Skip to content
Home

Linux kernel privilege escalation

Identify kernel version, find matching CVEs with linux-exploit-suggester, compile and run the exploit to reach root.

bash·1 min read··INE Certification

Linux kernel exploits target unpatched vulnerabilities in the kernel itself to execute code at the highest privilege level. The process is more manual than Windows as you need to match the kernel version, compile a C exploit on the target, then run it.

Step 1: identify the kernel version

uname -a                # full kernel info
uname -r                # just the version string
cat /etc/os-release     # distro + version

Step 2: find candidate exploits

# On attacker machine: run linux-exploit-suggester against the target's kernel version
./linux-exploit-suggester.sh

# Or install it:
wget https://raw.githubusercontent.com/mzet-/linux-exploit-suggester/master/linux-exploit-suggester.sh
chmod +x linux-exploit-suggester.sh

# From within Metasploit (existing session required)
use post/multi/recon/local_exploit_suggester
set SESSION <id>
run

Step 3: compile and run the exploit

# Most kernel exploits from exploit-db are C source code so compile it on the target if gcc is available
gcc exploit.c -o exploit
./exploit

# Or get an interactive bash shell first if you have a restricted one
/bin/bash -i
  • Kernel exploits are kernel-version-specific and architecture-specific. Some PoCs also require specific kernel configurations that may or may not be present.
  • Distro version matters too: distributions backport security patches to older kernel version strings, which can make a “vulnerable” version actually be patched.
  • If the target doesn’t have gcc, cross-compile on your attacker box for the target architecture and transfer the binary.