It's cool to see others embracing 🏟️ Ludus. Great work!

User readable /sys/kernel/notes exposed the address of xen_startup, effectively breaking kernel address space layout randomization (KASLR) for local privilege escalation exploits (or any exploit with file read ability) for the entire history of KASLR… 😬

Exploit devs stealing work and dropping 0days like old days!

The 'Kobold letters' entry under Techniques and Write-ups is going to be gold for bespoke phishing campaigns.

blog.badsectorlabs.com/last-week-in-s…

Got some free time and added a requested feature to NoConsolation.
Now binaries are automatically encrypted and stored in memory, so they don't need to be sent each time. Have fun!
github.com/fortra/No-Cons…

the xz sshd backdoor rabbithole goes quite a bit deeper. I was just able to trigger some harder to reach functionality of the backdoor. there's still more to explore.. 1/n

Fully agree! I ran raspberry pis with pwnable.kr challenges on them for soldiers when I was in the army, but now there is ludus.cloud which makes complex labs accessible to everyone!

Evilginx 💗 Gophish

The long-awaited official integration of Evilginx with Gophish has finally arrived with the Evilginx 3.3 update. 🪝🐟

The update includes lots of quality-of-life improvements as well.

Enjoy and happy phishing! 🤗
breakdev.org/evilginx-3-3-g…

Laser focused on the XZ backdoor 🧐🚪from last week? Come check out all the other stuff you missed including the best Linux LPE since DirtyCOW.

Alberto kept the news flowing while I worked on ludus.cloud 1.3.0.

blog.badsectorlabs.com/last-week-in-s…

What's better than 🏟️Ludus? Ludus with friends 🤝! Range sharing just dropped in Ludus 1.3.0 (no joke).

Set up a range and let others access it or set up lots of ranges for yourself and switch between them seamlessly.

Free and open source 🤟

docs.ludus.cloud/docs/sharing

Exciting news! 🚀 Just dropped my blogpost unveiling the universal Linux kernel LPE PoC for CVE-2024-1086 (working on v5.14 - v6.7) used for pwning Debian, Ubuntu, and KernelCTF Mitigation instances, including novel techniques like Dirty Pagedirectory 🧵

pwning.tech/nftables