kernelpwn - kernel-pwn and writeup collection

项目说明

kernel pwn

About this repo

This repository collects CTF kernel-pwn challenges and writeups.
Also, it introduces how to start learning kernel-pwn for beginners including me.
All the challs here are solved by me, though the writeup may be based on the author's one or others's ones.
I'm planning to include not only kernel-pwn, but also general non-userland pwn including QEMU, V8, multi-arch...

IMPORTANT:
If you know some good kernel(non-userland) pwn challs, please tell me and I'll solve it. Then I'll add it on this repo if I feel it good to solve.
And if you notice some wrong points in my writeups or blog posts, feel free to contact me.

Good Challs

corjail from CoRCTF2022

- SMEP/ SMAP/ KPTI/ KASLR/ Docker escape/ heap randomized/ heap hardened/ uffd disabled/ modprobe_path static/ poll_list/ user_key_payload/ kROP on tty_struct
-

Fire of Sal from CoRCTF2021

- SMEP/ SMAP/ KPTI/ KASLR/ FGKASLR/ heap randomized/ msg_msg/ uffd
-

nightclub from pbctf 2021

- SMEP/ SMAP/ KPTI/ KASLR/ uffd disabled/ heap
-

kone_gadget from SECCON CTF 2021

- SMEP/ SMAP/ KPTI/ no-KASLR/ unpri ebpf installation is NOT allowed / well-crafted shellcode in JIT-ed seccomp filter
-
- you are able to control RIP but all the registers are zero-cleared before it. Unpri ebpf is forbidden, but seccomp filter is still JIT-ed. you abuse operand to be shellcode and jump e to next opcode (which means next shellcode).
- Unexpected solution is jmp &flag, which leaks secret content in CODE secition of panic message. It means that if the kernel uses initramfs and KASLR is disabled (or we have full knowlege of memory layout), just getting RIP means success of exploit, SMEP/SMAP is useless.

klibrary from 3kCTF 2021

- SMEP/ SMAP/ KPTI/ KASLR/ race w/ uffd/ tty_struct/ modprobe_o in tty_struct
-
- between beginner and med

shared knote from Bsides Ahmedabad 2021

- no-SMEP/ no-SMAP/ KPTI/ KASLR/ modprobe_path search/ invalid fpos use/ zero-addr mapping
-
- I added check /proc/sys//addr in my first procedures list.

pprofile from LINE CTF 2021

- SMEP/ SMAP/ KPTI/ KASLR/ pointer / modprobe_path
-
- I realized again that userland pointer is important and kernel can endure some wirte-bruteforce. If the doesn't exist in distributed binaries, I should recall this chall.

nutty from Union CTF 2021

- SMEP/ SMAP/ KPTI/ KASLR/ race without uffd/ SLOB
-
- NOTE: I ignored the heap-o bug, and invoked race condition w/o uffd to abuse tty_struct. Then, bypass SMAP by kROP in kheap(on tty_strut).

Day One from AIS3 EOF CTF 2021 Final

- SMEP/ SMAP/ KPTI/ KASLR/ eBPF
-
- NOTE: the first half part of the chall is a little bit boring cuz it is exactly the same with the report of ZDI. But, the last half part, where we get root without bpf_map.btf, is cool.

kernel-rop from hxp CTF 2020

- SMEP/ SMAP/ KPTI/ FGKASLR/ single-core/ kROP
-

SharedHouse from ASIS 2020 Quals

- SMEP/ no-SMAP/ no-KPTI/ single-core/ heap
-

Spark from HITCON 2020

- SMEP/ no-SMAP/ no-KPTI/ signle-core/ heap
-

hashbrown from DiceCTF 2021

- SMEP/ SMAP/ KPTI/ FGKASLR/ double-core/ race/ hardened-heap
-

gnote from TokyoWesterns CTF 2019

- race
-

eebpf from TokyoWesterns CTF 2020

- eBPF/ bug
-

Krazynote from BalsnCTF 2019

- classic uffd/ race
-

Frequently Updated now...

Nirugiri

I don't know these challs are difficult or not and good or soso. But at least I feel these challs are worth solving.

[hwdbg]() from CakeCTF 2021

- TODO: writeup
- SMEP/ SMAP/ KPTI/ KASLR/ physicasl memory access/ modprobe_path
-
- You have AAW towards /dev/mem/, so all the protection is useless. However, CONFIG_DE is enabled and you would be confused if you don't know this config.

Stonks Socket from Hack.lu CTF 2021

- no-SMEP/ no-SMAP/ race w/o uffd/ custom TCP hook
-
- challenge itself is a little bit buggy, but enough for practice of race w/o uffd.

Frequently Updated now...

Beginners

If you don't know how to prepare for solving kernel-pwn, please refer to start-kernel-pwning.

lkgit(TBD) from TSGCTF 2021

- SMEP/SMAP/KPTI/KASLR/race
- simple uffd, though appropriate fault timing handling is required.
-

meowmeow from zer0pts CTF 2020

- buffer o
-

kstack from SECCON CTF 2020

- race
-

babydriver from NCSTISC CTF 2018

- kUAF
-

flitbip from Midnightsun CTF 2018 Finals

- no-SMEP/ no-SMAP/ no-KASLR/ custom syscall
-

Frequently Updated now...

Techniques

I want to know some techniques to pwn in kernelland. If you know something I should know, please tell me.
For the techniques I used to solve the challs listed above is listed HERE(under construction).

Frequently Updated now...

Configs to check

Kernel is distributed in the form of bzImage and no information about build configuration is not provided in 99% cases. However, you have to change the way of exploit depending on the configuration.
Some config might hide important information. Some config might randomize the memory layout. Some config might make only readable...
important_config directory collects the important configurations and tries to summarize how to check if it is enabled and how to bypass it.

My Blog

My blog posts contain not only kernel-writeup, but normal userland-pwn and technique frequently used in pwning and so on...
Please check it out.
NOTE:
The most parts of my blog is written when I'm solving the chall as a memo in HackMD and is con to blog entry with md2html con . I received some DMs which ask me to write my blog posts in Englinsh and I'm willing to, cuz writing in English is not a so heavy task for me (regardless of the quality of my English). I know that my blog is ill-translated by Google translater :( I'm planning to write them in English someday in the near future.

References

List of usefull resources are listed under reference directory.

If you have any suggestions, feel free to contact me on Twitter.

LICENSE

This repository is licensed under MIT.

Note that this license is applied only to WHAT I WROTE.

Binary of kernel challenges themsel be in many cases licensed under other licenses.

Please follow these in that case.

If you think this or related repositories your rights, please contact me.

项目信息

开发语言：C

Star 数：732

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕kernel-pwn and writeup collection展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。