https://kiperz.dev/tags/kaslr/ Recent content in KASLR on kiperZ Hugo -- 0.147.7 en Tue, 14 Jul 2026 00:00:00 +0000 https://kiperz.dev/writeups/3-2-1-0-click-3/ Tue, 14 Jul 2026 00:00:00 +0000 https://kiperz.dev/writeups/3-2-1-0-click-3/ <blockquote> <p>CTF Shutlock 2026 · pwn Android</p></blockquote> <p>Parts 1 and 2 gave us 0-click native code execution, first under the app&rsquo;s uid (<code>flag1</code>), then the ability to make a broken provider read a <code>system</code> file (<code>flag2</code>). <code>flag3</code> climbs one more notch: it belongs to <code>root</code>, and, surprise, <strong>root isn&rsquo;t even enough</strong>. The file is also SELinux-protected: under <em>enforcing</em>, even uid 0 takes a denial. So we need <strong>kernel code</strong>: enough to become root <em>and</em> neutralize the SELinux policy.</p>