Linux kernel Netfilter nftables use-after-free privilege escalation

This repository is a compact local privilege-escalation exploit for CVE-2022-32250, consisting of a README and a single C source file, exp.c. It is not part of a larger exploit framework. The README documents the vulnerability, affected Linux/Ubuntu versions, build command, and warns that exploitation may panic the kernel. The exploit targets a Linux kernel nf_tables use-after-free caused by an incorrect NFT_STATEFUL_EXPR check. The code is a real LPE exploit rather than a detector: it performs multi-stage heap manipulation and kernel object overlap using nftables objects together with keyrings, POSIX/System V message queues, and io_uring allocations. The visible structure shows staged exploitation: setup of stable nftables tables/sets, heap address leak, KASLR/kernel address leak, and a final arbitrary overwrite aimed at modprobe_path. Key capabilities visible in the code include: creating nftables tables and trigger sets; spraying keyrings via add_key/keyctl; spraying and gathering message queues; spraying io_uring objects; leaking heap and kernel-related addresses; and using the resulting write primitive to redirect modprobe_path. The embedded payload is operational and hardcoded: it prepares /tmp/shell.c containing a program that spawns bash when executed as root, creates a dummy malformed file /tmp/dummy, and installs a modprobe script that sets ownership and mode 4555 on /tmp/shell. This yields a local root shell. Fingerprintable artifacts are primarily local rather than network-based: /tmp/shell.c, /tmp/dummy, /tmp/shell, the implicit modprobe_path target (/proc/sys/kernel/modprobe), and nftables object names such as table1-table4 and set_trigger0-set_trigger5. No external network endpoints, C2, URLs, or remote services are used by the exploit code itself. Overall, this is an operational Linux kernel LPE PoC/exploit for vulnerable pre-patch kernels, with a concrete privilege-escalation payload and significant risk of kernel instability during execution.

The repository contains a single file, `expo1`, which is a compiled 64-bit ELF Linux executable rather than source code. It is not a framework module and appears to be a standalone local privilege-escalation exploit. Static strings and imported symbols strongly indicate the binary targets the Linux kernel netfilter/nftables subsystem using libmnl and libnftnl to craft and send netlink messages. Relevant imported functions include `mnl_socket_open`, `mnl_socket_sendto`, `nftnl_table_alloc`, `nftnl_set_alloc`, `nftnl_expr_alloc`, `nftnl_nlmsg_build_hdr`, `nftnl_table_nlmsg_build_payload`, `nftnl_set_nlmsg_build_payload`, and batch helpers, which are typical of nftables object creation/manipulation during exploitation. The binary also imports `unshare`, `sched_setaffinity`, `fork`, `syscall`, `mmap`, `mq_open`, `mq_send`, `mq_receive`, `msgsnd`, `read`, `write`, `system`, and `execve`. This suggests a full exploit chain that sets up process state, possibly isolates namespaces, performs heap or race-oriented kernel interaction, and then launches a privileged command/shell upon success. No external network C2, URLs, or remote IP/domain endpoints are visible in the provided content. The only fingerprintable artifacts are local ELF/library paths and shared object names. Because only a stripped/truncated binary is provided, exact CVE attribution and the final spawned command cannot be confirmed from the available data alone. However, the structure and symbol set are consistent with an operational Linux local root exploit against nftables/netfilter-related kernel logic, not a detection script or benign utility.

Repository purpose: a Linux kernel exploitation lab/PoC built around a custom vulnerable kernel driver interface (/dev/rdd) and an allocation primitive device (/dev/allocdev), with supporting VM tooling (disk image + initramfs) and GDB helper scripts for low-level memory/page-table/TLB inspection. Key components: - vmachine/exploit.c (C, ~22KB): main interactive exploit program. It defines a msg_t structure and three ioctls (RDD_ALLOC/RDD_FREE/RDD_READ) used to drive a kernel object lifecycle (allocate/free/read). It also implements heap spraying by repeatedly opening /dev/allocdev, and a timing side-channel using rdtsc around keyutils add_key() with an invalid description. The program includes routines to allocate a page and instruct the operator to convert it into a 1GB huge-page mapping by manually editing the PUD entry via GDB (walk_pgd script). It includes a TLB flush trick that relies on specific kernel configuration (KPTI enabled, PCID disabled). It can forward measurement results to the host via a virtio-serial port (/dev/virtio-ports/exploit_data), implying a QEMU-based setup. - gdbscripts/*.py (Python): custom GDB commands to (1) search QEMU TLB entries (monitor info tlb), (2) shift bytes in memory (manual patching), (3) walk a SLUB freelist from a head pointer and offset (heap debugging), and (4) walk page tables for a virtual address by reading CR3 and traversing PGD/PUD/PMD/PTE entries using a fixed phys->virt offset (0xffff888000000000). - scripts/pack_initramfs.sh and scripts/unpack_initramfs.sh (sh): manage initramfs.cpio.gz; pack script sets SUID on busybox inside initramfs (4755) and forces root ownership in the cpio archive. - setup.sh (bash): downloads Linux 6.2 tarball from kernel.org and creates/formats a 2GB raw disk image for the VM using qemu-img + losetup + mkfs.ext4. - vmachine/initramfs/bin/*: busybox applet stubs/symlinks for a minimal initramfs userland. Exploit capabilities (as implemented/observable from provided code excerpt): - Local kernel heap grooming: spray allocations via /dev/allocdev; obtain “fresh slab” and “populate slab” menu actions (functions referenced in the menu; full bodies not visible due to truncation). - Kernel object lifecycle control via /dev/rdd ioctls: allocate/free/read primitives (typical building blocks for UAF/infoleak exploitation). - Timing measurement around add_key() to infer allocation behavior; results can be exported to host via virtio-serial. - Page-table/TLB manipulation workflow assisted by GDB scripts, including guidance for creating huge-page mappings and flushing TLB under certain mitigations. No explicit CVE is referenced in the visible content; targeting appears to be a specific lab kernel (6.2) plus custom devices/drivers rather than a generic remote exploit. Overall maturity is best classified as PoC/lab exploit: interactive, environment-dependent, and requiring manual GDB steps for some stages.

This repository is a full exploit environment for CVE-2022-32250, a Linux kernel privilege escalation vulnerability in the netfilter/nftables subsystem. The structure includes scripts and Dockerfiles to build a vulnerable Linux 5.15.44 kernel and root filesystem, run it in QEMU, and facilitate debugging. The main exploit code is in C (exploit/src/main.c.bck, base.c, helpers.h, consts.h, prelude.h) and orchestrates a complex local attack: it sets up user and network namespaces, manipulates netfilter tables and sets via netlink sockets, and abuses kernel heap structures to overwrite the modprobe_path. The exploit then places a malicious script at the new modprobe path and triggers it via a crafted binary, resulting in a setuid root shell at /tmp/get_shell. The payload is a simple C program that spawns a root shell. The exploit is operational and requires local code execution on a vulnerable Linux system. The repository is well-structured for research and testing, with build automation and QEMU integration for safe analysis.

This repository contains a local privilege escalation exploit for CVE-2022-32250, a use-after-free vulnerability in the Linux kernel's nftables subsystem. The exploit is implemented in a single C file (exp.c) and is designed to be compiled and run on a vulnerable Linux system (such as Ubuntu 22.04 with kernel 5.15.0-27-generic, prior to the relevant security patch). The exploit works by manipulating kernel memory structures via netfilter/nftables and message queues, leaking kernel addresses, and ultimately overwriting the modprobe_path to execute a custom payload. The payload is a simple C program that, when executed, provides a root shell. The exploit creates and uses several temporary files in /tmp, including /tmp/shell.c (the payload source), /tmp/shell (the setuid root shell), and /tmp/dummy (a helper file). The README.md provides background, references, affected versions, and usage instructions. The exploit is operational and provides a working local root shell if successful, but may cause kernel panics due to kernel memory corruption.

This repository contains a Linux kernel local privilege escalation exploit targeting the nftables/netfilter subsystem. The main file, 'exploit.c', is a large C program that interacts with the kernel via netlink sockets using the libmnl and libnftnl libraries. It constructs and sends crafted netlink messages to manipulate kernel memory and trigger a vulnerability, ultimately executing a kernel ROP chain. The ROP chain calls commit_creds(prepare_kernel_cred(0)) to escalate privileges to root, switches namespaces, and returns to usermode to execute a shell as root. The exploit is operational, with hardcoded kernel offsets and gadgets, meaning it is tailored for specific kernel versions. The exploit requires local access to the target system and appropriate kernel configuration. The repository also includes a header file ('exploit.h') with data structures and enums relevant to nftables and kernel exploitation. No network endpoints or remote attack vectors are present; the attack is purely local and targets the Linux kernel via netlink communication.