Linux kernel perf_swevent_init local privilege escalation

This repository contains a single C source file, 'semtex.c', which is a local Linux kernel privilege escalation exploit targeting CVE-2013-2094 (the 'perf bug'). The exploit is designed for x86_64 systems running Linux kernel versions 2.6.37 to 3.x.x, and some backported 2.6.32 kernels (notably CentOS). The code works by mapping memory, manipulating kernel structures, and injecting shellcode to escalate privileges. Upon successful exploitation, it spawns a root shell by executing '/bin/bash'. The exploit must be compiled and run locally on the target system. No network endpoints are involved; the only fingerprintable endpoint is the use of '/bin/bash' to provide a root shell. The code is operational and provides a working privilege escalation payload.

This repository contains a C library exploit targeting the Linux kernel's perf_event subsystem on Android devices. The main files are 'perf_event.c' and 'perf_swevent.c', which implement functions to write arbitrary values to kernel memory addresses by abusing the perf_event_open syscall. The exploit is tailored for a set of specific Android devices, with hardcoded device IDs and kernel addresses for each supported device. The exploit works by spawning child processes to repeatedly call perf_event_open with crafted parameters, incrementing values at specific kernel addresses. This can be used as a primitive for privilege escalation. The code is structured as a static library (as per Android.mk) and is not a standalone exploit, but rather a component to be used in a larger rooting or exploitation tool. No network endpoints are present; the attack vector is local, requiring code execution on the target device. The repository is a proof-of-concept for the kernel memory write primitive via perf_event vulnerabilities on Android.

This repository contains two C exploit files (semtex.c and rewritten_semtex.c) and a README. Both C files are exploits for CVE-2013-2094, a privilege escalation vulnerability in the Linux kernel's perf_event_open syscall. The README provides build instructions and context, referencing a blog post for further explanation. The rewritten_semtex.c file is a more readable, heavily commented version of the original semtex.c exploit, intended for educational purposes. Both exploits work by mapping memory, manipulating kernel data structures, and injecting shellcode to overwrite the current process's credentials, ultimately granting root privileges and spawning a root shell (/bin/bash). The attack vector is local, requiring the attacker to execute the exploit on a vulnerable Linux system. No network endpoints or remote attack surfaces are present; the only fingerprintable endpoint is the use of /bin/bash to spawn a shell. The exploit is operational, providing a working payload but not part of a larger framework.