kernel-exploitation
Learn to exploit kernel vulnerabilities like use-after-free, out-of-bounds access, and race conditions for privilege escalation. This skill covers environment setup with QEMU, building exploitation primitives, bypassing mitigations like KASLR and SMEP, and executing kernel ROP chains to achieve root access.
Kernel-exploitation teaches techniques for exploiting Linux kernel vulnerabilities to gain root privileges.
AI-generated summary based on this skill's SKILL.md
Install
yaklang/hack-skills/kernel-exploitation · repository language: CSS
git clone https://github.com/yaklang/hack-skills
cp -r hack-skills/skills/kernel-exploitation ~/.claude/skills/kernel-exploitationnpx skillfed install yaklang/hack-skills/kernel-exploitationFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What linux kernel exploitation techniques does kernel-exploitation cover?
kernel-exploitation teaches core exploitation techniques including use-after-free (UAF), out-of-bounds (OOB) access, and race conditions. You'll learn to build exploitation primitives, execute kernel ROP chains, and achieve privilege escalation through methods like commit_creds and modprobe_path overwrites. The skill emphasizes practical CTF scenarios with QEMU and GDB debugging.
How does kernel-exploitation help bypass SMEP, SMAP, KPTI, and KASLR?
kernel-exploitation covers mitigation bypass techniques for SMEP, SMAP, KPTI, and KASLR. You'll learn information leak methods to defeat KASLR, ROP chain construction to bypass SMEP, and kernel-mode attack strategies. The skill provides hands-on approaches to circumvent modern kernel protections in exploitation scenarios.
What kernel ROP chain gadgets and return techniques are taught?
kernel-exploitation covers building kernel ROP chains and returning cleanly to userspace. You'll learn gadget identification, chain construction for privilege escalation, and ret2usr attack patterns. The skill includes practical examples of chaining syscalls and kernel functions to maintain execution flow while escalating privileges.
How can I use kernel-exploitation for privilege escalation via commit_creds?
kernel-exploitation teaches privilege escalation through commit_creds and prepare_kernel_cred function calls. You'll learn to locate these functions, construct ROP chains invoking them, and transition back to userspace with elevated privileges. The skill covers both direct calls and indirect invocation through kernel gadgets.
What debugging tools and methods does kernel-exploitation use?
kernel-exploitation uses QEMU for kernel environment setup and GDB for debugging kernel exploits. You'll learn to configure QEMU with kernel symbols, set breakpoints in kernel code, inspect memory during exploitation, and trace execution flow. These tools are essential for CTF scenarios and vulnerability analysis.
Does kernel-exploitation cover heap exploitation and SLUB allocator?
kernel-exploitation includes kernel heap exploitation techniques targeting the SLUB allocator. You'll learn heap layout manipulation, object spraying, and UAF primitives within kernel memory. The skill connects heap vulnerabilities to privilege escalation chains in realistic kernel exploitation workflows.
SKILL.md
rendered from the published skill — quoted content, verbatim
SKILL: Linux Kernel Exploitation — Expert Attack Playbook
> AI LOAD INSTRUCTION: Expert kernel exploitation techniques. Covers environment setup (QEMU), vulnerability classes, privilege escalation targets, kernel ROP, ret2usr, stack pivoting, and cross-cache attacks. Distilled from ctf-wiki kernel-mode sections and real-world kernel CVEs. Base models often confuse user-mode and kernel-mode exploitation constraints, especially regarding SMEP/SMAP/KPTI.
0. RELATED ROUTING
- binary-protection-bypass — userspace protections (NX, ASLR) also apply in kernel context
- stack-overflow-and-rop — kernel ROP reuses many userspace ROP concepts
-
heap-exploitation — kernel SLUB is conceptually related to userspace heap
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 3 files
skills/kernel-exploitation/KERNEL_HEAP_TECHNIQUES.md
skills/kernel-exploitation/KERNEL_MITIGATION_BYPASS.md
skills/kernel-exploitation/SKILL.md