featured post

Bypassing XDP and TC: Stealthy Connection Interception via BPF SK_LOOKUP

While most offensive eBPF techniques rely on XDP or TC to intercept raw network packets, Linux 5.6+ introduced BPF_PROG_TYPE_SK_LOOKUP, a hook operating at the socket dispatch layer. By attaching a 28-line BPF program directly to a network namespace, an attacker can silently redirect incoming TCP SYN requests to a backdoor socket without modifying packets, recalculating checksums, altering iptables rules, or leaving wire-level artifacts. This post breaks down how the technique works, common implementation traps, why it evades conventional EDR checks, and how defenders can audit for it.

ebpf sk-lookup bpf-sk-assign linux-kernel tcp-interception socket-programming red-teaming edr-evasion network-security c poc offensive-security backdoor-techniques netns libbpf
Jul 30, 2026  ·  16 min read  ·  67 views
read →
recent writing
eBPF Security Bypassing XDP and TC: Stealthy Connection Interception via BPF SK_LOOKUP Jul 30, 2026
Linux, Kernel, shellcode Cacheghost: Executing code from the kernel page cache Jul 30, 2026
Kernel I Spent a Week Fuzzing the BPF Verifier's New Circular Number System Jul 29, 2026
Security Research or Vulnerability Analysis DCOM Permission Misconfiguration in WaaSMedicSvc Enables Unprivileged PPL Process Access Mar 11, 2026
Windows Internals How Windows Delivery Optimization's Trust Chain Can Be Broken Before It Starts Mar 10, 2026
5posts
0papers
60topics
1110total views
writingarchive →
Linux, Kernel, shellcode ·linux-kernel

Cacheghost: Executing code from the kernel page cache

A file-backed executable mapping where the page content diverges from the backing file.

Jul 30, 2026 5 min 95 views
Kernel ·bpf

I Spent a Week Fuzzing the BPF Verifier's New Circular Number System

I spent the better part of a week reverse-engineering Meta's ~3500 line refactoring of the BPF verifier's bounds tracking, the "circular number" (or cnum) rework that landed in Linux 7.0. I built a fuzzer, ran a quarter million random tests, traced through the linked register propagation by hand, disassembled my running kernel's vmlinux to check for backports, and generally went deeper into `kernel/bpf/verifier.c` than any sane person should.

Jul 29, 2026 4 min 84 views
Security Research or Vulnerability Analysis ·Windows

DCOM Permission Misconfiguration in WaaSMedicSvc Enables Unprivileged PPL Process Access

The Windows Update Medic Service (WaaSMedicSvc) is configured with overly permissive DCOM LaunchPermission rights, granting standard users the ability to instantiate COM objects within a Protected Process Light (PPL) service running as LocalSystem. The service, which operates with LaunchProtected=2 (PPL), exposes the WaaSRemediation COM object with LaunchPermission SDDL that includes Everyone (WD) and Interactive User (IU) with execute rights. This configuration allows unprivileged users to communicate across the PPL security boundary and execute methods in SYSTEM context. While prior research demonstrated exploitation of this attack surface via TypeLib hijacking, this finding identifies a distinct unprivileged access vector. Remediation involves restricting DCOM LaunchPermission to SYSTEM and Administrators only.

Mar 11, 2026 6 min 218 views
Windows Internals ·windows

How Windows Delivery Optimization's Trust Chain Can Be Broken Before It Starts

Windows Delivery Optimization's security model, chunk hashes, peer banning, retry logic, all of it flows from a single in-memory structure called the Pieces Hash File. Control that file, and every downstream verification check works in your favor. This research traces how to get there: from the DLL, through the unpinned SSL channel, to the third-party CDN infrastructure serving that file to every Windows 11 machine on the planet.

Mar 10, 2026 25 min 646 views