skills.rest
lNwNl
lNwNlCOMMUNITY
Explore all skills by this author →
GitHub

kernel-exploitation

Develop mitigation-aware Linux kernel exploitation plans for privilege escalation.

2|Updated May 15, 2026
Search Tags:#privilege escalation#linux kernel exploitation#uaf exploitation#kaslr bypass#smep smap kpti#heap spraying#kernel rop
One-click install
npx skills add https://github.com/lNwNl/Methodos --skill kernel-exploitation
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: kernel-exploitation
Source: https://github.com/lNwNl/Methodos/tree/main/docker/opencode/skills/kernel-exploitation
Command: npx skills add https://github.com/lNwNl/Methodos --skill kernel-exploitation

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps you convert Linux kernel vulnerability findings (UAF, OOB, race, and type confusion) into a structured exploitation plan aimed at privilege escalation.

Core Features & Use Cases

  • Kernel exploitation workflow: Guides end-to-end reasoning from vulnerability identification to building primitives, bypassing mitigations, and selecting escalation targets.
  • Mitigation-aware attack paths: Integrates KASLR, SMEP, SMAP, KPTI, FG-KASLR, and CFI constraints into exploit strategy selection and return-to-user design.
  • Heap technique playbooks: Covers SLUB internals and practical cross-cache exploitation to achieve controlled reuse for structures like msg_msg, pipe_buffer, and sk_buff.
  • Use Case: When a CTF provides a kernel memory corruption bug, use this Skill to choose the correct primitive (read/write/RIP control), decide between commit_creds and modprobe_path overwrite, and design the final safe return to userspace.

Quick Start

Ask the AI to create a mitigation-aware exploitation plan for your kernel vulnerability by identifying the primitive you can build, the most suitable kernel target (commit_creds vs modprobe_path), and the required KASLR/SMEP/SMAP/KPTI return-to-userspace method.

Frequently Asked Questions about kernel-exploitation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I build a Linux kernel exploitation plan from a UAF vulnerability?▼

Building a Linux kernel exploitation plan from a UAF vulnerability requires establishing a controlled primitive like arbitrary read/write or RIP control through heap manipulation. You then select an escalation target such as commit_creds or modprobe_path overwrite to achieve privilege escalation.

What is the best way to bypass KASLR and SMEP during kernel privilege escalation?▼

Bypassing KASLR and SMEP during kernel privilege escalation involves designing a mitigation-aware attack path using kernel ROP techniques. This approach leverages arbitrary read primitives to leak KASLR base addresses and constructs ROP chains to defeat SMEP before executing the escalation payload.

How do I return to userspace safely after kernel exploitation with KPTI enabled?▼

Returning to userspace safely after kernel exploitation with KPTI enabled requires using a KPTI trampoline or executing swapgs and iretq instructions properly. This ensures the CPU transitions cleanly between kernel and user page tables without triggering a system panic.

When should I choose commit_creds over modprobe_path for privilege escalation?▼

Choosing commit_creds over modprobe_path depends on your exploit primitive: use commit_creds when you have controlled RIP execution to call the function directly, and overwrite modprobe_path when you only have arbitrary write primitives to trigger root execution via a failed binary lookup.

Can I use cross-cache heap spraying to exploit race conditions in the SLUB allocator?▼

Yes, you can use cross-cache heap spraying to exploit race conditions in the SLUB allocator. This technique manipulates SLUB internals to achieve controlled reuse of structures like msg_msg, pipe_buffer, or sk_buff, turning a race or type confusion bug into a reliable exploitation primitive.

Does this kernel exploitation approach work under CFI and FG-KASLR constraints?▼

Yes, this approach works under CFI and FG-KASLR constraints by integrating them into the mitigation-aware attack path selection. The strategy adapts to these mitigations by selecting appropriate exploitation routes and return-to-user methods that bypass control flow integrity and function granular address randomization.

Related Skills

Explore More Software Engineering Skills→
zebbernzebbern
4.5k

Linux Privilege Escalation

Enumerate and exploit privilege escalation paths on Linux systems.

Community
Advanced
kiwamizamuraikiwamizamurai
7

binary-analysis

Analyze binaries to identify protections, vulnerabilities, and exploit starting points.

Community
Advanced
salmanabdurrahmansalmanabdurrahman

ctf-pwn-heap

Execute heap exploitation workflows against authorized CTF binaries.

Community
Advanced
DorianGalloDorianGallo
5

kernel-exploitation

Convert Linux kernel vulnerabilities into privilege escalation plans with mitigation-aware exploitation strategies.

Community
Advanced