pwnPromedium

read_me_not — sendfile bypass

spbctf

Task: shellcode runner opens /flag for us, places the fd in rdi, and then installs seccomp KILL rules for read/write/open. Solution: use sendfile (syscall 40) to copy the open flag fd to stdout entirely in kernel space, which never invokes the forbidden sys_read/sys_write and escapes the filter.

$ ls tags/ techniques/
seccompamd64shellcodingsendfilekill_rules
sendfile_syscall_bypasskernel_space_copysyscall_denylist_bypass
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups