Leo_something on bitfriends' blog

Reviving modprobe_path technique (again)

Fri, 03 Jul 2026 23:22:28 +0700

Overview Link to heading

The modprobe_path technique is a widely known Linux kernel exploitation primitive that can be used to turn an arbitrary write primitive into LPE.

TL;DR Link to heading

modprobe_path is a string that specifies the name of the modprobe executable in the Linux kernel. This program is responsible for adding and removing loadable kernel modules.

When CONFIG_STATIC_USERMODEHELPER is disabled modprobe_pathis R/W, this means that if we have an arbitrary write primitive and a KASLR leak, we can change it to a controlled executable file path. If we now find a way to make the kernel run modprobe for us, it will run our executable with root privileges, thus achieving LPE.

snalloc - Lake CTF 2025

Sun, 01 Mar 2026 23:49:32 +0700

Overview Link to heading

This was an heap challenge with a custom allocator implementation. The main program basically let you allocate, edit and free chunks using either the custom allocator or the malloc allocator.

Vulnerability Link to heading

Snalloc Internals Link to heading

In the snallloc implementation, glibc malloc is still used as the “buddy” allocator. It is exclusively used to request blocks of memory that are multiple of PAGESIZE in size.

cherry - Mimic Defense CTF

Fri, 12 Dec 2025 23:31:15 +0700

Cherry - Mimic CTF Finals 2025 Link to heading

Two weeks ago I went to Nanjing, China to take part in the 2025 Qiangwang Challenge on Cyber Mimic Defense Finals with the ARESx team. Me and @leo_something) full cleared pwn during the CTF and in this writeup we are going to talk about a really nice browser challenge we encountered.

Overview Link to heading

The challenge consisted in a patched version of jerryscript, a “lightweight JavaScript engine intended to run on a very constrained devices such as microcontrollers”.