Google CTF 2021 eBPF

1 · 2019 · July 19, 2021, 10:22 a.m.
Last weekend we played Google CTF and I have solved 2 challenges: first 2 parts of fullchain and eBPF. The fullchain challenge is actually very easy: v8 bug and mojo bug are just basic OOB access bugs. However, eBPF is quite interesting for me, since it is my first time to learn and exploit eBPF module in Linux kernel, so it is worthy to do a write-up for it. 0x00 Overview In this challenge, instead of a .ko kernel module like normal kernel exploit challenge, we are provided only with a patched ...