Linux kernel exploit development

Inspired by Midas's seriesarrow-up-right on Linux kernel exploit development, this series follows the same pattern of exploit mitigations using pwn.college's kernelarrow-up-right and includes all of my code and examples here arrow-up-right

Topics include: * Setuparrow-up-right * Interacting with kernel modules (ioctl, character devices)arrow-up-right * Stack cookiesarrow-up-right * KASLRarrow-up-right * SMEParrow-up-right * SMAParrow-up-right * KPTIarrow-up-right * modprobe_path * cred_struct overwritting

Protections TLDR:

KASLR - Requires a leak to exploit

SMEP - Can't execute shellcode in userspace while in kernelmode (Kind of like DEP/NX)

SMAP - No reading or writing from userspace pages while in kernelmode (Stack pivots harder)

KPTI - Separate kernel space from user space. Need to swap between pages

Last updated

Was this helpful?