skills.rest
DorianGallo
DorianGalloCOMMUNITY
Explore all skills by this author →
GitHub

kernel-exploitation

Convert Linux kernel vulnerabilities into privilege escalation plans with mitigation-aware exploitation strategies.

5|2|Updated May 16, 2026
Search Tags:#exploitation#linux kernel#kaslr bypass#kernel rop#heap uaf#smep smap#kpti trampoline
One-click install
npx skills add https://github.com/DorianGallo/hack-skills-local --skill kernel-exploitation-doriangallo
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: kernel-exploitation
Source: https://github.com/DorianGallo/hack-skills-local/tree/main/skills/kernel-exploitation
Command: npx skills add https://github.com/DorianGallo/hack-skills-local --skill kernel-exploitation-doriangallo

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you turn Linux kernel vulnerabilities into reliable privilege escalation paths by building exploitation primitives and selecting appropriate targets and mitigation bypasses.

Core Features & Use Cases

  • Kernel exploitation workflow: Guides vulnerability → primitive → mitigation bypass → privilege escalation target → clean return to userspace.
  • Kernel heap exploitation playbook: Explains SLUB internals and cross-cache strategies for UAF/OOB-based control over kernel objects like msg_msg, pipe_buffer, and sk_buff.
  • Mitigation-aware attack planning: Covers KASLR, SMEP, SMAP, KPTI, FG-KASLR, and CFI considerations so your plan matches the target environment.
  • Privilege escalation methods: Focuses on commit_creds/prepare_kernel_cred, modprobe_path overwrite, and cred structure overwrite patterns, including return-to-userspace handling.

Quick Start

Ask an AI to walk you through exploiting a kernel UAF/OOB by mapping the bug to the correct heap primitive, identifying the right escalation target, bypassing KASLR/SMEP/SMAP/KPTI, and producing the final return-to-userspace plan for a CTF scenario.

Frequently Asked Questions about kernel-exploitation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I exploit a Linux kernel UAF vulnerability for privilege escalation?▼

Bypassing KASLR, SMEP, SMAP, and KPTI mitigations during kernel exploitation requires selecting correct primitives and leveraging techniques like the KPTI trampoline to orchestrate a clean return to userspace.

What is the workflow for converting a kernel OOB bug into an escalation strategy?▼

The workflow for converting a kernel OOB bug into an escalation strategy involves mapping the vulnerability to a primitive, selecting a mitigation bypass, overwriting targets like modprobe_path, and returning to userspace.

Can I plan cross-cache heap exploitation attacks targeting SLUB internals?▼

Yes, you can plan cross-cache heap exploitation attacks targeting SLUB internals, using UAF or OOB primitives to gain control over kernel objects like sk_buff, pipe_buffer, and msg_msg.

Does this kernel exploitation approach work for CTF and authorized research settings?▼

Yes, this kernel exploitation approach works for CTF and authorized research settings, providing mitigation-aware execution constraints and end-to-end return-to-userspace orchestration for Linux kernel vulnerabilities.

What privilege escalation methods are used after a kernel ROP flow?▼

Privilege escalation methods used after a kernel ROP flow include invoking commit_creds and prepare_kernel_cred, overwriting modprobe_path, and performing cred structure overwrites before handling return-to-userspace.

How do I handle type confusion and race conditions in Linux kernel exploitation?▼

Handling type confusion and race conditions in Linux kernel exploitation involves mapping these vulnerabilities to correct heap primitives, bypassing CFI and FG-KASLR mitigations, and selecting appropriate escalation targets.

Related Skills

Explore More Software Engineering Skills→
thimsluggathimslugga

kernel-debug

Coordinate multi-agent workflows to analyze Linux kernel crashes and produce debug reports.

Community
Advanced
alicangnllalicangnll

Linux Driver Exploit

Identify and exploit Linux kernel module vulnerabilities for privilege escalation.

Community
Advanced
BrownFineSecurityBrownFineSecurity
811

chipsec

Analyze offline UEFI firmware dumps to detect malware and vulnerabilities.

Official
Advanced
utsavthakurutsavthakur

stack-overflow-and-rop

Construct ROP chains and bypass protections in Linux binaries.

Community
Advanced