https://th3b0ywh0l1v3d.github.io/tags/kernel/ Recent content in Kernel on Th3B0yWh0L1v3d — Security Writeups Hugo en-us Sun, 07 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/misc/lost-my-flag-printer/ Sun, 07 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/misc/lost-my-flag-printer/ A setuid helper pins an eBPF flag-printer into a world-accessible PROG_ARRAY then chmod 000s the program pin; loading an unprivileged socket-filter that bpf_tail_calls index 0 runs the root-loaded printer and fills the readable flag map.