Metasploit modules that can be used to exploit Linux » Linux Kernel » 2.6.31

Order by Disclosure Date Module Name Module Type
  • Docker cgroups Container Escape
    Disclosure Date: 2022-02-04
    First seen: 2023-12-07
    exploit/linux/local/docker_cgroup_escape
    This exploit module takes advantage of a Docker image which has either the privileged flag, or SYS_ADMIN Linux capability. If the host kernel is vulnerable, its possible to escape the Docker image and achieve root on the host operating system. A vulnerability was found in the Linux kernel's cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly. More simply put, cgroups v1 has a feature called release_agent that runs a program when a process in the cgroup terminates. If notify_on_release is enabled, the kernel runs the release_agent binary as root. By editing the release_agent file, an attacker can execute their own binary with elevated privileges, taking control of the system. However, the release_agent file is owned by root, so only a user with root access can modify it. Authors: - h00die - Yiqi Sun - Kevin Wang - T1erno
  • Netfilter x_tables Heap OOB Write Privilege Escalation
    Disclosure Date: 2021-07-07
    First seen: 2022-12-23
    exploit/linux/local/netfilter_xtables_heap_oob_write_priv_esc
    A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space. Kernels up to 5.11 (including) are vulnerable. More information about vulnerable kernels is available at https://nvd.nist.gov/vuln/detail/CVE-2021-22555#vulnConfigurationsArea Authors: - Andy Nguyen (theflow <Andy Nguyen (theflow@)> - Szymon Janusz - bcoles <bcoles@gmail.com>
  • Reliable Datagram Sockets (RDS) rds_atomic_free_op NULL pointer dereference Privilege Escalation
    Disclosure Date: 2018-11-01
    First seen: 2020-04-26
    exploit/linux/local/rds_atomic_free_op_null_pointer_deref_priv_esc
    This module attempts to gain root privileges on Linux systems by abusing a NULL pointer dereference in the `rds_atomic_free_op` function in the Reliable Datagram Sockets (RDS) kernel module (rds.ko). Successful exploitation requires the RDS kernel module to be loaded. If the RDS module is not blacklisted (default); then it will be loaded automatically. This exploit supports 64-bit Ubuntu Linux systems, including distributions based on Ubuntu, such as Linux Mint and Zorin OS. Target offsets are available for: Ubuntu 16.04 kernels 4.4.0 <= 4.4.0-116-generic; and Ubuntu 16.04 kernels 4.8.0 <= 4.8.0-54-generic. This exploit does not bypass SMAP. Bypasses for SMEP and KASLR are included. Failed exploitation may crash the kernel. This module has been tested successfully on various 4.4 and 4.8 kernels. Authors: - Mohamed Ghannam - Jann Horn - wbowling - bcoles <bcoles@gmail.com> - nstarke
  • Linux Kernel UDP Fragmentation Offset (UFO) Privilege Escalation
    Disclosure Date: 2017-08-10
    First seen: 2020-04-26
    exploit/linux/local/ufo_privilege_escalation
    This module attempts to gain root privileges on Linux systems by abusing UDP Fragmentation Offload (UFO). This exploit targets only systems using Ubuntu (Trusty / Xenial) kernels 4.4.0-21 <= 4.4.0-89 and 4.8.0-34 <= 4.8.0-58, including Linux distros based on Ubuntu, such as Linux Mint. The target system must have unprivileged user namespaces enabled and SMAP disabled. Bypasses for SMEP and KASLR are included. Failed exploitation may crash the kernel. This module has been tested successfully on various Ubuntu and Linux Mint systems, including: Ubuntu 14.04.5 4.4.0-31-generic x64 Desktop; Ubuntu 16.04 4.8.0-53-generic; Linux Mint 17.3 4.4.0-89-generic; Linux Mint 18 4.8.0-58-generic Authors: - Andrey Konovalov - h00die - bcoles <bcoles@gmail.com>
  • Solaris RSH Stack Clash Privilege Escalation
    Disclosure Date: 2017-06-19
    First seen: 2020-04-26
    exploit/solaris/local/rsh_stack_clash_priv_esc
    This module exploits a vulnerability in RSH on unpatched Solaris systems which allows users to gain root privileges. The stack guard page on unpatched Solaris systems is of insufficient size to prevent collisions between the stack and heap memory, aka Stack Clash. This module uploads and executes Qualys' Solaris_rsh.c exploit, which exploits a vulnerability in RSH to bypass the stack guard page to write to the stack and create a SUID root shell. This module has offsets for Solaris versions 11.1 (x86) and Solaris 11.3 (x86). Exploitation will usually complete within a few minutes using the default number of worker threads (10). Occasionally, exploitation will fail. If the target system is vulnerable, usually re-running the exploit will be successful. This module has been tested successfully on Solaris 11.1 (x86) and Solaris 11.3 (x86). Authors: - Qualys Corporation - bcoles <bcoles@gmail.com>
  • AF_PACKET packet_set_ring Privilege Escalation
    Disclosure Date: 2017-03-29
    First seen: 2020-04-26
    exploit/linux/local/af_packet_packet_set_ring_priv_esc
    This module exploits a heap-out-of-bounds write in the packet_set_ring function in net/packet/af_packet.c (AF_PACKET) in the Linux kernel to execute code as root (CVE-2017-7308). The bug was initially introduced in 2011 and patched in version 4.10.6, potentially affecting a large number of kernels; however this exploit targets only systems using Ubuntu Xenial kernels 4.8.0 < 4.8.0-46, including Linux distros based on Ubuntu Xenial, such as Linux Mint. The target system must have unprivileged user namespaces enabled and two or more CPU cores. Bypasses for SMEP, SMAP and KASLR are included. Failed exploitation may crash the kernel. This module has been tested successfully on Linux Mint 18 (x86_64) with kernel versions: 4.8.0-34-generic; 4.8.0-36-generic; 4.8.0-39-generic; 4.8.0-41-generic; 4.8.0-42-generic; 4.8.0-44-generic; 4.8.0-45-generic. Authors: - Andrey Konovalov - bcoles <bcoles@gmail.com>
  • Linux Kernel 4.6.3 Netfilter Privilege Escalation
    Disclosure Date: 2016-06-03
    First seen: 2020-04-26
    exploit/linux/local/netfilter_priv_esc_ipv4
    This module attempts to exploit a netfilter bug on Linux Kernels before 4.6.3, and currently only works against Ubuntu 16.04 (not 16.04.1) with kernel 4.4.0-21-generic. Several conditions have to be met for successful exploitation: Ubuntu: 1. ip_tables.ko (ubuntu), iptable_raw (fedora) has to be loaded (root running iptables -L will do such) 2. libc6-dev-i386 (ubuntu), glibc-devel.i686 & libgcc.i686 (fedora) needs to be installed to compile Kernel 4.4.0-31-generic and newer are not vulnerable. This exploit does not bypass SMEP/SMAP. We write the ascii files and compile on target instead of locally since metasm bombs for not having cdefs.h (even if locally installed) Authors: - h00die <mike@stcyrsecurity.com> - vnik - Jesse Hertz - Tim Newsham
  • Linux Kernel 4.6.3 Netfilter Privilege Escalation
    Disclosure Date: 2016-06-03
    First seen: 2020-04-26
    exploit/linux/local/netfilter_priv_esc_ipv4
    This module attempts to exploit a netfilter bug on Linux Kernels before 4.6.3, and currently only works against Ubuntu 16.04 (not 16.04.1) with kernel 4.4.0-21-generic. Several conditions have to be met for successful exploitation: Ubuntu: 1. ip_tables.ko (ubuntu), iptable_raw (fedora) has to be loaded (root running iptables -L will do such) 2. libc6-dev-i386 (ubuntu), glibc-devel.i686 & libgcc.i686 (fedora) needs to be installed to compile Kernel 4.4.0-31-generic and newer are not vulnerable. This exploit does not bypass SMEP/SMAP. We write the ascii files and compile on target instead of locally since metasm bombs for not having cdefs.h (even if locally installed) Authors: - h00die <mike@stcyrsecurity.com> - vnik - Jesse Hertz - Tim Newsham
  • Overlayfs Privilege Escalation
    Disclosure Date: 2015-06-16
    First seen: 2020-04-26
    exploit/linux/local/overlayfs_priv_esc
    This module attempts to exploit two different CVEs related to overlayfs. CVE-2015-1328: Ubuntu specific -> 3.13.0-24 (14.04 default) < 3.13.0-55 3.16.0-25 (14.10 default) < 3.16.0-41 3.19.0-18 (15.04 default) < 3.19.0-21 CVE-2015-8660: Ubuntu: 3.19.0-18 < 3.19.0-43 4.2.0-18 < 4.2.0-23 (14.04.1, 15.10) Fedora: < 4.2.8 (vulnerable, un-tested) Red Hat: < 3.10.0-327 (rhel 6, vulnerable, un-tested) Authors: - h00die <mike@shorebreaksecurity.com> - rebel
  • Android 'Towelroot' Futex Requeue Kernel Exploit
    Disclosure Date: 2014-05-03
    First seen: 2020-04-26
    exploit/android/local/futex_requeue
    This module exploits a bug in futex_requeue in the Linux kernel, using similar techniques employed by the towelroot exploit. Any Android device with a kernel built before June 2014 is likely to be vulnerable. Authors: - Pinkie Pie - geohot - timwr
  • Android get_user/put_user Exploit
    Disclosure Date: 2013-09-06
    First seen: 2020-04-26
    exploit/android/local/put_user_vroot
    This module exploits a missing check in the get_user and put_user API functions in the linux kernel before 3.5.5. The missing checks on these functions allow an unprivileged user to read and write kernel memory. This exploit first reads the kernel memory to identify the commit_creds and ptmx_fops address, then uses the write primitive to execute shellcode as uid 0. The exploit was first discovered in the wild in the vroot rooting application. Authors: - fi01 - cubeundcube - timwr
  • Reliable Datagram Sockets (RDS) rds_page_copy_user Privilege Escalation
    Disclosure Date: 2010-10-20
    First seen: 2020-04-26
    exploit/linux/local/rds_rds_page_copy_user_priv_esc
    This module exploits a vulnerability in the `rds_page_copy_user` function in `net/rds/page.c` (RDS) in Linux kernel versions 2.6.30 to 2.6.36-rc8 to execute code as root (CVE-2010-3904). This module has been tested successfully on: Fedora 13 (i686) kernel version 2.6.33.3-85.fc13.i686.PAE; and Ubuntu 10.04 (x86_64) with kernel version 2.6.32-21-generic. Authors: - Dan Rosenberg - bcoles <bcoles@gmail.com>
12 metasploit modules found
Please note: Metasploit modules are only matched by CVE numbers. Visit metasploit web site for more details
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close