Linux Kernel Exploitation Part 1: ret2usr

Thu, 05 Jun 2025 00:00:00 +0000

Kernel Exploitation ret2usr Part 1

compress.sh - To extract compressed image from linux

#!/bin/sh
gcc -o exploit -static $1
mv ./exploit ./initramfs
cd initramfs
find . -print0 \
| cpio --null -ov --format=newc \
| gzip -9 > initramfs.cpio.gz
mv ./initramfs.cpio.gz ../

run.sh - Run qemu configuration

#!/bin/sh
qemu-system-x86_64 \
 -s \
 -m 128M \
 -cpu kvm64,+smep,+smap \
 -kernel vmlinuz \
 -initrd initramfs.cpio.gz \
 -hdb flag.txt \
 -snapshot \
 -nographic \
 -monitor /dev/null \
 -no-reboot \
 -append "console=ttyS0 quiet panic=1 nosmep nosmap nopti nokaslr"

As you can see all security mitigations are turned off. -s flag set for debugging the linux kernel.

Linux Kernel Exploitation Part 2: Adding Mitigitions

Thu, 05 Jun 2025 00:00:00 +0000

Kernel 2: Adding Mitigitions

Adding SMEP

SMEP, abbreviated for Supervisor mode execution protection (SMEP), is a feature that marks all the userland pages in the page table as non-executable when the process is exectuting in kernel-mode. In the kernel, this is enabled by setting the 20th bit of Control Register CR4.

Check it’s in gdb

Run the qemu with -s and on qemu boot, it can be enabled by adding +smep to -cpu, and disabled by adding nosmep to -append.