/scovetta/stackjacking) [slides] |
| 83 | 85 | ||
| 84 | [2011: "Stackjacking Your Way to grsec/PaX Bypass" by Jon Oberheide](https://jon.oberheide.org/blog/2011/04/20/stackjacking-your-way-to-grsec-pax-bypass/) [article] | 86 | [2011: "Stackjacking Your Way to grsec/PaX Bypass" by Jon Oberheide](https://jon.oberheide.org/blog/2011/04/20/stackjacking-your-way-to-grsec-pax-bypass/) [article] |
| @@ -361,6 +363,10 @@ Pull requests are welcome. | |||
| 361 | 363 | ||
| 362 | ## Defensive | 364 | ## Defensive |
| 363 | 365 | ||
| 366 | [2019: "Touch but don’t look - Running the Kernel in Execute-only memory" by Rick Edgecombe](https://linuxplumbersconf.org/event/4/contributions/283/attachments/357/588/Touch_but_dont_look__Running_the_kernel_in_execute_only_memory-presented.pdf) [slides] | ||
| 367 | |||
| 368 | [2019: "Breaking and Protecting Linux Kernel Stack" by Elena Reshetova](https://www.youtube.com/watch?v=FacpjoQbMhU) [video] | ||
| 369 | |||
| 364 | [2019: "Making C Less Dangerous in the Linux Kernel" by Kees Cook](https://outflux.net/slides/2019/lca/danger.pdf) [slides] | 370 | [2019: "Making C Less Dangerous in the Linux Kernel" by Kees Cook](https://outflux.net/slides/2019/lca/danger.pdf) [slides] |
| 365 | 371 | ||
| 366 | [2019: "Mitigation for the Kernel Space Mirroring Attack (内核镜像攻击的缓解措施)"](http://c0reteam.org/2019/01/02/ksma) [article] | 372 | [2019: "Mitigation for the Kernel Space Mirroring Attack (内核镜像攻击的缓解措施)"](http://c0reteam.org/2019/01/02/ksma) [article] |
| @@ -371,7 +377,7 @@ Pull requests are welcome. | |||
| 371 | 377 | ||
| 372 | [2018, beVX: "The Last Man Standing: The Only Practical, Lightweight and Hypervisor-Based Kernel Protector Struggling with the Real World Alone" by Seunghun Han](https://github.com/kkamagui/papers/blob/master/bevx-2018/presentation.pdf) [video] | 378 | [2018, beVX: "The Last Man Standing: The Only Practical, Lightweight and Hypervisor-Based Kernel Protector Struggling with the Real World Alone" by Seunghun Han](https://github.com/kkamagui/papers/blob/master/bevx-2018/presentation.pdf) [video] |
| 373 | 379 | ||
| 374 | [2018, CONFidence: "Linux Kernel Runtime Guard (LKRG) under the hood" by Adam "pi3" Zabrocki](https://www.youtube.com/watch?v=tOiPM692DOM) [video] | 380 | [2018, CONFidence: "Linux Kernel Runtime Guard (LKRG) under the hood" by Adam "pi3" Zabrocki](https://www.openwall.com/presentations/CONFidence2018-LKRG-Under-The-Hood/CONFidence2018-LKRG-Under-The-Hood.pdf) [slides, [video](https://www.youtube.com/watch?v=tOiPM692DOM)] |
| 375 | 381 | ||
| 376 | [2018: "GuardION: Practical Mitigation of DMA-based Rowhammer Attacks on ARM"](https://vvdveen.com/publications/dimva2018.pdf) [paper] | 382 | [2018: "GuardION: Practical Mitigation of DMA-based Rowhammer Attacks on ARM"](https://vvdveen.com/publications/dimva2018.pdf) [paper] |
| 377 | 383 | ||
| @@ -424,6 +430,12 @@ Pull requests are welcome. | |||
| 424 | 430 | ||
| 425 | ## Vulnerability discovery | 431 | ## Vulnerability discovery |
| 426 | 432 | ||
| 433 | [2019: "Unicorefuzz: On the Viability of Emulation for Kernelspace Fuzzing"](https://www.usenix.org/system/files/woot19-paper_maier.pdf) [paper] | ||
| 434 | |||
| 435 | [2019: "Case study: Searching for a vulnerability pattern in the Linux kernel" by Alexander Popov](https://a13xp0p0v.github.io/2019/08/10/cfu.html) [article] | ||
| 436 | |||
| 437 | [2019: "Razzer: Finding Kernel Race Bugs through Fuzzing"](https://www.youtube.com/watch?v=9UszCIxc0r0) [video] | ||
| 438 | |||
| 427 | [2019: "Fuzzing File Systems via Two-Dimensional Input Space Exploration"](https://taesoo.kim/pubs/2019/xu:janus.pdf) [paper] | 439 | [2019: "Fuzzing File Systems via Two-Dimensional Input Space Exploration"](https://taesoo.kim/pubs/2019/xu:janus.pdf) [paper] |
| 428 | 440 | ||
| 429 | [2019: "PeriScope: An Effective Probing and Fuzzing Framework for the Hardware-OS Boundary"](https://www.ndss-symposium.org/wp-content/uploads/2019/02/ndss2019_04A-1_Song_paper.pdf) [paper] | 441 | [2019: "PeriScope: An Effective Probing and Fuzzing Framework for the Hardware-OS Boundary"](https://www.ndss-symposium.org/wp-content/uploads/2019/02/ndss2019_04A-1_Song_paper.pdf) [paper] |
| @@ -572,6 +584,10 @@ https://github.com/w0lfzhang/kernel_exploit | |||
| 572 | 584 | ||
| 573 | https://github.com/jinb-park/linux-exploit | 585 | https://github.com/jinb-park/linux-exploit |
| 574 | 586 | ||
| 587 | https://github.com/bcoles/kernel-exploits | ||
| 588 | |||
| 589 | https://github.com/jollheef/lpe | ||
| 590 | |||
| 575 | 591 | ||
| 576 | ## Practice | 592 | ## Practice |
| 577 | 593 | ||
| @@ -621,6 +637,8 @@ Insomni'hack teaser 2019 (1118daysober): [writeup 1](https://ctftime.org/writeup | |||
| 621 | 637 | ||
| 622 | Security Fest 2019 (brainfuck64): [writeup](https://kileak.github.io/ctf/2019/secfest-brainfuck64/) | 638 | Security Fest 2019 (brainfuck64): [writeup](https://kileak.github.io/ctf/2019/secfest-brainfuck64/) |
| 623 | 639 | ||
| 640 | TokyoWesterns CTF 2019 (gnote): [writeup](https://rpis.ec/blog/tokyowesterns-2019-gnote/) | ||
| 641 | |||
| 624 | 642 | ||
| 625 | ## Tools | 643 | ## Tools |
| 626 | 644 | ||
