FreeBSD RPCSEC_GSS Stack Buffer Overflow

Repository contains a README and a single Python exploit script. The README documents CVE-2026-4747 as a stack buffer overflow in FreeBSD's kgssapi.ko RPCSEC_GSS handling and explains the lab setup, exploitation strategy, and operational constraints. The main code is exploit.py, a standalone Python 3 exploit using gssapi plus raw socket/RPC helpers to attack an NFS service over RPCSEC_GSS. Core capability: the exploit performs remote kernel code execution against a vulnerable FreeBSD NFS server. It uses a 15-round attack because the overflowed credential/XDR field cannot carry the full payload in one request. Round 1 uses a ROP chain to call pmap_change_prot on kernel .bss to make it RWX. Rounds 2-14 use repeated ROP write primitives to copy shellcode into kernel memory. Final round writes the tail of the shellcode and transfers execution to it. The shellcode pivots to a controlled stack in .bss, clears DR7, calls kproc_create to spawn a kernel worker context, then uses exec_alloc_args/exec_args_add_* and kern_execve to run /bin/sh -c with a reverse-shell one-liner. The result is an interactive root shell connecting back to the attacker. The exploit is highly target-specific and operational rather than generic: it hardcodes kernel base, .bss addresses, gadget offsets, and function offsets for FreeBSD 14.4-RELEASE amd64 GENERIC with no KASLR variation. It also assumes the target exposes NFS on TCP/2049 with RPCSEC_GSS enabled and that the attacker has a valid Kerberos ticket for the configured realm/SPN. The README further notes that 2+ CPUs are effectively required because each round consumes an NFS worker thread and the exploit needs enough surviving threads to complete all 15 rounds. Repository structure is minimal and purpose-built: README.md provides vulnerability background, setup instructions for a vulnerable FreeBSD/Kerberos/NFS lab, and a walkthrough of the multi-stage ROP/shellcode design; exploit.py is the only executable entry point and contains constants, XDR/RPC helpers, shellcode generation, exploit delivery logic, listener setup, and interactive shell handling.

Repository contains a small Python exploit scaffold plus extensive Markdown documentation for CVE-2026-4747, described as a FreeBSD kernel stack buffer overflow in kgssapi.ko reachable through NFS RPCSEC_GSS authentication. Structure is: README.md with high-level exploit narrative and setup/mitigation notes, write-up.md with detailed vulnerability and exploitation methodology, claude-prompts.txt containing prompt/session history used to develop the exploit, and exploit.py as the only executable entry point. The main exploit capability is remote kernel RCE against vulnerable FreeBSD NFS servers on TCP/2049, with the intended post-exploitation outcome being a root reverse shell. The Python code defines a target profile database with hardcoded kernel addresses/gadgets for FreeBSD 14.4-RELEASE-AMD64, a simple ROP chain builder, and logic intended to generate a payload that calls pmap_change_prot on kernel BSS memory before staging shellcode. It accepts a victim IP, callback IP, and callback port. However, the implementation is incomplete: shellcode is a placeholder NOP sequence, RPC packet transmission is commented out, and there is even a likely bug using log.success(), which standard Python logging does not provide. So the repository is best characterized as an operational exploit concept/documentation set with a partial exploit scaffold rather than a turnkey weaponized tool. The write-up and README provide the substantive exploit intelligence: the vulnerable function copies attacker-controlled RPCSEC_GSS credential data into a 128-byte stack buffer without proper bounds checking, enabling overwrite of saved registers and return address in kernel context. The documented attack path requires RPCSEC_GSS/Kerberos handling to reach the vulnerable code path, and the exploit strategy uses repeated overflow packets to build/write shellcode into kernel BSS, pivot execution, invoke kernel helpers such as kproc_create, and ultimately exec /bin/sh to obtain a uid 0 reverse shell. Fingerprintable targets and artifacts include NFS on TCP/2049, Kerberos/KDC port 88 (with example forwarding to 8888), /bin/sh, /etc/krb5.conf, /boot/loader.conf, /etc/exports, and hardcoded kernel addresses for the supported target profile.