Linux kernel Netfilter nft_set_elem_init heap buffer overflow

This repository contains a single Metasploit module implementing a local privilege escalation exploit for CVE-2022-34918, a heap overflow in the Linux kernel's Netfilter nft_set_elem_init function (in net/netfilter/nf_tables_api.c). The exploit targets Linux kernels up to 5.18.9 and requires the attacker to have local access with the ability to create an unprivileged user namespace (CONFIG_USER_NS enabled and permitted). The module uploads and executes a compiled exploit binary (either pre-compiled or compiled on the target) and a payload binary (such as a reverse shell) to a writable directory (default: /tmp). If successful, it provides a root shell or Meterpreter session to the attacker. The module includes checks for kernel version, configuration, and architecture, and cleans up dropped files after execution. The structure is typical for a Metasploit local exploit: it registers options, checks target suitability, uploads/compiles binaries, executes the exploit, and delivers the payload. No network endpoints are involved; the attack vector is purely local privilege escalation.

This repository is a local privilege escalation (LPE) exploit for CVE-2022-34918, targeting the Linux kernel's nf_tables implementation (specifically tested on Ubuntu 5.15.0-39-generic). The exploit is written in C and consists of a main exploit binary ('poc') and a helper binary ('get_root'). The exploit works by abusing a heap overflow in nf_tables to overwrite kernel structures, leaking kernel addresses, and ultimately overwriting the modprobe_path to point to a malicious script. This script sets the SUID bit on the 'get_root' binary, which is then executed to provide a root shell. The codebase is modular, with separate source files for key kernel heap spraying techniques (keyring, io_uring, xattr), netlink/nf_tables manipulation, and privilege escalation logic. The exploit requires local access and is not a detection script. Several fingerprintable file paths are used, including /proc/sys/kernel/modprobe, /tmp/get_root, /tmp/dummy, and files under /tmp/tmpfs/ for heap spraying. The exploit demonstrates a deep understanding of Linux kernel internals and heap manipulation for privilege escalation.

This repository contains multiple proof-of-concept (PoC) exploits for CVE-2022-34918, a local privilege escalation vulnerability in the Linux kernel's netfilter nftables subsystem. The exploit targets a heap out-of-bounds write, allowing an unprivileged user to escalate privileges to root. The repository is organized into several subfolders, each implementing a variant of the exploit using different kernel heap spraying and manipulation techniques (e.g., keyring, fs_context, and credential structures). The main exploit logic is implemented in C, with supporting shellcode generation scripts and Makefiles for building the PoCs. The exploit works by setting up user and network namespaces, spraying kernel heap objects (such as keyrings and fs_context), leveraging the netfilter netlink interface to trigger the vulnerability, leaking kernel pointers, and finally injecting shellcode or patching kernel code to escalate privileges. The payloads are custom shellcode that directly manipulates kernel memory to grant root privileges. The exploit also interacts with kernel files such as /proc/self/setgroups, /proc/self/uid_map, /proc/self/gid_map, and /proc/sys/kernel/modprobe, and may drop binaries in /tmp for privilege escalation. The exploit is operational and provides a root shell if successful. The code is intended for research and educational purposes only.

This repository is a local privilege escalation (LPE) exploit for CVE-2022-34918, targeting the Linux kernel (specifically 5.15.0-39-generic). The exploit is implemented in C and consists of a main exploit binary ('poc') and a helper binary ('get_root'). The exploit abuses a vulnerability in the netfilter/nf_tables subsystem to achieve an arbitrary write, which is used to overwrite the kernel's modprobe_path. By placing a malicious script at the new modprobe_path, the exploit is able to set the SUID bit on the 'get_root' binary, which then provides a root shell when executed. The codebase is modular, with separate source files for kernel heap spraying (keyring, uring, xattr), netlink/nf_tables manipulation, and the modprobe_path hijack. The exploit requires local access and the ability to create namespaces and mount tmpfs. Notable fingerprintable endpoints include '/proc/sys/kernel/modprobe', '/tmp/get_root', '/tmp/dummy', and '/tmp/tmpfs'. The exploit is operational and provides a working local root shell on vulnerable systems.