0x9000 · Kernel Exploitation
KASLR, KPTI and Modern Kernel Defenses
Kernel address randomization, page-table isolation, and the config options that harden a Linux kernel against memory-corruption exploits — what each one stops and how to enable it.
Guides
In-depth guides on memory-safety vulnerability classes, exploit mitigations, sanitizers, fuzzing and crash triage.
0x9000 · Kernel Exploitation
Kernel Exploitation: From a Bug to root
A kernel memory-corruption bug is about privilege, not a shell. The credential model, the commit_creds(prepare_kernel_cred(0)) payload, and returning cleanly to userspace — in a lab VM.
0x9000 · Kernel Exploitation
ret2usr, SMEP and SMAP
The kernel once trusted userspace memory, so exploits just pointed kernel execution at a user payload. SMEP and SMAP ended that — and how kernel ROP works around them.
0x2000 · Exploit Mitigations
The Mitigation Stack: Which Defenses, In Order
Every exploit walks the same stages: bug, corruption, hijack, code execution, escalation. A defender's checklist of which mitigation stops each — across Linux, ARM, Windows and the kernel.
0xa000 · Windows Exploitation
Bypassing DEP on Windows with ROP
DEP makes stack shellcode unrunnable, so a Windows ROP chain calls VirtualProtect to mark the shellcode region executable, then jumps to it. Build it with mona, then see ASLR and CFG respond.
0xa000 · Windows Exploitation
Windows Flow-Integrity Mitigations: CFG and CET
How SafeSEH, SEHOP, ASLR, Control Flow Guard and hardware CET each close a Windows exploitation technique — what they check, how to enable them, and their limits.
0xa000 · Windows Exploitation
SEH Overwrites: Hijacking Windows Exceptions
Windows keeps a linked list of exception handlers on the stack. Overflow into one, point it at a pop-pop-ret, trigger a fault, and control is yours — the technique Windows made famous.
0x8000 · ARM64 Exploitation
ARM64 Exploitation: the Link Register and ret2win
On AArch64 the return address lives in a register, not on the stack — until a non-leaf function saves it. Build the ARM ret2win in a lab and see where the saved link register sits.
0x8000 · ARM64 Exploitation
PAC and BTI: ARM's Answer to Code Reuse
Pointer authentication signs return addresses so a forged one faults; BTI forces indirect branches onto landing pads. How both work, how to enable and verify them, and their limits.
0x8000 · ARM64 Exploitation
ROP on ARM64: Gadgets and the Link Register
AArch64 gadgets end in ret, which branches to x30 — so the chain is threaded through the link register with ldp gadgets. Build a system("/bin/sh") chain, then watch PAC and BTI break it.
0x7000 · Exploitation Techniques
one-gadget: One Address to a Shell
Sometimes you control just one pointer. A one-gadget is a single libc address that calls execve("/bin/sh") — if its register and stack constraints hold. Find one, check the constraints, and use it.
0x7000 · Exploitation Techniques
ret2dlresolve: Resolving a Symbol Without a Leak
No libc leak, no problem: forge the relocation the dynamic linker reads and make it resolve and call system for you. A pwntools walkthrough — and why Full RELRO ends it.
0x7000 · Exploitation Techniques
Seccomp Sandboxes and the open-read-write Chain
A seccomp policy that bans execve takes the shell off the table, so attackers switch goals: open the flag, read it, write it back. Build the ORW chain, and see what a tighter policy stops.
0x7000 · Exploitation Techniques
File-Structure Attacks: Hijacking a FILE Object
When hooks are gone, the FILE object is the target. A stdio call dispatches through a vtable pointer in writable memory — corrupt it and the next fwrite runs your code.
0x7000 · Exploitation Techniques
Information Leaks: Defeating ASLR and Canaries
Modern exploits are leak-then-act. Build an out-of-bounds read, then use it to recover a stack canary, the PIE base and the libc base — the three secrets every mitigation relies on.
0x7000 · Exploitation Techniques
ret2csu: Borrowing the Runtime's Universal Gadget
No pop rdx gadget? The C runtime's startup code has a universal sequence that loads several registers and makes a controlled call. Build it with pwntools, and see where it's gone.
0x7000 · Exploitation Techniques
SROP: Exploiting with a Fake Signal Frame
When gadgets are scarce, forge a signal frame. A sigreturn syscall restores every register from the stack at once — build one with pwntools to call execve, then see how seccomp and CET respond.
0x7000 · Exploitation Techniques
Stack Pivoting: Relocating the ROP Chain
When the overflow gives you only a few bytes past the return address, pivot the stack pointer into a buffer you fully control and run the real chain from there. A pwntools walkthrough.
0x7000 · Exploitation Techniques
Format-String Bugs: Arbitrary Read and Write
One printf(user_input) is a full read/write primitive. Leak with %p, overwrite with %n via pwntools, then watch -Wformat=2 and FORTIFY_SOURCE shut it down.
0x7000 · Exploitation Techniques
Hijacking the GOT: Redirecting a libc Call
Lazy binding leaves the Global Offset Table writable. Aim an arbitrary write at a GOT entry, turn puts() into system(), then enable Full RELRO and watch the same write fault instantly.
0x7000 · Exploitation Techniques
Heap Exploitation: tcache and Use-After-Free
The heap's own metadata is the write primitive. Build a use-after-free, poison the glibc tcache to allocate a chunk over a chosen address, and see why safe-linking and ASan raise the bar.
0x7000 · Exploitation Techniques
Hijacking Control Flow: the ret2win Technique
A complete lab walkthrough: build a vulnerable C program, find the offset to the saved return address, redirect execution with pwntools, then watch each mitigation break the exploit.
0x7000 · Exploitation Techniques
Returning into libc: the ret2libc Technique
NX is on and the binary is tiny, but libc is mapped and full of useful code. Leak its base past ASLR, then return straight into system("/bin/sh") — a full two-stage pwntools walkthrough.
0x7000 · Exploitation Techniques
Building a ROP Chain Step by Step
With NX on, injected shellcode is dead — so we reuse the program's own code. A full lab walkthrough: find gadgets, hand-build an execve syscall chain with pwntools, then watch CET and CFI break it.