Projects on bitfriends' blog

Reviving modprobe_path technique (again)

Fri, 03 Jul 2026 23:22:28 +0700

Overview Link to heading

The modprobe_path technique is a widely known Linux kernel exploitation primitive that can be used to turn an arbitrary write primitive into LPE.

TL;DR Link to heading

modprobe_path is a string that specifies the name of the modprobe executable in the Linux kernel. This program is responsible for adding and removing loadable kernel modules.

When CONFIG_STATIC_USERMODEHELPER is disabled modprobe_pathis R/W, this means that if we have an arbitrary write primitive and a KASLR leak, we can change it to a controlled executable file path. If we now find a way to make the kernel run modprobe for us, it will run our executable with root privileges, thus achieving LPE.

My own kernel fuzzer - lxfuzz

Sat, 07 Sep 2024 18:11:00 +0200

My long-term project is writing a kernel fuzzer named lxfuzz. It is a coverage-guided fuzzer for the linux kernel. I chose that project for some reasons:

To learn about fuzzing, its mechanisms etc. in general
To learn more about the linux kernel, especially
To improve my C++ skills :) (the language used for lxfuzz)
Profit (finding CVEs)

Under the hood it’s using qemu to run the kernel and KCOV for coverage collection. The project is still work-in-progress and developed gradually. Current features are:

Exploiting the kernel - CVE-2022-24122

Sun, 12 Mar 2023 17:47:13 +0200

For the first time I exploited the kernel in real life. I used the bug CVE-2022-24122, which allowed a use-after-free due to bad use of refcount.

The exploit itself requires a KASLR leak to prevent an oops during the process, as well as access to user namespaces. It is not really reliable, needs many tries :D

To get root I corrupted the SLUB freelist and wrote to modprobe_path.

The exploit code can be found on GitHub or in the following:

Jailbreaking iOS 9.3.5 - CVE-2016-4669

Tue, 01 Mar 2022 14:02:26 +0200

In this article, I’ll present a detailed iOS jailbreak writeup and some basic tips and tricks on how to set up an environment for exploiting. The bug I am exploiting is in the iOS kernel. I hope this is a helpful reference for anyone who wants to start with iOS pwn

Now let us begin! Link to heading

Short story:

A few weeks ago, I found an old iPad 3,1 by my dad. I wanted to set it up for homeschooling for my sister, but the iOS version was so old, that I was unable to download anything from the AppStore. So I decided to jailbreak it to make it somewhat usable again. However, I didn’t use my own jailbreak at first. I used the Phoenix jailbreak from https://phoenixpwn.com/, which worked like a charm. Now I can install some packages and tweaks to be able to download older app versions from the App Store. But I wasn’t satisfied. In fact, I used an exploit that other people wrote and I didn’t know exactly what it was doing. That’s why I decided to do some research, to understand how the Phoenix jailbreak worked and maybe write a jailbreak or at least a demo by ourselves.