Kernel-Exploit-Dojo - CTF kernel exploitation notes, PoCs, exploits, and

项目说明

!Kernel Exploit Dojo banner

Kernel-Exploit-Dojo （道場）

O

Kernel-Exploit-Dojo is a curated archive of 200+ Linux kernel exploitation CTF challenges, organized by bug class, exploitation primiti technique, difficulty, and sol.
The goal is to organize practical kernel pwn techniques such as UAF, heap spraying, pipe_buffer abuse, msg_msg, modprobe_path o, and cred o.

“Dojo” means a training place; this repository is intended as a practice-oriented archive for learning Linux kernel exploitation through CTF challenges.

Each challenge directory contains the original distribution files when a, exploit code, and a technical writeup.

Challenges are organized by year, and the top-le List works as an index to each challenge directory.

For technique-based na, see Techniques Index.

Note: Year folders are based on the actual event date, not necessarily the year shown in the CTF name.

Kernel-Exploit-Dojo (道場) は、200件以上の Linux Kernel Exploit CTF 問題を、Bug・Primitive・Final Technique・Difficulty・Solve数ごとに整理した技術索引です。

「道場」は練習・鍛錬の場という意味で、本リポジトリは CTF 問題を通じて Linux Kernel Exploit を学ぶための実践的なアーカイブです。

各問題ごとに配布ファイル、exploit、解説をまとめ、実戦的な kernel pwn 技術を復習できる形にしています。

各問題は年度別フォルダに整理しており、トップページの Challenge List から各問題へ移動できます。

技術別に探したい場合は Techniques Index を参照してください。

Note: 年度別フォルダは CTF 名の年ではなく、実際の開催年を基準にしています。

Disclaimer

This repository is for CTF learning and local lab en only.
Do not run the exploits on production systems or systems you do not own.
All examples are intended to be executed inside isolated QEMU/CTF en.

本リポジトリは CTF 学習およびローカル検証環境向けです。
実環境・第三者環境では絶対に実行しないでください。

Challenge List

Difficulty is subjectively classified based on exploit complexity, required kernel knowledge, and the number of solves. Note that unintended solutions arising from configuration misconfigurations are not taken into account.

Difficulty は exploit の複雑さ、必要な kernel 知識、solve 数をもとに主観的に分類しています。ただし、環境の設定ミス等に起因する非想定解（意図しない解法）は考慮していません。

| CTF | Challenge | Status | Difficulty (Solves) | Bug | Primitive | Final Technique |
|---|---|:---:|:---:|---|---|---|
| CakeCTF 2022 | welkerme | solved / writeup | (75) | kernel calls user function pointer | run user code as kernel | CC(PKC(0)) |
| b01lers CTF 2026 | throughthewall | solved / writeup | Easy (69) | kmalloc-1024 UAF | pipe_buffer reclaim | Dirty Pipe, /etc/passwd o |
| ASIS CTF Finals 2025 | KList | solved | Easy (37) | OOB write | kernel memory write | modprobe_path o |
| NexHunt CTF 2025 | below | solved / writeup | Easy (12) | OOB read/write | kernel read/write | modprobe_path o |
| N1CTF 2025 | ktou | solved / writeup | Easy (38) | logic flaws | kernel object pointer corruption | GOT o |
| UIUCTF 2025 | Baby Kernel | solved / writeup | Easy (53) | customizable UAF | tty_struct ops hijack | modprobe_path o |
| NahamCon CTF 2025 | The Jumps | solved / writeup | Easy (59) | stack o | kernel stack ROP | kernel ROP, CC(PKC(0)) |
| TCP1P CTF 2024 | K-Revenge | solved / writeup | Easy (4) | customizable UAF + double free | pipe-based kernel leak + AAW | freelist poisoning => modprobe_path o |
| SECCON Beginners CTF 2024 | kbuf | solved | Easy (8) | uninit heap + OOB R/W + arbitrary seek | OOB leak => AAR/AAW | modprobe_path o |
| L3akCTF 2024 | xen | solved / writeup | Easy (?) | stack buffer o | kernel stack RIP control | kernel ROP, CC(IC) |
| TCP1P CTF 2023: First Step Beyond Nusantara | 💀 | solved / writeup | Easy (5) | arbitrary read/write usercopy | AAR/AAW | modprobe_path o |
| corCTF 2023 | zeroday | solved / writeup | Easy (25) | QEMU serial multiplexing misconfiguration (monitor escape) | arbitrary physical memory read | QEMU monitor memory dump |
| SECCON Beginners CTF 2023 | driver4b | solved / writeup | Easy (19) | missing copy_from_user / copy_to_user | AAR/AAW | modprobe_path o / core_pattern o |
| Midnight Sun CTF 2023 Quals | SPD D | solved / writeup | Easy (?) | unchecked ppos used as kernel stack buffer offset | kernel stack OOB read/write | saved RIP o => ret2usr => CC(PKC(0)) |
| ADDA CTF 2022 | Kernauth | solved | Easy (11) | TOCTOU race | struct cred o | cred o / commit_creds() |
| TSJ CTF 2022 | clipboard.ko | solved | Easy (11) | kmalloc-1024 UAF | tty_struct o + function pointer hijack | modprobe_path o |
| BackdoorCTF 2021 | babyKernel | solved | Easy (?) | improper strlen() boundary check | linked-list pointer o | modprobe_path o |
| K3RN3LCTF | Easy kernel is still kernel right? | solved / writeup | Easy (16) | stack leak + stack BOF | canary leak + KASLR leak + kernel ROP | CC(PKC(0)) + KPTI trampoline |
| 3kCTF-2021 | echo | solved / writeup | Easy (9) | unsafe syscall | 8-byte AAR/AAW + physmap leak | modprobe_path o |
| CyberSecurityRumble CTF | unhackable | solved / writeup | Easy (15) | QEMU serial multiplexing misconfiguration (monitor escape) | arbitrary physical memory read | QEMU monitor memory dump |
| m0leCon CTF 2020 Teaser | babyk | solved / writeup | Easy (20) | stack BOF | saved RIP control | CC(PKC(0)) + kernel ROP |
| Hack.lu CTF 2019 | Baby Kernel 2 | solved / writeup | Easy (68) | arbitrary kernel read/write ioctl arguments | AAR/AAW | cred o |
| D^3CTF 2026 | d3kbus | writeup | Easy-Medium (78) | QEMU 0-day (perf_event / io_uring loop) | arbitrary physical memory write (PTE corruption) | guest kernel task pri escalation |
| MntcrlCTF 2026 | noName | solved | Easy-Medium (3) | UAF due to dangling global pointer | pipe_buffer o | Dirty Pipe, /bin/busybox page cache o |
| DEF CON CTF Qualifier 2026 | gitvfs | writeup | Easy-Medium (43/30) | QEMU 0-day (perf_event / io_uring loop) | arbitrary physical memory write (PTE corruption) | guest kernel task pri escalation |
| 0xFUN CTF 2026 | Phantom | solved / writeup | Easy-Medium (45) | mmap UAF | dangling mmap, freed page reuse | cred o, modprobe_path |
| THJCC CTF 2026 | Excalipipe | solved / writeup | Easy-Medium (17) | allowing reuse of merge flag | page cache o | /bin/busybox o |
| PatriotCTF 2025 | switchboard | solved / writeup | Easy-Medium (53) | kmalloc-32 UAF | small-cache reclaim, controlled object reuse | modprobe_path o |
| M*CTF 2025 Quals | Procrastination | solved | Easy-Medium (4) | UAF + double free + broken custom allocator size confusion | fake entry => AAR / AAW | modprobe_path o |
| LINE CTF 2025 | Transmit | solved | Easy-Medium (10) | trusted user pointer in TRANSMIT_FAST | arbitrary kernel write | modprobe_path o |
| TFC CTF 2025 | SLOTS | solved / writeup | Easy-Medium (28) | customizable UAF | tty_struct ops hijack | read global flag buffer |
| TsukuCTF 2025 | easy_kernel | solved / writeup | Easy-Medium (12) | UAF due to dangling global pointer | kmalloc-32 UAF write | seq_operations->start o + CC(IC) |
| TsukuCTF 2025 | xcache | solved / writeup | Easy-Medium (5) | UAF / double free in a dedicated kmem_cache object | SLUB freelist poisoning to corrupt the global object pointer table | modprobe_path o |
| smileyCTF 2025 | blargh | solved / writeup | Easy-Medium (38) | 1-byte NULL write into kernel memory | read-only kernel text modification | patch kernel function |
| Codegate CTF 2025 Preliminary | pew | solved / writeup | Easy-Medium (13) | kmalloc-4096 UAF | pipe_buffer reclaim | Dirty Pipe, /etc/passwd o |
| BackdoorCTF 2024 | Kuwu | solved / writeup | Easy-Medium (4) | double free, kmalloc-4096 UAF | msg_msg o + pipe_buffer leak | Dirty Pipe, /etc/passwd o |
| HKCERT CTF 2024 (Qualifying Round) | Flipper Hero | solved / writeup | Easy-Medium (10) | arbitrary bit flip | arbitrary kernel bit flip | modprobe_path o |
| IERAE CTF 2024 | free2free | solved / writeup | Easy-Medium (2) | double free | heap o | Dirty Pipe, /etc/passwd o |
| DownUnderCTF 2024 | Faulty Kernel | solved / writeup | Easy-Medium (15) | page cache map/write | pipe_buffer page cache mapping | page cache o (/etc/passwd) |
| IrisCTF 2024 | Memory | writeup | Easy-Medium (42) | kernel-to-user access side-channel () | timing oracle for secret-dependent userland address access | reco flag bytes timing side-channel |
| TPCTF 2023 | core revenge | solved / writeup | Easy-Medium (11) | kmalloc-64 UAF | pipe-based kernel leak + AAW | add_key + Dirty Pipe-style page cache o of /bin/busybox |
| HITCON CTF 2023 Quals | Full Chain - Wall Rose | solved / writeup | Easy-Medium (17) | global pointer double-free | pipe_buffer o | Dirty Pipe / init_cred o |
| idekCTF 2022 | Sofire=good | solved / writeup | Easy-Medium (7) | global UAF | ptmx reclaim + stale list R/W | core_pattern o |
| KITCTFCTF 2022 | SYS_jail | solved | Easy-Medium (7) | missing copy_from_user / direct user-space pointer dereference | TOCTOU race condition fetches (Double Fetch) | struct cred o / pri escalation to root (UID 0) |
| UTCTF 2022 | Bloat | solved / writeup | Easy-Medium (?) | missing of user pointer in custom binfmt handler | arbitrary kernel write | modprobe_path o |
| TAMUctf 2022 | Shmeeky | solved / writeup | Easy-Medium (7) | integer o in size calculation | OOB read/write /shm | modprobe_path o |
| GrabCON CTF 2021 | Paas | solved / writeup | Easy-Medium (1) | kernel format string | cpu_entry_area leak + pipe capture + AAW | modprobe_path o |
| BSides Noida CTF | suscall | solved | Easy-Medium (6) | unsafe custom syscall | arbitrary function pointer call | MSR leak + CC(PKC(0)) |
| LINE CTF 2021 | pprofile | solved / writeup | Easy-Medium (7) | put_user misuse | constrained kernel write + oracle leak | modprobe_path o |
| Union CTF 2021 | nutty | solved / writeup | Easy-Medium (10) | heap OOB read + signed arithmetic o | tty_struct leak + heap OOB write | modprobe_path o |
| GACTF2020 | forest | solved | Easy-Medium (1) | customizable UAF + double free | seq_operations reclaim | CC(PKC(0)) + kernel ROP |
| ASIS CTF Quals 2020 | Shared House | solved / writeup | Easy-Medium (7) | off-by-one NULL o | freelist poisoning | modprobe_path o / kernel ROP |
| zer0pts CTF 2020 | meowmow | solved / writeup | Easy-Medium (9) | forward OOB R/W | tty_struct leak + fake tty_operations + AAW | modprobe_path o |
| Hack.lu CTF 2019 | Teen Kernel | solved | Easy-Medium (29) | unchecked kernel stack offset | AAR/AAW | read task_struct + cred o |
| Facebook CTF 2019 | kpets | solved / writeup | Easy-Medium (27) | TOCTOU race | 1-byte OOB write | o adjacent type => flag read |
| Security Fest 2019 | Brainfuck64 | solved / writeup | Easy-Medium (5) | brainfuck interpreter pointer bounds check failure | kernel pointer leak and out-of-bounds heap read/write | modprobe_path o |
| *CTF 2019 | hack_me | solved / writeup | Easy-Medium (13) | out-of-bounds index / negati | AAR/AAW | modprobe_path o |
| Midnight Sun CTF 2019 Quals | Hfsipc | solved / writeup | Easy-Medium (18) | off-by-one arbitrary byte write | SLUB freelist poisoning | modprobe_path o |
| D^3CTF 2026 | d3kbus-revenge | writeup | Medium (60) | logic flaw / CRC32C bug | 4-byte page cache write | page cache corruption => /sbin/poweroff hijack |
| DEF CON CTF Qualifier 2026 | coalmine revenge | solved | Medium (31) | interpreter index out-of-bounds byte write & un encrypted pointers | arbitrary kernel memory/stack o & kernel pointer leak | heap spray (add_key) + stack pivot + kernel ROP + CC(IC) + KPTI trampoline |
| CTF Quals | Event Horizon | solved | Medium (31) | custom microcode VM bug | custom , kernel code execution path | TBD |
| BITSCTF 2026 | Promotion | solved / writeup | Medium (?) | arbitrary IRET frame modification 0x81 | CPL3=>CPL0 token ele under userland page table | Ring 0 userland code execution & ATA PIO direct hardware read |
| UofTCTF 2026 | uprobe | writeup | Medium (14) | SUID uprobe arbitrary byte patch | single-byte code patch (INT3 / 0xcc) | passwd path redirection |
| HeroCTF v7 | Safe Device | solved / writeup | Medium (7) | stack o | kernel stack ROP | aarch64 kernel ROP, modprobe_path o |
| GlacierCTF 2025 | Flip Flip Hooray! | solved / author writeup | Medium (18) | arbitrary kernel address 1-bit XOR syscall | one-shot blind bit flip => multi-shot by flipping flips_left | modprobe_path o physmap/direct-map alias (aarch64) |
| DownUnderCTF 2025 | backdoor | solved / writeup | Medium (18) | custom syscall | kbase leak and kernel memory write | modprobe_path o |
| MaltaCTF 2025 Quals | Write Flag Where | solved / writeup | Medium (16) | custom syscall | physical memory write map | call modify_ldt |
| D^3CTF 2025 | d3kheap2 | solved / author writeup | Medium (6) | refcount bug / double free | cross-cache o with msg_msg and pipe_buffer | Dirty Pipe-style /bin/busybox page cache o |
| LA CTF 2025 | messenger | solved / writeup | Medium (10) | 3-byte o of msgutil | pipe_buffer page corruption | cred search, cred o |
| IrisCTF 2025 | Checksumz | solved / writeup | Medium (39) | OOB read/write | relative OOB R/W + kernel leak | core_pattern o |
| HeroCTF v6 | Buafllet | solved / writeup | Medium (4) | kmalloc-8192 UAF | UAF R/W + AAW | tty struct => modprobe_path / Pipe => Dirty Pipe (aarch64) |
| SCTF 2024 | kno_puts revenge | solved / writeup | Medium (20) | race condition / UAF write | userfaultfd race + kmalloc-1024 freelist poisoning, msg_msg leak, tty_struct o | fake tty_operations, modprobe_path o |
| PatriotCTF 2024 | DirtyFetch | solved / writeup | Medium (9) | uninitialized stack leak + double-fetch race | canary/KASLR leak + race-won o length => kernel stack o | kernel ROP, CC(PKC(0)) |
| CrewCTF 2024 | Kulele | solved / writeup | Medium (?) | customizable UAF + double free | freelist poisoning leak & CONFIG_FREELIST_HARDENED bypass or cross-cache UAF | modprobe_path o or pipe_buffer=>ops hijacking + ROP |
| cr3 CTF 2024 | mov-cr3 | solved / writeup | Medium (10) | arbitrary CR3 write | kernel AAR + cross-AS AAR | task->mm->pgd => CR3 pivot |
| bi0sCTF 2024 | palindromatic | solved / writeup | Medium (5) | OOB + double free | buddy reclaim + pipe_buffer + msg_msg o | Dirty Pipe, /etc/passwd o |
| BackdoorCTF 2023 | EmpDB | solved / writeup | Medium (15) | race UAF | userfaultfd race | modprobe_path o |
| Bauhinia CTF 2023 | Kernpass | solved / writeup | Medium (10) | race condition leading to customizable UAF | userfaultfd race + CONFIG_SLAB_FREELIST_HARDENED bypass heap o | kmalloc-32 freelist poisoning => modprobe_path o |
| ImaginaryCTF 2023 | window-of-opportunity | solved / writeup | Medium (10) | unsafe usercopy & stack BOF | AAR via an 8-byte input pointer + kernel stack o | kernel ROP, commit_creds(&init_cred) |
| bi0sCTF 2022 | k32 | solved / writeup | Medium (1) | uninitialized heap read + heap object reuse | heap leak + kernel text leak + RIP control | seq_operations o + register spill + stack pivot + CC(PKC(0)) |
| DownUnderCTF 2022 | pac | solved / writeup | Medium (7) | un encrypted pointers + unmasked upper 32-bit execution | control-flow hijack PAC forgery | ret2usr (SMEP disabled) + dynamic KASLR bypass via MSR read + iretq context restore |
| *CTF 2022 | babyarm | solved / writeup | Medium (5) | signedness mismatch leading to aarch64 kernel stack o | canary/KASLR leak + aarch64 kernel stack ROP | CC(IC) + ret2pt_regs trampoline |
| CrewCTF 2022 | qKarachter | solved / writeup | Medium (6) | state inconsistency + u8 o + invalid kfree | double free + o objects | modprobe_path o |
| Securinets CTF Quals 2022 | xblob | solved / writeup | Medium (4) | TOCTOU open race + UAF | UAF + kernel heap leak + AAW | modprobe_path o |
| zer0pts CTF 2022 | kRCE | solved / writeup | Medium (8) | signedness OOB | OOB => AAR/AAW => task tra => stack leak | CC(PKC(0)) + KPTI trampoline + userland ROP |
| SUSCTF 2022 | kqueue's revenge | solved / writeup | Medium (19) | queue UAF | seq_operations leak + userfaultfd reclaim + RIP control | CC(PKC(0)) kernel ROP |
| hxp CTF 2021 | 日本旅行 | writeup | Medium (4) | double PTRACE_SYSCALL / ptrace state desync | syscall path-filter bypass | unchecked openat("/flag.txt") + sendfile |
| CyberSecurityRumble CTF 2021 | bufctl | solved | Medium (?) | RCU read-side critical section sleep leading to customizable UAF | userfaultfd race + pipe_buffer o => arbitrary page cache o | Dirty Pipe-style page cache o of /bin/busybox |
| Hack.lu CTF 2021 | Stonks Socket | writeup | Medium (12) | UAF race on sk_user_data | kernel RIP control 32-byte object / function pointer call | userland shellcode => CC(PKC(0)) |
| ASIS CTF Quals 2021 | Mini memo | solved / writeup | Medium (16) | partial heap OOB (3-byte) | msg_msg o => pipe_buffer leak => freelist poisoning | modprobe_path o |
| TSG CTF 2021 | lkgit | solved / writeup | Medium (7) | duplicate-hash race UAF | userfaultfd race + kmalloc-32 UAF write / seq_operations leak | modprobe_path o |
| 0CTF/TCTF 2021 Finals | Kernote | solved / author writeup | Medium (?) | kmalloc-16 UAF | AAR o (modify_ldt) | page_offset_base leak => direct-map memory scan |
| InCTF 2021 | Kqueue | solved / writeup | Medium (7) | integer o in size calculation, kmalloc-32 heap OOB | OOB loop read/write recycling | tty_struct ops hijack => modprobe_path o async-write |
| BSides Noida CTF | K-HOP | solved / writeup | Medium (3) | NULL pointer dereference & boundary-checked string copy leading to stack o | canary leak copy offset & zero-page controlled data read | kernel stack ROP wrapper gadget jump, CC(PKC(0)), & KPTI trampoline |
| Circle City Con CTF 2021 | sockcamp | solved / writeup | Medium (3) | single-bit flip in task_struct | thread flag corruption (TIF_SECCOMP) | inject shellcode => CC(PKC(0)) |
| 3kCTF-2021 | klibrary | solved / writeup | Medium (2) | race-based UAF | userfaultfd + tty_struct o | tty_ops hijack + modprobe_path o |
| Midnight Sun CTF 2021 Quals | Brohammer | solved / writeup | Medium (18) | arbitrary 1-bit kernel write | physmap PTE permission flip | CC(PKC(0)) |
| DiceCTF 2021 | hashbrown | solved / writeup | Medium (7) | resize race + value UAF | userfaultfd race + pipe_buffer UAF read/write | /bin/busybox page cache o |
| hxp CTF 2020 | pfoten | writeup | Medium (18) | writable swap file configuration | arbitrary swap storage modification | page cache / init process code o |
| HITCON CTF 2020 | atoms | solved / writeup | Medium (17) | missing () refcount bug | fork()+munmap() UAF + msg_msg reclaim | lock corruption => watchdog-triggered flag output |
| GACTF2020 | easy_kernel | solved / writeup | Medium (2) | UAF + stack OOB R/W | tcache poisoning + stack leak + stack BOF | .fini hijack => kernel ROP |
| InCTF 2020 | lab9 | solved | Medium (5) | heap OOB XOR write | freelist poisoning + tty_struct o | modprobe_path o |
| 2020 Defenit CTF | Input Test Driver | solved | Medium (7) | dangling global pointer nullification on kfree | deterministic ptr == _fp aliasing & heap OOB read null-terminator | stack pivot + CC(PKC(0)) |
| D^3CTF 2019 | knoteV2 | solved / writeup | Medium (3) | customizable UAF ed deletion | tty_struct reclaim and freelist poisoning | modprobe_path o |
| Balsn CTF 2019 | KrazyNote | solved / writeup | Medium (13) | userfaultfd race + note metadata corruption | AAR/AAW | modprobe_path o |
| D^3CTF 2026 | d3kheap2pro-revenge | writeup | Medium-High (34) | cross-cache custom allocator UAF / double free | cross-cache o with msg_msg and pipe_buffer | io_uring personality-assisted cred spray & owner-fast-path chmod attack |
| R3CTF 2026 | r3map | writeup | Medium-High (15) | race between bind and unbind operations | stale mmap mapping to freed physical pages reclaim | arbitrary physical memory R/W => cred o, and escape nsjail |
| TRX CTF 2026 | krwd | writeup | Medium-High (15) | deferred user pointer in delayed_work | cross-mm usercopy active_mm | BusyBox modprobe FSOP |
| THJCC CTF 2026 | 僕と契約して、魔法少女になってよ！ | solved / writeup | Medium-High (3) | off-by-one NULL o | struct file corruption | struct file->f_mode o |
| UofTCTF 2026 | extended-eBPF | writeup | Medium-High (39) | eBPF range confusion | map value OOB R/W | modprobe_path o |
| BackdoorCTF 2025 | skernel | writeup | Medium-High (5) | kmalloc-64 UAF | race-assisted OOB leak/write | kernel ROP, commit_creds(&init_cred) |
| BackdoorCTF 2025 | | writeup | Medium-High (4) | workqueue UAF race | FUSE-assisted kmalloc-4k UAF write | dirty pagetable + TSS I/O bitmap abuse + QEMU fw_cfg physical write |
| CrewCTF 2025 | barelyontime | writeup | Medium-High (3) | logic bug, UAF | userfaultfd-assisted UAF race | kernel text o |
| corCTF 2025 | zenerational-aura | solved / writeup | Medium-High (5) | crash syscall | KASLR bypass | kernel panic log oracle |
| Full Weak Engineer CTF 2025 | cknote | solved / writeup | Medium-High (2) | kmalloc-32 UAF | UAF read/write, freelist manipulation | cred o |
| DownUnderCTF 2025 | Rolling Around | solved / writeup | Medium-High (4) | custom eBPF ALU bug | eBPF stack OOB + AAR/AAW | modprobe_path o |
| MaltaCTF 2025 Quals | secure-dwarf | solved / writeup | Medium-High (8) | custom DWARF bytecode | AAR primitive | read flag in kernel memory |
| TsukuCTF 2025 | new_era | solved / writeup | Medium-High (4) | off-by-one NULL o in kmalloc-1k object | pipe_buffer->page LSB o + PageJack page UAF | struct file->f_mode o => /etc/passwd o |
| DiceCTF 2025 Quals | oboe | writeup | Medium-High (16) | single-byte OOB o | refcount o | kernel ROP, commit_creds(&init_cred) |
| KalmarCTF 2025 | decore | writeup | Medium-High (10) | executable path in core_pattern | race condition | replace target file with symlink |
| TRX CTF 2025 | /dev/mem | solved / writeup | Medium-High (4) | /dev/mem access | KASLR bypass, physical memory R/W | task list tra, cred o |
| HITCON CTF 2024 Quals | Seccomp Hell | writeup | Medium-High (15) | hidden backdoor / intended kernel interface | CPL3=>CPL0 via LDT call gate | manual cred + seccomp patch |
| Codegate CTF 2024 Preliminary | PhysicalTest | writeup | Medium-High (?) | global backing_ / wrong VMA zap | stale mmap mapping to freed physical pages | fops hijack => stack pivot => kernel ROP => CC(IC) |
| KalmarCTF 2024 | msrable | solved / writeup | Medium-High (9) | MSR exposure | LSTAR leak + FMASK abuse + entry hijack | CR4 disable => CC(IC) => KPTI return |
| KalmarCTF 2024 | Maestro | writeup | Medium-High (11) | uncleared DF in syscall / kernel mmap o | kernel EIP control | zero-page shellcode or mmap-based kernel memory o |
| N1CTF 2023 | n1sub | writeup | Medium-High (4) | UAF with dangling pointer / broken slot management | fixed-offset 4-byte decrement on reclaimed pipe_buffer->flags | pipe_buffer reclaim => Dirty Pipe-style page cache o of /bin/busybox |
| SECCON CTF 2023 Quals | umemo / kmemo | solved / writeup | Medium-High (20/5) | UAF + mmap ownership corruption | object reuse => AAR / AAW | modprobe_path o |
| corCTF 2023 | kcipher | writeup | Medium-High (11) | kmalloc uninit heap read / customizable UAF | OOB leak => o fake pri => AAW | inverse ROT/XOR encryption, modprobe_path o |
| zer0pts CTF 2023 | flipper | solved / writeup | Medium-High (5) | OOB 1-bit flip | single-bit heap corruption | cred capability bit flip / file refcount corruption |
| UIUCTF 2023 | Zapping a Setuid (1/2) | writeup | Medium-High (?) | SUID / namespace abuse | SUID binary relocation + library hijack / Cross-namespace mount graft + SUID preser | loader hijack / mount-tree SUID bypass |
| SCTF-2023 | Sycrop | writeup | Medium-High (9) | missing copy_from_user / copy_to_user | 1-shot AAR & arbitrary RSP control (stack pivot) | ret2hbp (DB stack pivot breakpoint) => kernel ROP |
| D^3CTF 2023 | d3kcache | solved / author writeup | Medium-High (2) | off-by-one NULL o in a dedicated kmem_cache object | pipe_buffer->page LSB o => controlled struct file reuse | struct file->f_mode o => /bin/busybox binary modification |
| RCTF 2022 | game | solved / writeup | Medium-High (?) | type confusion + kmalloc-16 double free [Unintended: writable /bin/umount] | freelist poisoning => fork-assisted modify_ldt AAR / io_uring AAW | cred o personality-assisted spray |
| HITCON CTF 2022 | ⛓️ Fourchain - Kernel | writeup | Medium-High (12) | race / UAF | userfaultfd + UAF => msg_msg / pipe_buffer / sk_buff | DirtyCred / kernel ROP |
| SECCON CTF 2022 Quals | babypf | solved / writeup | Medium-High (10) | eBPF shift range bug | eBPF stack corruption + AAR/AAW | modprobe_path o |
| DownUnderCTF 2022 | just-in-kernel | writeup | Medium-High (11) | custom VM/JIT instruction-boundary bypass | JIT immediate shellcode + stack pivot | kernel ROP + CC(PKC(0)) |
| nullcon HackIM 2022 | ENO-Bank 2 | solved / writeup | Medium-High (?) | UAF due to dangling global pointer | isolated-cache freelist poisoning + mandatory memset(0) write or customized seq_file layout modification => fake count o AAR | cred field nullification / cred o or deterministic modprobe_path o via SLUB freelist poisoning |
| Aero CTF 2022 | kernel-gym | writeup | Medium-High (?) | customizable UAF copy / user session duplication | UAF reclaim => function pointer hijack (RIP control) | kernel ROP or cred o |
| LINE CTF 2022 | ecrypt (fixed) | solved / writeup | Medium-High (7) | broken mmap() + kernel pointer exposure | key_ptr o + crypto oracle + AAW | direct cred o |
| D^3CTF 2022 | d3bpf | solved / writeup | Medium-High (?) | eBPF shift range bug | eBPF stack corruption + AAR/AAW | modprobe_path o |
| D^3CTF 2022 | d3bpf-v2 | solved / writeup | Medium-High (?) | eBPF shift range bug | eBPF stack corruption + AAR/AAW | modprobe_path o |
| hxp CTF 2021 | trusty user diary | solved / writeup | Medium-High (8) | missing FOLL_WRITE in GUP | pinned page write / COW bypass | page cache corruption => busybox shellcode injection |
| SECCON CTF 2021 | kone_gadget | writeup | Medium-High (5) | backdoored syscall (RIP control + RSP=0) | seccomp JIT + CR4 SMEP/SMAP bypass | stack pivot + CC(PKC(0)) / panic dump via jmp flag.txt |
| CTF 2021 | IPS | solved / writeup | Medium-High (0) | OOB write (index underflow) & logic flaw (boundary check bypass) | constrained OOB write => cross-page OOB leak (add_key size expansion) & zero-knowledge cookie har => absolute freelist hijacking | kmalloc-128 page exhaustion => dynamic boundary-tracked freelist poisoning => modprobe_path o |
| DUNGEON - BSides Ahmedabad CTF 2021 | shared knote | solved / author writeup | Medium-High (1) | race condition / TOCTOU | AAR & AAW via NULL pointer dereference | modprobe_path o |
| DamCTF 2021 | cuttlefish-game | writeup | Medium-High (4) | heap OOB read + signed arithmetic o | OOB leak => kmalloc-192 UAF | msg_msg o + stack pivot + kernel ROP |
| pbctf 2021 | Nightclub | solved / writeup | Medium-High (8) | NULL-terminated heap OOB | msg_msg m_ts corruption + heap leak + SLUB freelist corruption | modprobe_path o |
| InCTF 2021 | MultiStorage | solved / writeup | Medium-High (1) | TOCTOU race + heap OOB write | page-cross heap o + heap feng shui | cred o |
| Google Capture The Flag 2021 | EBPF | writeup | Medium-High (20) | eBPF type confusion | forged PTR_TO_MAP_VALUE => AAR/AAW | modprobe_path o |
| Pwn2Win CTF 2021 | Accessing the Truth | writeup | Medium-High (8) | UEFI password stack o | RIP control in UEFI context | UEFI shellcode reads initramfs.cpio and scans flag |
| hxp CTF 2020 | kernel-rop | solved / writeup | Medium-High (6) | stack leak + stack BOF | stack leak => kernel ROP | FG-KASLR => ksymtab => CC(IC) |
| Hack.lu CTF 2020 | Through the Backdoor | writeup | Medium-High (12) | logic flaw in UEFI length | out-of-bounds stack o UEFI input | pri escalation state machine corruption |
| SECCON 2020 Online CTF | kstack | solved / writeup | Medium-High (4) | race double free | userfaultfd heap reuse + seq_operations leak + AAW | seq_operations pivot + CC(PKC(0)) ROP |
| HITCON CTF 2020 | spark | writeup | Medium-High (10) | UAF by missing node refcount on graph link | fake spark_node reclaim => OOB distance-array read/write | cred o () |
| TastelessCTF 2020 | yaknote | solved | Medium-High (1) | OOB index (signed/unsigned) | type confusion => AAR/AAW | modprobe_path o |
| TokyoWesterns CTF 6th 2020 | Extended Extended Berkeley Packet Filter | writeup | Medium-High (8) | eBPF range confusion | map value OOB R/W | modprobe_path o |
| Pwn2Win CTF 2020 | Trusted Node | writeup | Medium-High (12) | TA command interface / function-pointer disclosure / client-side misuse | TA code pointer leak + hidden function in | use leaked TA address to call get_secret through android_get_increment |
| DEF CON CTF Qualifier 2020 | keml | solved / author writeup | Medium-High (5) | stack buffer o PUSH | kernel heap/stack OOB write | cred o / target permission nullification |
| N1CTF 2019 | BabyKernel | writeup | Medium-High (1) | TOCTOU on user-controlled buffer metadata | userfaultfd assisted OOB read/write | userfaultfd assisted kernel memory corruption |
| TokyoWesterns CTF 5th 2019 | gnote | solved / writeup | Medium-High (3) | double-fetch race on user-controlled command dispatch | race-controlled indirect call / RIP control via an OOB jump-table lookup | kernel ROP with CC(PKC(0)) |
| Teaser CONFidence CTF 2019 | p4fmt | writeup | Medium-High (10) | linux binary execution(binfmt) OOB read / unchecked load metadata | linux_binprm pointer leak + clear_user()-based kernel zeroing | binfmt exec-time cred corruption => commit_creds(bprm->cred) |
| KalmarCTF 2026 | faulty | under analysis / TBD | High (2) | race condition (TOCTOU) | TBD | TBD |
| tkbctf5 | Hungry Goats | writeup | High (1) | sk_buff data_len corruption | controlled put_page() => page UAF | page UAF o => cred o |
| DiceCTF 2026 Quals | cornelslop | writeup | High (6) | RCU UAF race | RCU callback hijack | cross-cache pipe reclaim + IOPL fw_cfg initrd dump |
| WannaGame Championship 2025 | Johnny Sins | writeup | High (2) | pipe_buffer page UAF via tee/link_pipe off-by-one | page UAF | ret2pt_regs via fake file_operations |
| N1CTF 2025 | N1khash | writeup | High (7) | delayed work UAF | control-flow hijack + stack pivot | UAF reclaim + ROP + modprobe_path o |
| ASIS CTF Quals 2025 | File No! | writeup | High (8) | file->pri R/W for regular files | seq_file pri leak/hijack regular file | fake seq_file + seq_operations hijack + stack pivot ROP |
| ToH CTF 2025 | kRWX | solved / author writeup | High (0) | arbitrary function pointer o | LKM text leak + KCFI-checked one-shot indirect call | KCFI-compatible seccomp BPF JIT code execution |
| bi0sCTF 2025 | Kernel-Mailinglists | writeup | High (1) | uninitialized lhead in broadcast mail | unlink pointer write + kernel heap leak | cross-cache reclaim into cred_jar and cred field nullification |
| D^3CTF 2025 | d3kshrm | author writeup | High (1) | OOB page mapping in mmap fault handler | OOB struct page pointer mapping / read-only file page remap as RW | DirtyPage-like read-only file o + splice |
| KalmarCTF 2025 | Maestro Revenge | writeup | High (4) | missing userspace stack in signal delivery | kernel memory o | AccessProfile o / pri bypass |
| PwnMe CTF Quals 2025 | Hidden Key Recovery | under analysis / TBD | High (6) | SMM secret + DMA write | physical write-what-where (TBD) | SMM code patch / password-check bypass (TBD) |
| N1CTF 2024 | heap_master | writeup | High (7) | UAF / stale pointer after kfree | cross-cache UAF on struct file / PTE corruption | DirtyPage-style PTE hijack, DMA-BUF assisted physical memory access, kernel text patch, nsjail escape |
| idekCTF 2024 | kernel module golf | writeup | High (1) | unpri load_module() exposure | msg_msg heap grooming + forged ELF relocations | 345-byte ELF module golf => module->init hijack => CC(IC) |
| UIUCTF 2024 | Syscalls 2 | writeup | High (8) | kernel logic / policy bypass | I/O without normal fd allocation | io_uring-based flag read / FD creation restriction bypass |
| L3HCTF 2024 | kpid | writeup | High (1) | find_vpid() reference-count misuse / put_pid() without get_pid() | struct pid UAF + refcount increment primitive | Dirty Pagetable + DMA-BUF arbitrary physical memory R/W |
| m0leCon CTF 2023 Finals | keasy | writeup | High (?) | struct file UAF with a dangling FD caused by calling fput() after fd_install() | cross-cache the freed files_cache slab page into a PTE page, then use dup() and DMA-BUF Heap to gain arbitrary physical read/write | o do_symlinkat() with kernel shellcode to gain root pri, switch namespaces, replace current->fs, and escape nsjail |
| Azure Assassin Alliance CTF 2023 | easy netlink | under analysis / TBD | High (2) | undersized LZO output buffer in ADD_MSG; additionally, unlocked object lookups allow Type/Title race-condition UAFs (TBD) | kmalloc heap o, or kmalloc-256/kmalloc-512 UAF (TBD) | not determinable from bbs.ko alone; likely heap spraying and adjacent-object corruption using the LZO o, followed by a kernel pointer leak and control-flow or data-only pri escalation (TBD) |
| TeamItaly CTF 2023 | kSMS - Secure Message Storage | author writeup | High (0) | Out-of-bounds read and UAF in the kernel module | information disclosure (KASLR/heap leak) and arbitrary function call | bypassing kCFI by spoofing struct subprocess_info to trigger root command execution |
| corCTF 2023 | sysruption | author writeup | High (3) | Intel CPU SYSRET hardware quirk (C / C re-enabling) | EntryBleed (KASLR leak) + Ring 0 #GP exception stack corruption | wrgsbase user GS forgery => tcp_prot hijack => setsockopt stack pivot => kernel ROP |
| SCTF-2023 | Moonpray | author writeup | High (2) | CFI / missing copy_from_user | ASLR & per-CPU stack layout leak , plus arbitrary RSP control | blind EntryBleed + ret2pt_regs dynamic stack pivot |
| hxp CTF 2022 | one_byte | author writeup | High (5) | 1-byte arbitrary kernel write | one-shot 1-byte write-what-where | LDT call gate => ring0 shellcode |
| N1CTF 2022 | Babyuefi | writeup | High (5) | UEFI UiApp stack OOB / uninitialized length | stack leak + stack o | UEFI boot option hijack to root shell |
| N1CTF 2022 | File | under analysis / TBD | High (1) | struct file refcount bug | struct file UAF / dangling fd | DirtyCred-style struct file replacement |
| N1CTF 2022 | Praymoon | writeup | High (0) | kmalloc-512 double free | user_key_payload OOB read / setxattr + userfaultfd reclaim | AF_PACKET pg_vec USMA text patch |
| corCTF 2022 | Cache of Castaways | writeup | High (2) | 6-byte OOB write in isolated slab cache | cross-cache o | leakless cred->uid o allocator feng shui |
| Azure Assassin Alliance CTF 2022 | kkk | under analysis / TBD | High (4) | parser logic bug | hidden IOCTL reach (TBD) | kernel heap corruption (TBD) |
| N1CTF 2021 | Baby_guess | writeup | High (2) | OOB read + stack o + size race | stack leak + canary/KASLR leak + kernel stack ROP | modprobe_path o |
| pbctf 2021 | Access Key | under analysis / TBD | High (1) | 8-bit refcount o | UAF-style kmalloc-64 heap o (TBD) | secret bypass => controlled kernel function call (TBD) |
| corCTF 2021 | Fire of Sal | author writeup | High (0) | duplicated rule shallow copy UAF | kmalloc-4k UAF + msg_msg AAR/AAW + userfaultfd-assisted AAW | task_struct walk + current->cred / real_cred o with init_cred |
| corCTF 2021 | Wall of Perdition | author writeup | High (0) | duplicated firewall rule UAF | kmalloc-64 UAF + msg_msg AAR + pipe_buffer RIP + FG-KASLR bypass | RetSpill ROP + __ksymtab symbol resolution + CC(PKC(0)) |
| N1CTF 2020 | W2L | writeup | High (3) | C: signedness mismatch leading to integer wrap-around | AF_PACKET packet_ring_buffer heap OOB write | cred_jar heap spray + cred o |
| DEF CON CTF Qualifier 2020 | ooofs | under analysis / TBD | High (3) | inode table OOB access(TBD) | out-of-bounds kernel memory read/write(TBD) | TBD |
| De1CTF 2019 | Race | author writeup | High (3) | race condition (copy_from/to_user) | slab address leak + slab object corruption alias | physmap spray + page cache/cred o |
| TRX CTF 2026 | 🍼🤏🤏 revenge | writeup | (1) | per-CPU stack pointer corruption | per-CPU stack pivot | FSGSBASE + SWAPGS stack pivot |
| WannaGame Championship 2025 | Matrix | author writeup | (0) | eBPF range bug | BPF stack pointer corruption => AAR/AAW | current cred replacement |
| TRX CTF 2025 | 🍼🤏 | author writeup | (0) | unrestricted wrmsr ioctl | arbitrary MSR write | fake syscall GS / fake kernel stack + kernel ROP |
| m0leCon CTF 2024 Teaser | 🍼 One dream 🍼 | under analysis / TBD | (0) | one-shot arbitrary low-byte text patch | repeatable byte patch via LKM self-patching (TBD) | aarch64 kernel/LKM text self-modification (TBD) |
| HITCON CTF 2024 Quals | Halloween | author writeup | (1) | auth bypass + malformed write state corruption + shared grip race | OOB read/leak + jump-table OOB RIP control | kernel ROP OOB => send_to_socket(flag) |
| SCTF-2023 | Sycrpg | writeup | (1) | arbitrary 1-byte write / missing copy_from_user | arbitrary 1-byte kernel modification (arbitrary byte write) | bringing back the stack attack (page table directory pointer LSB o ) |
| KalmarCTF 2023 | hyper-k | under analysis / TBD | (1) | EPT management bug / guest-accessible hypervisor memory via GPA namespace confusion | writable EPT paging structures / guest-controlled second-stage translation (TBD) | /EPTP switching abuse => host physical memory AAR/AAW (TBD) |
| WMCTF2022 | Ubuntu-rev | under analysis / TBD | (0) | nf_tables set element bug inspired by C | stack or kernel memory OOB write nftables netlink messages (TBD) | TBD |
| Balsn CTF 2021 | Futex | writeup | (0) | state inconsistency / futex_unlock_pi non-owner check bypass inspired by C | pi_state refcount underflow => customizable kernel stack/heap UAF | kernel stack ROP / cred o |

Note: CC(PKC(0)) means commit_creds(prepare_kernel_cred(0)).

CC(IC) means commit_creds(&init_cred).

Techniques Covered

Build and Run

Most exploits are intended to be compiled statically and executed inside the provided QEMU/initramfs en.

Example:

or

Exploit Note

Exploit code in this repository is mainly intended for local CTF/QEMU en.

Unless explicitly stated otherwise, exploits authored or modified in this repository were primarily tested locally against the provided challenge en.
They are not guaranteed to work on the original remote servers, patched challenge instances, different kernel builds, or different runtime configurations.

Remote services may use different kernels, mitigations, time limits, file systems, network wrappers, or deployment settings.
Some exploits may require adjustment, stabilization, or additional en tuning.

本リポジトリ内の exploit code は、主にローカルの CTF/QEMU 環境での検証を目的としています。

特に明記していない限り、本リポジトリで作成・修正した exploit は、配布された challenge 環境に対してローカルでの動作確認を中心に行っています。
元の remote server、修正後の challenge instance、異なる kernel build、異なる実行環境での動作は保証していません。

remote 環境では kernel、mitigation、time limit、filesystem、network wrapper、deployment 設定などが異なる場合があり、追加の調整・安定化・環境依存の修正が必要になることがあります。

Large Files Policy

Large distribution files such as rootfs images, disk images, , or archives may be omitted from this repository when they exceed GitHub's normal file size limit.
In such cases, only the minimum files required for analysis are included, and an external download link or a note about the original distribution is provided when a.

GitHub の通常のファイルサイズ上限を超える大きな配布ファイルについては、本リポジトリに直接含めない場合があります。
その場合は、解析に必要な最小限のファイルのみを配置し、可能であれば外部リンクまたは元配布ファイルに関するメモを記載します。

Challenge Template

Original challenge files are preserved for archival and analysis purposes.
Some files may be intentionally or unsafe to run outside isolated CTF/QEMU en.

配布ファイルはアーカイブおよび解析目的で、可能な限り元の状態に近い形で保存しています。
一部のファイルは意図的に脆弱または危険な挙動を含むため、隔離された CTF/QEMU 環境以外では実行しないでください。

References

Acknowledgements

I would like to express my sincere gratitude to all CTF challenge authors who created these excellent kernel exploitation challenges.

Many of the techniques, exploit strategies, and implementation details in this repository were learned from public writeups, author writeups, and shared research notes.
I deeply appreciate the authors of those writeups for documenting their approaches and making their knowledge a to the community.

This repository is intended as a personal learning archive and technical index.
All credit for the original challenges belongs to the respective CTF organizers and challenge authors.
All credit for referenced writeups belongs to their original authors.

謝辞

素晴らしい Kernel Exploit 問題を作成してくださった CTF 運営・問題作者の皆様に深く感謝します。

本リポジトリに含まれる多くの技術、exploit 方針、実装上の知見は、公開 writeup、author writeup、各種技術メモから多くを学んだものです。
解法や考察を公開し、知識を共有してくださった writeup 作者の皆様にも心より感謝します。

本リポジトリは、個人の学習記録および技術索引として整理しているものです。
各 CTF 問題の権利とクレジットは、それぞれの CTF 運営・問題作者に帰属します。
参照した writeup のクレジットは、それぞれの原著者に帰属します。

项目信息

开发语言：C

Star 数：565

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕CTF kernel exploitation notes, PoCs, exploits, and writeups.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。