CTF Kernel Exploitation

Kernel exploitation CTF challenges: privilege escalation from unprivileged user to root inside a QEMU VM. Two major families: (A) actual kernel vulnerabilities (UAF, heap overflow in kernel modules), and (B) QEMU emulator bugs that let userspace bypass kernel protections.

When to Load

• Any CTF challenge tagged "kernel", "pwn", "misc 0day", or involving a bzImage + rootfs.cpio
• The user asks about exploiting a Linux kernel, QEMU escape, or kernel privilege escalation
• The challenge provides a QEMU run script and kernel/rootfs files

Core Approach

Step 1: Analyze the challenge files

unzip dist.zip
cat run.sh          # QEMU flags: KVM vs TCG, protections
cat rootfs/init     # System config, kptr_restrict, setuid binaries
file vmlinux        # ELF or compressed?

Step 2: Extract kernel offsets

For modprobe_path technique, find the virtual address:

# Parse vmlinux ELF, find "/sbin/modprobe" string, compute virt addr
# modprobe_path is in .data section
# offset from kernel text base (0xffffffff81000000) is the key value

Step 3: Choose exploit strategy

Strategy A: QEMU TCG iret/far-call (most common for misc/kernel CTFs)

• Works on QEMU < 9.1 in TCG mode (not KVM)
• sgdt → GDT address → TSS → IST shared stack
• iretq with RSP=physical_addr → reads physical memory (page fault trick)
• call far shellcode → writes byte to physical memory
• Overwrite modprobe_path → trigger unknown binary → script reads /flag

Strategy B: Kernel module vulnerability (custom .ko provided)

• Reverse engineer the module
• Exploit the specific bug (UAF, overflow, race condition)
• Standard kernel exploitation: heap spray, overwrite cred structure, etc.

Strategy C: Kernel ROP via custom module stack-pivot (wand.ko pattern) A clean pattern seen in AIS3 CTFs: a custom miscdevice module provides ioctl that:

1. Copies user-controlled data into a kernel stack buffer (e.g., magic_core[168])
2. Pivots RSP to that buffer: mov %0, %%rsp
3. Jumps to a hardcoded swapgs_restore_addr (e.g., KPTI trampoline): jmp *%1
4. The trampoline does swapgs; iretq — the iretq frame is user-controlled from the buffer

Key constraint: limited ROP space (e.g., 168 bytes total, minus 40-byte iretq frame = 128 bytes for ROP chain = 16 qwords).

Exploit ROP chain layout (ring0 → root → ring3):

buffer[0]:   pop rdi; ret           # first gadget (RIP in iretq frame, CS=0x10)
buffer[1]:   0                      # rdi = 0 for prepare_kernel_cred(NULL)
buffer[2]:   prepare_kernel_cred     # returns new root cred in rax
buffer[3]:   <rax->rdi gadget>      # MOV RDI, RAX essential — see Pitfalls
buffer[4]:   commit_creds            # elevate to root
buffer[5]:   swapgs_restore_addr     # swapgs; iretq back to ring3
buffer[6]:   user_rip                # shellcode
buffer[7]:   0x33                    # user CS
buffer[8]:   user_rflags (0x202)     # interrupt flag set
buffer[9]:   user_rsp
buffer[10]:  0x2b                    # user SS
...
buffer[16]:  iretq frame: RIP=pop_rdi_ret, CS=0x10, RFLAGS, RSP=&buffer[1], SS=0x18

init_cred bypass: If no rax→rdi gadget exists, commit init_cred directly:

pop rdi; ret → &init_cred → commit_creds → swapgs_restore → user shellcode

Skips prepare_kernel_cred entirely. Needs init_cred address (a global struct cred in .data with full capabilities, uid=0).

Step 4: Remote connection (if applicable)

Most kernel CTFs use: HTTP PoW → WebSocket → terminal inside VM

• Solve PoW (SHA-256, typically 20-bit difficulty)
• Connect WebSocket with token + pow_token
• Handle queue/status/ready/error messages
• Interact with terminal (busybox shell)

Step 5: Upload and run exploit

• Binary must be statically linked (VM has only busybox)
• Compress with gzip, encode as base64
• Upload in chunks via printf or echo -n
• Decode: base64 -d /tmp/e.b64 | gzip -d > /tmp/e
• VM session timeout is typically 300s — keep total operation under this

Key Pitfalls

xchg eax, edi / 32-bit swap is USELESS for kernel addresses

xchg eax, edi; ret (bytes 97 c3) is common but only swaps lower 32 bits and zero-extends to 64 bits. If RAX holds 0xffff88800a1b2c00 (kernel heap cred pointer), after xchg eax, edi, RDI becomes 0x000000000a1b2c00 — a userspace address, not a valid kernel pointer. Always search for a 64-bit rax→rdi gadget:

• 48 89 c7 c3 = mov rdi, rax; ret (rare in kernel .text)
• 48 97 c3 = xchg rax, rdi; ret (extremely rare)
• 50 5f c3 = push rax; pop rdi; ret (occasionally found)
• Fallback: use init_cred bypass (see Strategy C)

KPTI trampoline address verification

The swapgs_restore_addr hardcoded in the module (e.g., 0xffffffff820015d0) may NOT point to swapgs; iretq. Always disassemble around that address with objdump -d to verify. In Linux 6.12 with KPTI, the code at that offset may be MSR writes (wrmsr) for page-table switching, not the expected swapgs instruction. The actual swapgs; iretq sequence may be elsewhere in the trampoline.

commit_creds and prepare_kernel_cred are NOT exported

Since kernel ~5.x, these functions have no EXPORT_SYMBOL. They are absent from __ksymtab. Do not waste time searching __ksymtab — use:

• Symbol extraction from stripped vmlinux (see references/symbol-extraction-stripped-vmlinux.md)
• QEMU boot with modified initramfs (dump /proc/kallsyms before kptr_restrict=1 is set)
• ENDBR64 function boundary scan (modern IBT kernels start every function with f3 0f 1e fa)

EFI-stub bzImage extraction

Modern kernels with CONFIG_EFI_STUB=y produce bzImages that are valid PE executables (start with MZ). The compressed kernel is inside the .text PE section, not at the traditional (setup_sects+1)*512 offset. Use:

# Parse PE header to find .text section, then gzip offset within it
# Verified for Linux 6.12.85: gzip at bzImage offset 21188 (0x52C4)
# Decompresses to 43,911,280 byte ELF

The extract-vmlinux script from kernel source may fail on EFI-stub images — parse PE sections manually.

Docker QEMU TCG mode is IMPRACTICALLY slow

Booting a full Linux kernel in Docker with QEMU TCG (no KVM inside containers on macOS) can take 10-30+ minutes. Key tactic: the slow part is apt-get install qemu-system-x86 (pulls in graphical dependencies). Pre-build a Docker image with QEMU or reuse the same container for multiple boots. For symbol extraction, prefer:

• Static binary analysis (ENDBR64 scan, byte-pattern gadget search)
• Modify initramfs to dump kallsyms before kptr_restrict — most reliable method; trivial init script change repack with cpio+gzip
• Building kernel from source to get System.map (~20 min but guaranteed correct)
• Using pre-built Ubuntu kernel debug packages for the same version

Ubuntu QEMU 6.2.0 has BACKPORTED iret/far-call fix

CRITICAL: Ubuntu 22.04 ships QEMU 6.2.0 (qemu-system-x86 from apt) with a backported security patch that fixes the ring3→ring0 iretq privilege-escalation bug. The upstream fix landed in QEMU 9.1, but Ubuntu backported it. The ring3→ring0 iretq exploit will SIGSEGV immediately on Ubuntu-packaged QEMU. This means local testing in Docker with ubuntu:22.04 gives false negatives.

Verification: A minimal iretq test (RSP=userspace, CS=0x10) gets SIGSEGV (exit 139) on Ubuntu's QEMU 6.2.0. On unpatched QEMU (e.g., compiled from source before 9.1, or older distro packages), the same test succeeds.

Workaround for local testing: The remote CTF server may use a DIFFERENT QEMU version. For local testing, either:

• Use a Docker image with unpatched QEMU (Alpine, Debian, or compile from source)
• Test on the remote directly (mind the 1-hour cooldown)
• Use a non-Ubuntu QEMU package

Physical address calculation

The CORRECT formula:

uint64_t modprobe_phys = (kbase + MODPROBE_PATH_OFF) - 0xffffffff80000000ULL;

DO NOT add an extra PHYSICAL_START (0x1000000) — PAGE_OFFSET already accounts for the mapping.

Binary upload timing

• Send all upload chunks without intermediate reads (shell echo interferes)
• After READY, wait 10-15s for VM to finish booting
• Use gzip -d not gunzip (busybox compatibility)
• Don't use 2>/dev/null during decode — errors must be visible
• Terminal prompt detection is unreliable; use fixed waits instead

Static compilation for Linux target

On macOS, use Docker:

# Alpine (musl): gcc -static -Os -s -o exp exp.c
# Alpine musl lacks REG_ERR/REG_RSP in ucontext — use raw gregs index 19 for REG_ERR on x86_64
docker run --rm -v $PWD:/work -w /work alpine sh -c '
  apk add --no-cache gcc musl-dev && gcc -static -Os -s -o exp exp.c'

Alpine musl may lack REG_ERR/REG_RSP defines, and <asm/ldt.h> is absent. Workarounds:

• ferr = ((ucontext_t*)ctx)->uc_mcontext.gregs[19]; — raw index 19 for REG_ERR on x86_64
• Remove <asm/ldt.h> include; the phys_read/iretq exploit doesn't need LDT

WebSocket lifecycle

• The VM session timeout starts from VM boot, not from READY
• Don't read terminal output during upload — it captures stale echoes
• Send all commands (upload, decode, run, flag) in one burst, then read
• Total operation MUST fit in ~300s window

Verified Offsets Reference

For common kernel builds, modprobe_path offset from kbase:

• Linux 6.1.81 (AIS3 build): 0x2877760
• Linux 6.12.85 (AIS3 2026): full verified address table in references/linux-6.12.85-verified-addresses.md. Key addresses: modprobe_path@0xffffffff82b44f60, commit_creds@0xffffffff810c1dd0, prepare_kernel_cred@0xffffffff810c2060, init_cred@0xffffffff82a52ba0

Physical addresses from kallsyms 'A' symbols

Kallsyms entries with type A (Absolute) are physical addresses, not virtual! Critical for QEMU TCG phys_read exploits:

000000000000b000 A gdt_page          ← GDT at physical 0xb000
0000000000006000 A cpu_tss_rw        ← TSS at physical 0x6000

Use these directly as physical addresses for iretq RSP targets. Do NOT subtract PAGE_OFFSET from 'A' symbols — they are already physical.

Netcat-based CTFd remote protocol (non-WebSocket)

Some CTFd instancers use a raw netcat protocol instead of WebSocket:

→ Server: PoW prompt ("Prefix: <hex>")
→ Client: PoW answer
→ Server: "CTFd token:" prompt  
→ Client: ctfd_<64-hex-chars>
→ Server: "NEED_UPLOAD_EXPLOIT (y/n)"
→ Client: y
→ Server: (accepts exploit as RAW BINARY, boots VM)

Token is rate-limited: "This account can verify only once every 1 hour." Plan attempts carefully. The exploit binary is provided as a raw disk image (becomes /dev/sda in VM, copied to /tmp/e by init script).

PITFALL — raw binary, NOT base64: Sending base64-encoded data after 'y' causes "[X] Invalid URL." The server expects the raw binary (ELF file bytes) directly on the socket. It shows a progress bar (backspace characters) while receiving. After upload, the VM boots — set socket timeout to 300+ seconds (not 60) to capture the full VM boot + exploit output. The 60s default is too short; the exploit runs but you miss the flag. See references/netcat-raw-binary-upload-pitfall.md.

PITFALL — base64 echo confusion: If you send base64 INSTEAD of first answering 'y', the server reads 'f' (first char of base64) as the answer, defaults to 'n', echos the base64, and boots WITHOUT your exploit ("No exploit supplied"). Always send 'y\n' BEFORE the binary data.

Apple Silicon + Docker QEMU = broken (Rosetta)

On Apple Silicon Macs, docker run --platform linux/amd64 with QEMU inside the container fails with rosetta error: Unimplemented syscall number 282. Rosetta 2 does not support the full x86_64 syscall table needed by QEMU's system emulation. For local kernel exploitation testing on Apple Silicon:

• Native macOS QEMU via Homebrew (may fail to build for x86_64 target)
• UTM.app or similar virtualization
• Test on the remote CTF server directly (mind the cooldown)
• Use a remote x86_64 cloud VM

Key gadget byte patterns (search .text section after objcopy -O binary -j .text)

2025-2026 Kernel Exploitation Update: New CVEs & Techniques

Critical Kernel CVEs for CTF (2025-2026)

nf_tables UAF Exploitation (CVE-2024-1086 "Flipping Pages")

The most significant kernel exploit of 2025 — a decade-old UAF in nf_tables:

1. Trigger: Double-free via NFT_MSG_NEWRULE + NFT_MSG_DELRULE race
2. Heap spray: Use msg_msg structure for controlled heap allocation at freed object's slab
3. Arbitrary read/write: Overwrite msg_msg.m_ts for OOB read, msg_msg.next for arbitrary read
4. Privilege escalation: Overwrite task_struct.cred or use setresuid ROP
5. KASLR bypass: single_start leak via /proc/self/stat or msg_msg partial overwrite

vsock VM Escape (CVE-2025-21756)

For CTF challenges involving VM escape:

1. vsock transport reassignment causes refcount corruption
2. UAF on vsock_sock structure after transport module unload
3. Kernel memory corruption → arbitrary code execution with root privileges
4. PoC published alongside disclosure

QEMU Updates (2025-2026)

• QEMU 9.1+ fixed the ring3→ring0 iretq privilege escalation bug (Ubuntu backported fix to 6.2.0)
• QEMU TCG mode still used in CTFs without KVM — check version before attempting iretq exploits
• Apple Silicon + Docker + QEMU: Still broken (Rosetta doesn't support full x86_64 syscall table). Use remote testing or cloud x86_64 VM.
• New: --cpu kvm64 includes PCID → KPTI is ON by default. Only pti=off/nopti cmdline disables it.

Modern Kernel Hardening (2025-2026)

Practical Kernel CTF Resources (2025-2026)

• linux-kernel-exploitation GitHub: github.com/xairy/linux-kernel-exploitation — comprehensive link collection (6.5k stars)
• kernelCTF VRP (Google): Continuous kernel exploitation challenge with experimental mitigations
• RVAsec 2025: "Linux Kernel Exploitation for Beginners" — training using kernel CTFs as entry point
• Reddit r/ExploitDev: Community kernel exploitation CTF labs
• Google kernelCTF: First blood on experimental mitigation instance — single byte OOB → privilege escalation

modprobe_path AF_ALG Bypass (2025 — search_binary_handler Patch)

As of Linux v6.14-rc1 (patch fa1bdca98d74), the search_binary_handler() flow that called request_module() has been completely removed. Executing a dummy file with unknown magic bytes (e.g., \xff\xff\xff\xff) no longer triggers modprobe_path on upstream kernels. The old technique is dead on mainline.

New trigger: AF_ALG socket bind()

The AF_ALG socket subsystem calls request_module("algif-%s", type) in alg_bind() when sa->salg_type doesn't match any known crypto type. This reaches call_modprobe() without needing a dummy file.

// Trigger — no capabilities required, no file needed
int sock = socket(AF_ALG, SOCK_SEQPACKET, 0);
struct sockaddr_alg sa = {0};
strcpy((char*)sa.salg_type, "V4bel"); // dummy string
bind(sock, (struct sockaddr*)&sa, sizeof(sa));

Fileless chaining with memfd_create

Combine with memfd_create() + dup() for a fully fileless privilege escalation:

1. memfd_create("", MFD_CLOEXEC) → anonymous memory mapping
2. Write #!/bin/sh\n/bin/sh 0</proc/%u/fd/%u 2>&1\n to the memfd
3. AAW: overwrite modprobe_path[] with /proc/<pid>/fd/<memfd_fd>
4. bind(AF_ALG socket) → kernel executes the script as root → shell redirected to current process

CTF relevance: On kernelCTF and other mount-namespace environments, PID guessing is needed (same as lau's nftables approach). The AF_ALG method is in major distributions (CONFIG_CRYPTO_USER_API).

Patch status: Only merged into upstream kernel. Distribution kernels (Ubuntu, Debian) have NOT backported this patch yet (as of mid-2025), so the old dummy file technique still works there. Check /proc/sys/kernel/modprobe and kernel version before choosing the trigger method.

Reference:

Kernel-Exploit-Dojo (100+ Kernel CTF Archive)

github.com/mito753/Kernel-Exploit-Dojo is a curated archive of 100+ Linux kernel exploitation CTF challenges (2020–2026), organized by bug class, exploitation primitive, final technique, difficulty, and solve count. Each challenge has exploit code + writeup.

Key 2025-2026 challenges for technique study:

Common bug → primitive → final technique flow:

• UAF in kmalloc-N → object reclaim (tty_struct/pipe_buffer/seq_operations) → modprobe_path overwrite
• OOB write → kernel memory write → modprobe_path or core_pattern overwrite
• Stack overflow → kernel stack ROP → CC(PKC(0)) via KPTI trampoline
• Double free → heap overlap → Dirty Pipe /etc/passwd overwrite
• page cache manipulation → /etc/passwd or /bin/busybox overwrite

Technique abbreviations: CC(PKC(0)) = commit_creds(prepare_kernel_cred(0)), CC(IC) = commit_creds(&init_cred)

References

• references/qemu-tcg-technique.md — Detailed QEMU TCG iret/far-call exploit technique
• references/qemu-backported-iret-fix.md — Ubuntu 22.04 QEMU backported fix pitfall + verification test
• references/remote-ctf-solver-pattern.md — PoW + WebSocket terminal solver template
• references/netcat-raw-binary-upload-pitfall.md — Netcat instancer protocol: raw binary upload, cooldown, timeout gotchas
• references/wand-stack-pivot-technique.md — Kernel ROP via custom module stack-pivot (AIS3 wand.ko pattern)
• references/symbol-extraction-stripped-vmlinux.md — Extracting symbols/gadgets from stripped vmlinux without kallsyms