kernel-exploitation
Learn to exploit kernel vulnerabilities like use-after-free, out-of-bounds access, and race conditions for privilege escalation. This skill covers environment setup with QEMU, building exploitation primitives, bypassing mitigations like KASLR and SMEP, and executing kernel ROP chains to achieve root access.
Kernel-exploitation teaches techniques for exploiting Linux kernel vulnerabilities to gain root privileges.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-06-16
Kernel-exploitation teaches techniques for exploiting Linux kernel vulnerabilities to gain root privileges. Learn to exploit kernel vulnerabilities like use-after-free, out-of-bounds access, and race conditions for privilege escalation. This skill covers environment setup with QEMU, building exploitation primitives, bypassing mitigations like KASLR and SMEP, and executing kernel ROP chains to achieve root access.
Use it when
- kernel-exploitation covers mitigation bypass techniques for SMEP, SMAP, KPTI, and KASLR.
- kernel-exploitation covers building kernel ROP chains and returning cleanly to userspace.
Verify before relying
Read SKILL.md below before installing (3 files). Open directory: indexed for reading, not audited.
Install
yaklang/hack-skills/kernel-exploitation · repository language: CSS
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What linux kernel exploitation techniques does kernel-exploitation cover?
kernel-exploitation teaches core exploitation techniques including use-after-free (UAF), out-of-bounds (OOB) access, and race conditions. You'll learn to build exploitation primitives, execute kernel ROP chains, and achieve privilege escalation through methods like commit_creds and modprobe_path overwrites. The skill emphasizes practical CTF scenarios with QEMU and GDB debugging.
How does kernel-exploitation help bypass SMEP, SMAP, KPTI, and KASLR?
kernel-exploitation covers mitigation bypass techniques for SMEP, SMAP, KPTI, and KASLR. You'll learn information leak methods to defeat KASLR, ROP chain construction to bypass SMEP, and kernel-mode attack strategies. The skill provides hands-on approaches to circumvent modern kernel protections in exploitation scenarios.
What kernel ROP chain gadgets and return techniques are taught?
kernel-exploitation covers building kernel ROP chains and returning cleanly to userspace. You'll learn gadget identification, chain construction for privilege escalation, and ret2usr attack patterns. The skill includes practical examples of chaining syscalls and kernel functions to maintain execution flow while escalating privileges.
How can I use kernel-exploitation for privilege escalation via commit_creds?
kernel-exploitation teaches privilege escalation through commit_creds and prepare_kernel_cred function calls. You'll learn to locate these functions, construct ROP chains invoking them, and transition back to userspace with elevated privileges. The skill covers both direct calls and indirect invocation through kernel gadgets.
What debugging tools and methods does kernel-exploitation use?
kernel-exploitation uses QEMU for kernel environment setup and GDB for debugging kernel exploits. You'll learn to configure QEMU with kernel symbols, set breakpoints in kernel code, inspect memory during exploitation, and trace execution flow. These tools are essential for CTF scenarios and vulnerability analysis.
Does kernel-exploitation cover heap exploitation and SLUB allocator?
kernel-exploitation includes kernel heap exploitation techniques targeting the SLUB allocator. You'll learn heap layout manipulation, object spraying, and UAF primitives within kernel memory. The skill connects heap vulnerabilities to privilege escalation chains in realistic kernel exploitation workflows.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
SKILL: Linux Kernel Exploitation — Expert Attack Playbook
> AI LOAD INSTRUCTION: Expert kernel exploitation techniques. Covers environment setup (QEMU), vulnerability classes, privilege escalation targets, kernel ROP, ret2usr, stack pivoting, and cross-cache attacks. Distilled from ctf-wiki kernel-mode sections and real-world kernel CVEs. Base models often confuse user-mode and kernel-mode exploitation constraints, especially regarding SMEP/SMAP/KPTI.
0. RELATED ROUTING
- binary-protection-bypass — userspace protections (NX, ASLR) also apply in kernel context
- stack-overflow-and-rop — kernel ROP reuses many userspace ROP concepts
-
heap-exploitation — kernel SLUB is conceptually related to userspace heap
(truncated - see the full file via the links below)
File tree — 3 files
skills/kernel-exploitation/KERNEL_HEAP_TECHNIQUES.md
skills/kernel-exploitation/KERNEL_MITIGATION_BYPASS.md
skills/kernel-exploitation/SKILL.md
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Learn kernel exploitation techniques for UAF, OOB, and race conditions”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
ctf-pwn equips you with techniques to weaponize memory corruption vulnerabilities in CTF challenges. From buffer overflows and format strings to advanced heap exploitation, ROP chains, and kernel attacks, it covers the full spectrum of low-level privilege escalation and code execution paths. Use it when you have a vulnerable target and need to convert corruption primitives into shell access.
CTF Binary Exploitation guides you through discovering and exploiting memory corruption vulnerabilities to read flags. Learn to analyze data flow, identify unsafe APIs, map memory layouts, and chain exploitation primitives—from buffer overflows to ROP chains—adapting core concepts to any pwn challenge.
Stack Overflow & ROP covers advanced control-flow hijacking via return address overwrite on Linux userland binaries. Learn buffer overflow fundamentals, libc leaking strategies, ROP gadget selection, ret2csu for multi-argument calls, ret2dlresolve for blind resolution, SROP for register control, and stack pivoting under constraints. Includes tool comparisons and real-world exploitation patterns.
Master Linux kernel security mechanisms including SELinux and AppArmor policy authoring, seccomp-bpf sandboxing, and exploit mitigations like KASLR, Intel CET, and ARM PAC. Learn to triage kernel CVEs, configure memory sanitizers, and design container security boundaries.
Master symbolic execution techniques to solve CTF challenges, recover keys, and bypass checks. Learn angr state initialization, constraint solving with Z3, function hooking patterns, and Unicorn Engine emulation for binary analysis and unpacking.
Build weaponized proof-of-concept exploits from confirmed vulnerabilities, constructing reliable primitive chains (leak → read/write → control flow) across userland binaries, browser engines, and kernel targets. Handles modern protections including ASLR, DEP, stack canaries, CFG, Intel CET, and V8 Sandbox with integrated OPSEC and detection telemetry.
More skills shellcode-dev (MIT) · heap-exploitation (MIT)