PatriotCTF 2024 - DirtyFetch Solves: 9 (expert - 484) My kernel is your kernel. Well, some of it. Here’s ioctl. Author: Dylan (elbee3779) nc chal.competitivecyber.club 8886 Team: Weak But Leet Attachment: dirty_fetch.tar.gzpwn.c DirtyFetch had a simple race condition in its kernel module, which could be used to overflow the stack to rop. The module was accessable via ioctl and provided functionality to (0x10) set a max length for requests to be read/write (0x20) allocate a storage buffer, w...
