Kernel on kiperZ

Sofirium

Fri, 21 Aug 2026 00:00:00 +0000

A character driver that keeps a singly linked list of “NFTs”. Deleting the collection frees every node and forgets to clear a single pointer, so the whole list stays walkable after the free. That is the entire bug. Getting from there to a root shell took me longer than it should have, because the obvious fake chunk placement poisons the kmalloc-512 freelist, and the technique I wanted to finish with allocates from kmalloc-512 itself.

僕と契約して、魔法少女になってよ！ - THJCC CTF 2026

Fri, 05 Jun 2026 00:00:00 +0000

TL;DR

A single-byte NULL off-by-one in a kmalloc-1024 object is leveraged into a pipe_buffer.page LSB clear → page-level UAF → cross-cache reclaim into filp_cachep → struct file->f_mode overwrite → page-cache code injection into /bin/busybox (Dirty-Pipe style) → root code execution. Fully leakless: no kernel address is ever read.

Description: Make a contract and become a magical girl!

Target: Linux 6.17.7, x86-64. Mitigations on: SMEP, SMAP, KPTI (pti=on), KASLR, dmesg_restrict=1, kptr_restrict=1. The interactive shell runs as uid 1000.

Messenger - LACTF 2025

Sun, 17 May 2026 00:00:00 +0000

TL;DR

A 3-byte heap OOB write in msgsnd() is leveraged into a page-level UAF and then into root via a struct cred overwrite (PageJack).

Description: i love sending messages, so i made it possible to add just a few more bytes to them

Vulnerability

A custom Linux 6.10.9 kernel ships with the following patch in ipc/msgutil.c:

@@ -93,7 +93,7 @@
        return ERR_PTR(-ENOMEM);

    alen = min(len, DATALEN_MSG);
-   if (copy_from_user(msg + 1, src, alen))
+   if (copy_from_user(msg + 1, src, alen + 3))
        goto out_err;

load_msg(), invoked by msgsnd(), copies alen + 3 bytes from userland into a freshly-allocated msg_msg slab object. Three bytes are written past the end of the slot, into the next object in the same slab. The allocation size (via msgsz) and the three overflow bytes (bytes [msgsz, msgsz+1, msgsz+2] of the user buffer) are both attacker-controlled.

Phantom - 0xfunctf 2026

Sat, 14 Feb 2026 00:00:00 +0000

TL;DR

Physical page UAF via persistent mmap → spray to reallocate the page as a PTE → forge a PTE to the physical page of modprobe_path → overwrite via /proc/self/mem → trigger modprobe → root.

Challenge Files: A .tar.gz archive containing:

tar -ztvf phantom.gz
-rw-r--r-- root/root   1306874 2026-02-14 08:00 initramfs.cpio.gz
-rw-r--r-- root/root  12430112 2026-02-14 04:11 bzImage
-rw-r--r-- root/root      8848 2026-02-13 22:24 phantom.ko
-rwxr-xr-x root/root       251 2026-02-13 06:39 run.sh
-rw-r--r-- root/root       145 2026-02-13 22:24 interface.h

Note: This writeup focuses on the physical page UAF, PTE reallocation, and the overwrite of modprobe_path.

Hello Rootkitty (Harder)

Thu, 30 Oct 2025 00:00:00 +0000

TL;DR

Same rootkit, harder exploitation. No SMEP/SMAP means we can execute userspace code from kernel context (ret2usr). Overflow the buffer → execute our shellcode → disable CR0 write protection → restore syscall table → iretq back to userspace. Oh, and we can also get root shell as a bonus.

Tags: pwn kernel rootkit ret2usr privilege-escalation CR0 iretq SMEP-bypass

Challenge Files: Kernel module (rootkit), same as before

Note: This writeup assumes you’ve read the previous “Hello Rootkitty” challenge. I’ll focus on the advanced techniques specific to the “Harder” version without repeating the basics.

Hello Rootkitty

Wed, 29 Oct 2025 00:00:00 +0000

TL;DR

Kernel rootkit hides ecsc_flag_* files but has a buffer overflow in its strcpy(). Create a super long filename to overflow the buffer → control RIP → call cleanup_module() to restore original syscalls → profit!

Challenge Files: Kernel module (rootkit)

Note: This is my first CTF writeup! At the time I solved this challenge, I was just starting out with heap exploitation. There are probably cleaner/simpler ways to solve this, but this approach worked for me. If you spot improvements, feel free to share!

Kexpita

Sat, 21 Jun 2025 00:00:00 +0000

TL;DR

Buffer overflow in a kernel module → RIP control → ROP chain to bypass SMEP/SMAP → commit_creds(prepare_kernel_cred(0)) → root shell

Note: This is my first kernel exploitation writeup! This was a school project at EPITA, not a CTF challenge. I was learning kernel security concepts for the first time, so the approach might not be the most optimized. Feedback welcome!

Challenge Overview

This is a class project where we had to exploit a vulnerable kernel module called kexpita. The module is a character device driver with a classic buffer overflow vulnerability.