Introduction In march 2017, I took part in the pwn2own contest with team Chaitin Security Research Lab. The target I was focused on was VMware Workstation Pro and we managed to get a working exploit before the contest. Unfortunately, a version of VMware was released on March 14th, the day before the contest, with a patch for the vulnerability our e…

Overview First of all, we would like to thank @gyno_lbs. He asked us to make a writeup about this challenge in exchange for two free Binary Ninja licenses. As a result, most of the analyses in this writeup were re-done using Binary Ninja. Thanks to the insane reversing skills of my teammate fish, we were able to find a number of vulnerabilities i…

Introduction login: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.24, BuildID[sha1]=aaf466b83156cb16970b254de9d45994bef6e9f9, stripped Full RELRO Canary found NX enabled PIE enabled No RPATH No RUNPATH sandbox.so: ELF 64-bit LSB shared object, x86-64, versi…