> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/privilege-escalation/linux/kernel-exploitation.md).

# Kernel Exploitation

Kernel exploits are used to elevate privileges from a low-privileged user to root by targeting vulnerabilities in the Linux kernel. These exploits require local access and are typically matched to the kernel version running on the target system.

***

### Identify OS and Kernel Version

#### OS Version

```bash
cat /etc/os-release
cat /etc/*-release
cat /etc/lsb-release
cat /etc/redhat-release
lsb_release -a
```

#### Kernel Version

```bash
uname -a         # Complete system information
uname -r         # Kernel release
uname -s         # Kernel name
uname -m         # Machine architecture
cat /proc/version
```

***

### Kernel Package Information

#### For RPM-based systems (RedHat, CentOS):

```bash
rpm -q kernel
rpm -qa | grep kernel
```

#### For DPKG-based systems (Debian, Ubuntu):

```bash
dpkg -l | grep kernel
```

#### Additional:

```bash
dmesg | grep -i kernel
```

***

### Search for Kernel Exploits

#### Using SearchSploit (offline):

```bash
searchsploit linux kernel 4.15
```

#### Online Resources:

* Google Search (linux kernel 4.15 exploit)
* [Exploit-DB](https://www.exploit-db.com)

***

### Compile or Transfer Exploit Code

If an exploit is found, it might require:

* Compiling the exploit code on the **target** system (check if compilers like `gcc` or `clang` are available).

#### Example:

```bash
gcc exploit.c -o exploit
```

***

### Common Kernel Exploits

| Exploit Name    | CVE ID        |
| --------------- | ------------- |
| Dirty COW       | CVE-2016-5195 |
| PwnKit (Polkit) | CVE-2021-4034 |
| OverlayFS       | CVE-2015-1328 |
| Dirty Pipe      | CVE-2022-0847 |

***

### Kernel Exploit Suggestion Tools

These tools can help automatically suggest known kernel exploits for the running version:

* [**Les.sh**](https://github.com/mzet-/linux-exploit-suggester) (original shell script):

```bash
./les.sh
```

* [**Linux Exploit Suggester 2**](https://github.com/jondonas/linux-exploit-suggester-2):

```bash
perl linux-exploit-suggester-2.pl
```