OverlayFS local privilege escalation in Ubuntu Linux kernel

This repository is a minimal local Linux privilege-escalation exploit consisting of a short README and a single C source file. The README only provides a static compilation command, while all exploit logic is contained in exploit.c. The exploit abuses Linux namespace and overlay mount behavior to create or overwrite /etc/ld.so.preload from an unprivileged context. Its structure is straightforward: main() forks, attempts to unshare into a new user namespace, then clones a child into a new mount namespace. The child_exec() routine creates temporary directories under /tmp/ns_sploit, performs one overlay mount using either overlayfs or overlay, renames a reachable file (.access or ns_last_pid) to ld.so.preload inside the overlay, unmounts, then performs a second overlay mount with /etc as the upperdir so that ld.so.preload becomes materialized under /etc. After the namespace work completes, main() verifies that /etc/ld.so.preload is writable/openable. Once the preload file is in place, the exploit writes embedded C source to /tmp/ofs-lib.c and invokes the local compiler ('cc -fPIC -shared') to build /tmp/ofs-lib.so. It then writes that shared object path into /etc/ld.so.preload. Finally, it executes /bin/su so the dynamic loader will preload the attacker-controlled library in a privileged context. The embedded payload overrides getuid(). When loaded by /bin/su with effective UID 0, it checks /proc/self/exe to confirm the process path is /bin/su, deletes /etc/ld.so.preload and /tmp/ofs-lib.so for cleanup, sets UID/GID to 0, and execs an interactive /bin/sh shell. This gives the attacker a root shell. There are no network capabilities, C2 endpoints, or remote targets. The exploit is purely local and depends on vulnerable kernel/filesystem behavior plus the presence of a compiler and dynamically linked /bin/su. Overall, this is an operational local privilege-escalation exploit with a built-in payload rather than a mere proof-of-concept or detection script.

This repository is a small, self-contained penetration-test artifact set for the VulnHub SecOS:1 VM rather than a polished standalone exploit framework. It contains 4 files: a README documenting the full attack chain, a CSRF HTML payload, a bash script with the end-to-end command history used during reconnaissance/exploitation/post-exploitation, and a helper script for creating an attacker user on Kali. The primary exploit capability implemented directly in code is the CSRF attack in csrf-exploit.html. That file auto-submits a POST request to http://127.0.0.1:8081/change-password with username=spiderman and password=abc123, relying on a victim browser session on the target host to reset the account password. The exploit-commands.sh file then documents operational follow-on steps: host the lure via Apache as holidays.html, monitor access logs, SSH into 192.168.122.202 as spiderman, enumerate the host with LinPEAS, download and compile the OverlayFS local privilege-escalation exploit (37292.c / CVE-2015-1328), obtain root, read /root/flag.txt, dump sensitive files, inspect MongoDB data, crack hashes, clear logs, create a UID 0 backdoor user, and install a cron-based reverse shell to 192.168.122.186:4444. Repository structure and purpose: - README.md: narrative report of the black-box assessment, target environment, discovered services, vulnerabilities, attack chain, and recommendations. - csrf-exploit.html: actual exploit payload for the CSRF password reset. - exploit-commands.sh: documentation-style shell script containing all commands used across discovery, exploitation, privilege escalation, and persistence. - user-creation.sh: local attacker workstation preparation script. Attack vectors are mixed: web (CSRF against the password-change endpoint), network (SSH access and web enumeration), and local (kernel privilege escalation via OverlayFS). The repository is a real exploit/pentest artifact, not merely a detector. However, it is not highly modular or reusable; most actions are hardcoded to the lab IPs and target account, so OPERATIONAL is the best maturity fit rather than WEAPONIZED.

This repository is a proof-of-concept (PoC) exploit for CVE-2015-1328, a local privilege escalation vulnerability in the Linux kernel's overlayfs implementation. The exploit targets systems (notably Ubuntu 14.04 LTS with vulnerable kernels) where user namespaces and overlayfs are enabled. The repository contains six files: a Makefile for building, a README.md with detailed usage and background, two C source files (ofs.c and ofs-lib.c), and a header (lib_so.h) containing a binary shared library. The main exploit logic is in ofs.c, which creates user and mount namespaces, mounts overlayfs, and manipulates system files to write a malicious shared library to /tmp/ofs-lib.so and inject its path into /etc/ld.so.preload. The payload (ofs-lib.so, built from ofs-lib.c) hooks getuid() and, when triggered by executing /bin/su, spawns a root shell as UID 0. The exploit is operational as a PoC, requiring compilation and execution on a vulnerable system, and demonstrates a classic LD_PRELOAD privilege escalation technique. No network endpoints are involved; all actions are local to the target system.

This repository contains a single C exploit file (CVE-2015-1328.c) targeting the overlayfs local privilege escalation vulnerability (CVE-2015-1328) in Ubuntu kernels prior to 2015-06-15. The exploit abuses incorrect permission handling in overlayfs combined with user namespaces to overwrite /etc/ld.so.preload, causing the system to load a malicious shared library on privileged binary execution (such as /bin/su). The exploit creates several temporary directories under /tmp, mounts overlayfs with crafted parameters, and writes a C shared library that, when loaded, escalates privileges and spawns a root shell. The exploit is operational and provides a working local root shell on vulnerable systems. The main fingerprintable endpoints are the files /etc/ld.so.preload, /tmp/ofs-lib.so, /tmp/ofs-lib.c, /tmp/ns_sploit, and /bin/su. The code is self-contained and does not require network access, focusing solely on local privilege escalation.

This repository contains a single Metasploit module (Ruby file) for local privilege escalation on Linux systems via OverlayFS vulnerabilities (CVE-2015-1328 and CVE-2015-8660). The module targets specific kernel versions on Ubuntu, Fedora, and Red Hat, and is designed to be run from an existing shell or Meterpreter session. It checks the target's kernel version and distribution, prepares and uploads exploit binaries and payloads to writable directories (typically /tmp), and executes them to escalate privileges to root. The default payload is a reverse shell, but any compatible Metasploit payload can be used. The module is weaponized, allowing for easy payload customization and integration into the Metasploit framework. Key fingerprintable endpoints include temporary directories and payload file paths used during exploitation.

This repository contains a local privilege escalation exploit for CVE-2015-1328, targeting Ubuntu systems (12.04, 14.04, 14.10, 15.04) with vulnerable kernels. The exploit abuses overlayfs's improper permission checks to create and write to /etc/ld.so.preload, causing the system to load a malicious shared library that escalates privileges to root. The repository includes three files: a README.md with usage instructions, exploit.c (the main exploit code), and exploit.sh (a helper script that compiles the exploit and starts a Python HTTP server on port 6969 for file transfer). The attack vector is local, requiring the attacker to execute the exploit on the target system. Notable fingerprintable endpoints include /etc/ld.so.preload, /tmp/ofs-lib.so, /tmp/ns_sploit, and the HTTP server endpoint for delivering the exploit binary. The exploit is operational and provides a root shell if successful.