Ethical Hacking Academy · Lesson

Kernel Exploits

Escalation via kernel.

Kernel Exploits is a free Ethical Hacking Academy lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Ethical Hacking Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Escalation via the Kernel

When configuration is locked down, the kernel itself may be the weak point. A bug in kernel code — reachable from an unprivileged process — can be exploited to execute code in ring 0 and gain root.

Identifying the Kernel

Everything starts with the exact kernel version and distro. A specific build maps to specific public CVEs and exploits.

uname -r
uname -a
cat /proc/version
cat /etc/os-release

Matching Version to CVE

Search exploit databases for your kernel/distro. Tools like searchsploit (Exploit-DB offline) and linux-exploit-suggester map a version to likely working exploits.

searchsploit linux kernel 4.4
./linux-exploit-suggester.sh

Famous: Dirty COW

Dirty COW (CVE-2016-5195) is a race condition in the kernel's copy-on-write handling of memory mappings. It lets an unprivileged user write to read-only files (like /etc/passwd), gaining root. It affects kernels from 2007 to 2016.

Famous: DirtyPipe

DirtyPipe (CVE-2022-0847) affects Linux 5.8+. A flaw in pipe buffer handling lets an unprivileged user overwrite data in read-only files, enabling root via the same passwd/SUID-overwrite tricks.

Famous: PwnKit

PwnKit (CVE-2021-4034) is technically a userspace bug in pkexec (Polkit), not the kernel, but it is a reliable local-root on nearly every Linux distro for over a decade. Always check it during privesc.

ls -la /usr/bin/pkexec   # SUID root, often vulnerable

Compiling an Exploit

Most kernel exploits are C source you must compile on a matching environment. Mismatched headers or compiler versions cause failures. Compile on a lab clone of the target where possible.

gcc -o exploit exploit.c
# or: gcc dcow.c -o dcow -lpthread

Risks of Kernel Exploits

Kernel exploits are the last resort. A failed attempt can panic the kernel and crash the entire box — data loss, downtime, and a dead foothold. Never run one casually on production.

Stability and Reliability

Exploit reliability varies by kernel sub-version, hardware, and mitigations (KASLR, SMEP, SMAP). Read the exploit notes, confirm the exact affected range, and test in a lab before touching the engagement target.

Defenses

The primary defense is simple: patch promptly. Keep kernels updated, enable mitigations, minimize SUID binaries, and use restricted kernels (grsecurity-style hardening, seccomp). Most kernel exploits die the moment a system is patched.

Authorization and Caution

Because kernel exploits can crash systems, get explicit written approval before running them, prefer non-production windows, and have the client ready to reboot. Run only within your authorized scope.

Quick Check

Test your kernel-exploit knowledge.

Recap

You learned kernel-based escalation:

Match exact kernel version to CVEs with searchsploit / LES
Classics: Dirty COW, DirtyPipe, PwnKit
Exploits are often C that must be compiled for the target
They are a last resort — failures crash the box; patch to defend

That completes the Linux Privilege Escalation course.

Frequently asked questions

Is the “Kernel Exploits” lesson free?

Yes — the full text of “Kernel Exploits” is free to read here on the web, and the Ethical Hacking Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Ethical Hacking Academy course, upgrade to CoddyKit PRO.

What will I learn in “Kernel Exploits”?

Escalation via kernel. You practise Ethical Hacking Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Ethical Hacking Academy?

No prior experience is required. Ethical Hacking Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Kernel Exploits” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Ethical Hacking Academy lesson?

Yes. Every Ethical Hacking Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to Ethical Hacking Academy