Looking into the Looney Tunable Linux Privesc CVE-2023-4911

Name: Looking into the Looney Tunable Linux Privesc CVE-2023-4911
Uploaded: 2023-10-09T11:14:13Z
Channel: IppSec
Description: 00:00 - Introduction talking about what the Looney Tunable exploit is and my thoughts on the severity of the exploit 02:30 - Start talking about how the...

IppSec · Beginner ·🛡️ AI Safety & Ethics ·2y ago

00:00 - Introduction talking about what the Looney Tunable exploit is and my thoughts on the severity of the exploit 02:30 - Start talking about how the vulnerability works 04:00 - The POC String to identify if a box is vulnerable, it doesn't actually exploit but quickly identifies if a vulnerable glibc is installed 05:45 - Important parts I wanted to point out in the technical writeup. 09:00 - Downloading a good POC written in python, then glancing over the code to make sure there isn't anything malicious 13:37 - Analyzing the exit shellcode manually in Ghidra to see it just exits with 0x66 1…

Watch on YouTube ↗ (saves to browser)

Chapters (14)

Introduction talking about what the Looney Tunable exploit is and my thoughts

2:30 Start talking about how the vulnerability works

4:00 The POC String to identify if a box is vulnerable, it doesn't actually exploit

5:45 Important parts I wanted to point out in the technical writeup.

9:00 Downloading a good POC written in python, then glancing over the code to make

13:37 Analyzing the exit shellcode manually in Ghidra to see it just exits with 0x66

18:50 Analyzing the main shellcode in Ghidra, showing it does a lot more

21:50 Putting the Shellcode into an elf binary, so we can analyze it with gdb

29:50 Logging into HTB's TwoMillion machine to run this exploit

31:45 Showing how to get the magic numbers incase your target is not supported. Disa

34:50 Looking at how Elastic got lucky and detected this exploit with their default

36:00 Looking at how CrowdSec detects it

36:55 Looking at the more recent Elastic rules to see the more thorough check for th

40:40 Showing all the segfaults in /var/log/kern.log

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →