how2keap - 各种Linux内核堆利用程序的备忘单

项目说明

how2keap

A WIP cheat sheet for linux kernel heap exploitation techniques (and pri escalations).

flag is in /flag or /dev/sda

exploit is located inside the vm in /pwn (recommend running with while ! /pwn; do true; done)

Disclaimer

This source code is provided for educational and ethical purposes only. The author(s) strictly prohibit any use of this code for unlawful, malicious, or unauthorized acti. By using this code, you agree to comply with all applicable laws and take full responsibility for any misuse.

The author(s) disclaim all liability for damages or legal consequences resulting from improper or illegal use of this code. Use responsibly and only in accordance with ethical guidelines and legal requirements.

Techniques

Pri Escalation

| File | Technique | Linux- | Jail Escape | Applicable CTF Challenges |
| - | - | - | - | - |
| mad\_cow.c | corrupt file struct and abuse COW to inject code into another process | latest | ~[^1] | Baby VMA |
| dirty\_cred.c | DirtyCred abuses the heap memory reuse mechanism to get pri, using MadCOW to achi escalation | latest | ~[^2] | Wall Rose |
| jit\_spray.c | cBPF JIT Spray sprays attacker controlled ring0 shellcode | latest | X| |
| dirty\_pagetable.c | Dirty Pagetable abuse pagetables to get unprotected AAR/AAW in kernel space (kernel RCE) | latest | X| keasy |

[^1]: Jail escape possible if a binary or library is accessible as readonly in jail and used by outside process
[^2]: Jail escape only possible through MadCOW style escape

Gadgets

| File | Technique | Linux- | Applicable CTF Challenges |
| - | - | - | - |
| cross\_cache.c | showcasing a cross-cache attack that allows using dangeling ptrs to target heap of other slabs | latest | Wall Rose
| per\_cpu\_slabs.c | showcasing how slabs are managed and reallocated on a per cpu basis| latest |
| pipe\_buffer.c | turn pipe buffers into arb page read/write | latest |d3kheap2|
| pbuf\_realloc.c | use io\_uring provided buffers to realloc into GFP_KERNEL or GFP_KERNEL_ACCOUNT holes | latest |ARIES - Sheratan|
| pselect\_realloc.c | use pselect to realloc into GFP_KERNEL holes | latest |tinyfs|
| mmaped\_files.c | using mmaped files to create race windows with copy_from_user or copy_to_user | latest |
| entrybleed.c | EntryBleed exploit prefetch timing to leak KASLR | latest | |
| slubstick.c | SLUBStick more reliable way to trigger cross-cache | latest | |

run examples

just replace pwn.c with the example you want to run (e.g. ./linux6.6.22/dirty\_cred.c)

then run ./scripts/start-qemu.sh -b to build and execute /pwn inside the vm

helper scripts:

+ scripts/start-qemu.sh [OPTIONS]\
-b build and compress rootfs if changed \
-d build with -DDEBUG \
-p run /pwn on startup \
-g run with GDB (kaslr still enabled) \
-k disable kaslr \
-c force compress rootfs \
-l set loglevel to 9 \
-r run as root \
-n run with nsjail \
-v run with kvm (host cpu)

+ scripts/gdbinit\
This file can be used to specify gdb commands to be executed on startup.

buildroot

compile and modify kernel using buildroot

1. download buildroot and extract
2. apply buildroot keap.patch and config.patch using patch:

3. make changes using make menuconfig (e.g. changing kernel )
4. compile keap and kernel using make (might take a while)
5. you will be prompted about additional packages, default is fine
5. the final files (rootfs.cpio.gz and bzImage) are located inside the buildroot dir inside ./output/images

helpful links

+ bootlin:
+ linux-stable:
+ bata24/gef:

项目信息

开发语言：C

Star 数：118

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A cheat sheet for various linux kernel heap exploitation techniques (and privilige escalations). 展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。