0day VirtualBox 6.1.2 Escape for RealWorld CTF 2020/2021

Overview

RWCTF21-VirtualBox-61-escape

0day VirtualBox 6.1 Escape for RealWorld CTF 2020/2021

Demo

Exploit Demo

What?

This is our solution for RealWorld CTF's "Box Escape" challenge from the 2020/2021 quals. Currently a 0day but we'll add the CVE number once there is one. CVE-2021-2119

How does it work?

We wrote a blogpost describing the vulnerabilities and our exploit techniques. You can find it here.

How to protect yourself?

Until the release build of VirtualBox is patched disable SCSI.

Credits

Writing this exploit was a joint effort of a bunch of people.

  • ESPR's spq, tsuro and malle who don't need an introduction :D

  • My ALLES! teammates and windows experts Alain Rödel aka 0x4d5a and Felipe Custodio Romero aka localo

  • niklasb for his prior work and for some helpful pointers!

"A ROP chain a day keeps the doctor away. Immer dran denken, hat mein Opa immer gesagt."

~ Niklas Baumstark (2021)

  • myself, Ilias Morad aka A2nkF :)

I had the pleasure of working with this group of talented people over the course of multiple sleepless nights and days during and even after the CTF was already over just to get the exploit working properly on a release build of VirtualBox and to improve stability. This truly shows what a small group of dedicated people is able to achieve in an incredibly short period of time if they put their minds to it! I'd like to thank every single one of you :D

You might also like...
Firmware-agnostic PS4 sandbox escape

libjbc This a firmware-agnostic implementation of the sandbox escape for PS4 homebrew apps. It operates by traversing the process list up to PID 1 (in

Control-Alt-Delete - Help Tux Escape Beastie's Jail!

Control-Alt-Delete Help Tux escape Beastie's jail by completing the following challenges! Challenges Challenge 00: Drinks: Tux needs to drink less. Ch

➿ mulle-c-string-escape turns data into C-strings

mulle-c-string-escape ➿ mulle-c-string-escape turns data into C-strings Non-ASCII characters will be escaped to hex or octal. C-escapes are used for k

A virtual machine hardware tool that gives you an escape option for when your VM locks you in (when it freezes, and also traps your mouse).

A virtual machine hardware tool that gives you an escape option for when your VM locks you in (when it freezes, and also traps your mouse). A secondary mouse that only activates once you press it.

Do you have what it takes? - 2-bit Dungeon Escape game implemented on the Arduino Platform
Do you have what it takes? - 2-bit Dungeon Escape game implemented on the Arduino Platform

This game was created as part of the Introduction to Robotics course I took during my 3rd year of studying Computer Science @ University of Bucharest,

C/C++ Application to solve irrigation rotation whatever two-turn rotation or three-turn rotation, longitudinal section design, hydraulic calculations, and design of hydraulic structures like weirs and tail escape.
C/C++ Application to solve irrigation rotation whatever two-turn rotation or three-turn rotation, longitudinal section design, hydraulic calculations, and design of hydraulic structures like weirs and tail escape.

Irrigation works C/C++ Application to solve irrigation rotation whatever two-turn rotation or three-turn rotation, longitudinal section design, hydrau

Slides and other materials from CppCon 2020

CppCon 2020 Presentation Materials https://github.com/CppCon/CppCon2020 is the canonical location for presentations and code from CppCon 2020. For Spe

Repository of problems and solutions of labsheets used for Data Structures and Algorithms (CS F211) in Semester 2, 2020-21 at BITS Pilani - Hyderabad Campus.

CS F211 Data Structures and Algorithms (BITS Pilani - Hyderabad Campus) This repository contains the problems, solution approaches & explanations and

Bootcamp 2020-21

Welcome to Winter Bootcamp 2020 The goal of this bootcamp is to get you familiar with the fundamentals of code.The bootcamp consists of 4 weeks of mai

Solutions for problems given in ETH course Algorithms Lab in Fall 2020

Algolab2020 Solutions for problems given in ETH course Algorithms Lab in Fall 2020. The code for these problems is written with the following in mind:

T-Watch 2020 v1 compatible firmware providing WiFi and BLE testing tools (and also, a watch :D)

ESP-IDF template app This is a template application to be used with Espressif IoT Development Framework. Please check ESP-IDF docs for getting started

Repository for the Object-oriented programming course for academic year 2020/21

Object-Oriented Programming 2020/21 Repository for the Object-oriented programming course for the 2020/21 academic year. Structure exam -- tasks given

Demo exploit code for CVE-2020-27904, a tfp0 bug.

xattr-oob-swap CVE-2020-27904: a tfp0 bug for macOS 10.15.x and below. Demo exploit code for my talk at BlackHat ASIA 2021. The vulnerability has been

2020-1 KyungHee University information protection project
2020-1 KyungHee University information protection project

PGP Pretty Good Privacy의 약자로, 컴퓨터 파일을 암호화하고 복호화하는 프로그램입니다. Visual Studio 2019 기반으로 코드를 완성했고, PGP 동작 과정을 콘솔에 표현했습니다. PGP Transmission Mode의 Step 3 단계에서

Unofficial third-party implementation of FFD (fast feature detector) published in IEEE TIP 2020.

fast_feature_detector Unofficial third-party implementation of FFD (fast feature detector) published in IEEE TIP 2020. Caution I have not got any perm

C64 Watch is a customized T-Watch 2020 that was inspired by the Commodore 64 computer. It features a C64 theme and a built-in BASIC interpreter.
C64 Watch is a customized T-Watch 2020 that was inspired by the Commodore 64 computer. It features a C64 theme and a built-in BASIC interpreter.

C64 Watch C64 Watch is a customized T-Watch 2020 that was inspired by the Commodore 64 computer. It features a C64 theme and a built-in BASIC interpre

Repo per il corso di Programmazione 2 - canale M-Z - A.A. 2020/21

Argomenti del corso Principi della Programmazione a Oggetti Astrazione Incapsulamento e Information Hiding Ereditarietà Polimorfismo Classi e oggetti

Project Game lama 2020
Project Game lama 2020

Runner-game-with-Unreal-Engine-4 Baca Deskripsi di bawah Game ini di buat pada tahun 2020 menggunakan Game Engine Unreal Engine 4 Software Pendukung U

MasterAI decisively defeated 14 top human Texas hold'em poker professsionals in September 2020.

MasterAI-1.0-1vs1-Limit Introduction MasterAI is an AI poker dedicated to suport n-play (single- or multi-agent) Texas Hold'em imperfect-informatin ga

Comments
  • No

    No "how does it work" document

    We wrote a blogpost describing the vulnerabilities and our exploit techniques. You can find it here (https://github.com/Sauercloud/RWCTF21-VirtualBox-61-escape/blob/main/TODO).

    Wrong link or you forgot to add TODO file.

    opened by rkraevskiy 1
Owner
null
Advent-of-Code: 2021 Edition

?? ?? Advent of Code 2021 ☃️ ❄️ Description Advent of code 2021 Awesome Advent of Code Advent of Code is an Advent calendar of small programming puzzl

Lento Manickathan 6 Apr 5, 2022
Building Escape is a simple room escape game made with Unreal Engine 4.27 and C++.

Building-Escape Building Escape is a simple room escape game made with Unreal Engine and C++. The main purpose of the game is to find a way to escape

Christine Coomans 2 Dec 13, 2021
This Program Enables And Disables Hyper-V Hypervisor So You Can Use Other Virtualisation Tools Such As (VMware, VirtualBox) Simultaneously.

Hyper-V-Switch This Program Enables And Disables Hyper-V Hypervisor So You Can Use Other Virtualisation Tools Such As (VMware, VirtualBox) Simultaneou

RaynerSec 4 Nov 10, 2022
StringCheese is a CTF tool to solve easy challenges automatically in many cases where a strings | grep is just not enough

StringCheese StringCheese is a script written in Python to extract CTF flags (or any other pattern with a prefix) automatically. It works like a simpl

Mathis HAMMEL 62 Nov 30, 2022
A CTF fuzz powerd by protobuf.

protobuf_ctf_fuzz 一、简介 通过 protobuf + AFLplusplus 进行传统 ctf fuzz。 请参考这篇博文 来了解具体细节。 二、构建与运行 构建很简单,只需一行命令即可: 网络一定一定一定要好!!! 否则还是一条一条的粘贴 ./build.sh 中的命令运行,确

Kiprey 10 Dec 12, 2022
Problem set of the final contest from CTF COMPFEST 13

CTF COMPFEST 13 - Final This repository contains the problem set of final contest from CTF COMPFEST 13. Table of Contents Problem Title Author Categor

CTF COMPFEST 8 Oct 11, 2022
DirectX 11 library that provides convenient access to compute-based triangle filtering (CTF)

AMD GeometryFX The GeometryFX library provides convenient access to compute-based triangle filtering (CTF), which improves triangle throughput by filt

GPUOpen Effects 218 Dec 15, 2022
Aulas de Sistemas Operativos da turma LI42D no semestre de verão de 2020/2021

ISEL - Sistemas Operativos LI42D - Verão de 2021 Aulas de Sistemas Operativos da turma LI42D no semestre de verão de 2020/2021 Aulas Remotas em Direct

null 12 May 6, 2022
CVE-2021-24084 Windows Local Privilege Escalation Left officially unpatched since 2020. Hence, its still a zero day

WindowsMDM-LPE-0Day Works best on Windows 11 CVE-2021-24084 Windows Local Privilege Escalation Left officially unpatched since 2020. Hence, its still

Exploit Blizzard 35 Nov 9, 2022
Ejercicios y prácticas de Sistemas Operativos (SO) del curso 2020-2021.

Sistemas Operativos UCM Ejercicios y prácticas de la asignatura de Sistemas Operativos (grado de Ingeniería Informática) del curso 2020-2021. A contin

Erik 1 Dec 23, 2021