Pwn_Full_Chain-Wall_Rose

Full Chain - Wall Rose

Author

wxrdnx

Description

https://storage.googleapis.com/hitconctf2023/chal-wall-rose/wall-rose-a10160050459354487c14f76f6bbd783d8d02c91.tgz

Challenge
nc 34.80.190.155 30001

Instruction
You have a busybox shell running as user user
/home/user/rose.ko is a vulnerable kernel driver
Try exploiting /home/user/rose.ko to achieve privilege escalation
You may assumed that Busybox, the Linux kernel, and Qemu are not vulnerable.

Files
./share/rose.ko: The vulnerable driver
./src/rose.c: The source code of rose.c

Flag location
/home/user/flag

Notes
FG-KASLR is enabled
Your exploit should be kernel-agnostic. In other words, it should not rely on any kernel offsets

Distribution

• wall-rose-a10160050459354487c14f76f6bbd783d8d02c91.tgz

Points

296

Solves

17

Writeup

• https://chovid99.github.io/posts/hitcon-ctf-2023/
• https://github.com/wxrdnx/HITCON-2023-Challenges/tree/main/wall-rose
• https://gist.github.com/0xdaidai/79d0892d964947af4872bd03428ef79a
• See writeup/