Pentester
2.79K subscribers
115 photos
3 videos
163 files
2.76K links
- Offensive Security (Red Teaming / PenTesting)
- BlueTeam (OperationSec, TreatHunting, DFIR)
- Reverse Engineering / Malware Analisys
- Web Security
Download Telegram
VM Escape Exploit for Parallels Desktop Hypervisor (Pwn2Own 2021) source code + video walkthrough

https://zerodayengineering.com/research/pwn2own-2021-vm-escape.html

A virtual machine escape exploit will typically require kernel privileges in the guest OS. In this exploit it off-loading the reverse-engineered toolgate protocol implementation to a Python module, while keeping low-level kernel code minimal, just enough to implement the attack interface - a nod to the principle of least privilege in systematic software engineering, which is missed a lot in non-trivial exploit development.
ⓒ Alisa Shevchenko
🔥2