Kernel-Exploit-Dojo

KO | EN

gitlite — search

#javascript #react #llm #android #machine-learning #deep-learning #macos #java #windows #kubernetes #awesome-list #security #openai #open-source

Kernel-Exploit-Dojo

(★ 521)

CTF kernel exploitation notes, PoCs, exploits, and writeups.

Kernel-Exploit-Dojo Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

![Kernel Exploit Dojo banner](https://raw.githubusercontent.com/mito753/Kernel-Exploit-Dojo/main/assets/banner02.jpg)

# Kernel-Exploit-Dojo （道場）

## Overview

Kernel-Exploit-Dojo is a curated archive of 100+ Linux kernel exploitation CTF challenges, organized by bug class, exploitation primitive, final technique, difficulty, and solve count.
The goal is to organize practical kernel pwn techniques such as UAF, heap spraying, pipe_buffer abuse, msg_msg, modprobe_path overwrite, and cred overwrite.

“Dojo” means a training place; this repository is intended as a practice-oriented archive for learning Linux kernel exploitation through CTF challenges.

Each challenge directory contains the original distribution files when available, exploit code, and a technical writeup.

Challenges are organized by year, and the top-level Challenge List works as an index to each challenge directory.

For technique-based navigation, see [Techniques Index](./TECHNIQUES.md).

Note: Year folders are based on the actual event date, not necessarily the year shown in the CTF name.

Kernel-Exploit-Dojo (道場) は、100件以上の Linux Kernel Exploit CTF 問題を、Bug・Primitive・Final Technique・Difficulty・Solve数ごとに整理した技術索引です。

「道場」は練習・鍛錬の場という意味で、本リポジトリは CTF 問題を通じて Linux Kernel Exploit を学ぶための実践的なアーカイブです。

各問題ごとに配布ファイル、exploit、解説をまとめ、実戦的な kernel pwn 技術を復習できる形にしています。

各問題は年度別フォルダに整理しており、トップページの Challenge List から各問題へ移動できます。

技術別に探したい場合は [Techniques Index](./TECHNIQUES.md) を参照してください。

Note: 年度別フォルダは CTF 名の年ではなく、実際の開催年を基準にしています。

## Disclaimer

This repository is for CTF learning and local lab environments only.
Do not run the exploits on production systems or systems you do not own.
All examples are intended to be executed inside isolated QEMU/CTF environments.

本リポジトリは CTF 学習およびローカル検証環境向けです。
実環境・第三者環境では絶対に実行しないでください。

## Challenge List

Difficulty is based on exploit complexity, required kernel knowledge, and solve count.

Difficulty は exploit の複雑さ、必要な kernel 知識、solve 数をもとに主観的に分類しています。

| CTF | Challenge | Status | Difficulty (Solves) | Bug | Primitive | Final Technique |
|---|---|:---:|:---:|---|---|---|
| CakeCTF 2022 | [welkerme](./2022/CakeCTF_2022/Pwn_welkerme) | solved / writeup | Very-Easy (75) | kernel calls user function pointer | run user code as kernel | `CC(PKC(0))` |
| b01lers CTF 2026 | [throughthewall](./2026/b01lers_CTF_2026/Pwn_throughthewall) | solved / writeup | Easy (69) | kmalloc-1024 UAF | pipe_buffer reclaim | Dirty Pipe, `/etc/passwd` overwrite |
| ASIS CTF Finals 2025 | [KList](./2025/ASIS_CTF_Finals_2025/Pwn_KList) | solved | Easy (37) | OOB write | kernel memory write | modprobe_path overwrite |
| NexHunt CTF 2025 | [below](./2025/NexHunt_CTF_2025/Pwn_below) | solved / writeup | Easy (12) | OOB read/write | kernel read/write | modprobe_path overwrite |
| N1CTF 2025 | [ktou](./2025/N1CTF_2025/Pwn_ktou) | solved / writeup | Easy (38) | logic flaws | kernel object pointer corruption | GOT overwrite |
| UIUCTF 2025 | [Baby Kernel](./2025/UIUCTF_2025/Pwn_Baby_Kernel) | solved / writeup | Easy (53) | customizable UAF | `tty_struct` ops hijack | modprobe_path overwrite |
| NahamCon CTF 2025 | [The Jumps](./2025/NahamCon_CTF_2025/Pwn_The_Jumps) | solved / writeup | Easy (59) | stack overflow | kernel stack ROP | kernel ROP, `CC(PKC(0))` |
| TCP1P CTF 2024 | [K-Revenge](./2024/TCP1P_CTF_2024/Pwn_K-Revenge) | solved / writeup | Easy (4) | customizable UAF + double free | pipe-based kernel leak + AAW | freelist poisoning => modprobe_path overwrite |
| SECCON Beginners CTF 2024 | [kbuf](./2024/SECCON_Beginners_CTF_2024/Pwn_kbuf) | solved | Easy (8) | uninit heap + OOB R/W + arbitrary seek | OOB leak => AAR/AAW | modprobe_path overwrite |
| L3akCTF 2024 | [xen](./2024/L3akCTF_2024/Pwn_xen) | solved / writeup | Easy (?) | stack buffer overflow | kernel stack RIP control | kernel ROP, `CC(IC)` |
| TCP1P CTF 2023: First Step Beyond Nusantara | [💀](./2023/TCP1P_CTF_2023_First_Step_Beyond_Nusantara/Pwn_💀) | solved / writeup | Easy (5) | arbitrary read/write via unsafe usercopy | AAR/AAW | modprobe_path overwrite |
| corCTF 2023 | [zeroday](./2023/corCTF_2023/Pwn_zeroday) | solved / writeup | Easy (25) | QEMU serial multiplexing misconfiguration (monitor escape) | arbitrary physical memory read | QEMU monitor memory dump |
| SECCON Beginners CTF 2023 | [driver4b](./2023/SECCON_Beginners_CTF_2023/Pwn_driver4b) | solved / writeup | Easy (19) | missing copy_from_user / copy_to_user | AAR/AAW | modprobe_path overwrite / `core_pattern` overwrite |
| Midnight Sun CTF 2023 Quals | [SPD D](./2023/Midnight_Sun_CTF_2023_Quals/Speed_SPD_D) | solved / writeup | Easy (?) | unchecked ppos used as kernel stack buffer offset | kernel stack OOB read/write | saved RIP overwrite => ret2usr => `CC(PKC(0))` |
| ADDA CTF 2022 | [Kernauth](./2022/ADDA_CTF_2022/Pwn_Kernauth) | solved | Easy (11) | TOCTOU race | struct cred overwrite | cred overwrite / `commit_creds()` |
| TSJ CTF 2022 | [clipboard.ko](./2022/TSJ_CTF_2022/Pwn_clipboard.ko) | solved | Easy (11) | kmalloc-1024 UAF | tty_struct overlap + function pointer hijack | modprobe_path overwrite |
| BackdoorCTF 2021 | [babyKernel](./2021/BackdoorCTF_2021/Pwn_babyKernel) | solved | Easy (?) | improper strlen() boundary check | linked-list pointer overwrite | modprobe_path overwrite |
| K3RN3LCTF | [Easy kernel is still kernel right?](./2021/K3RN3LCTF/Pwn_Easy_kernel_is_still_kernel_right) | solved / writeup | Easy (16) | stack leak + stack BOF | canary leak + KASLR leak + kernel ROP | `CC(PKC(0))` + KPTI trampoline |
| 3kCTF-2021 | [echo](./2021/3kCTF-2021/Pwn_echo) | solved / writeup | Easy (9) | unsafe syscall | 8-byte AAR/AAW + physmap leak | modprobe_path overwrite |
| m0leCon CTF 2020 Teaser | [babyk](./2020/m0leCon_CTF_2020_Teaser/Pwn_babyk) | solved / writeup | Easy (20) | stack BOF | saved RIP control | `CC(PKC(0))` + kernel ROP |
| 0xFUN CTF 2026 | [Phantom](./2026/0xFUN_CTF_2026/Pwn_Phantom) | solved / writeup | Easy-Medium (45) | mmap UAF | dangling mmap, freed page reuse | cred overwrite, modprobe_path |
| THJCC CTF 2026 | [Excalipipe](./2026/THJCC_CTF_2026/Pwn_Excalipipe) | solved / writeup | Easy-Medium (17) | allowing reuse of merge flag | page cache overwrite | `/bin/busybox` overwrite |
| PatriotCTF 2025 | [switchboard](./2025/PatriotCTF_2025/Pwn_switchboard) | solved / writeup | Easy-Medium (53) | kmalloc-32 UAF | small-cache reclaim, controlled object reuse | modprobe_path overwrite |
| M*CTF 2025 Quals | [Procrasti nation](./2025/MCTF_2025_Quals/Pwn_Procrasti_nation) | solved | Easy-Medium (4) | UAF + double free + broken custom allocator size confusion | fake entry => AAR / AAW | modprobe_path overwrite |
| LINE CTF 2025 | [Transmit](./2025/LINE_CTF_2025/Pwn_Transmit) | solved | Easy-Medium (10) | trusted user pointer in TRANSMIT_FAST | arbitrary kernel write | modprobe_path overwrite |
| TFC CTF 2025 | [SLOTS](./2025/TFC_CTF_2025/Pwn_SLOTS) | solved / writeup | Easy-Medium (28) | customizable UAF | `tty_struct` ops hijack | read global flag buffer |
| TsukuCTF 2025 | [easy_kernel](./2025/TsukuCTF_2025/Pwn_easy_kernel) | solved / writeup | Easy-Medium (12) | UAF due to dangling global pointer | kmalloc-32 UAF write | seq_operations->start overwrite + `CC(IC)` |
| TsukuCTF 2025 | [xcache](./2025/TsukuCTF_2025/Pwn_xcache) | solved / writeup | Easy-Medium (5) | UAF / double free in a dedicated kmem_cache object | SLUB freelist poisoning to corrupt the global object pointer table | modprobe_path overwrite |
| smileyCTF 2025 | [blargh](./2025/smileyCTF_2025/Pwn_blargh) | solved / writeup | Easy-Medium (38) | 1-byte NULL write into kernel memory | read-only kernel text modification | patch kernel function |
| Codegate CTF 2025 Preliminary | [pew](./2025/Codegate_CTF_2025_Preliminary/Pwn_pew) | solved / writeup | Easy-Medium (13) | kmalloc-4096 UAF | pipe_buffer reclaim | Dirty Pipe, `/etc/passwd` overwrite |
| BackdoorCTF 2024 | [Kuwu](./2024/BackdoorCTF_2024/Pwn_Kuwu) | solved / writeup | Easy-Medium (4) | double free, kmalloc-4096 UAF | msg_msg overlap + pipe_buffer leak | Dirty Pipe, `/etc/passwd` overwrite |
| HKCERT CTF 2024 (Qualifying Round) | [Flipper Hero](./2024/HKCERT_CTF_2024/Pwn_Flipper_Hero) | solved / writeup | Easy-Medium (10) | arbitrary bit flip | arbitrary kernel bit flip | modprobe_path overwrite |
| IERAE CTF 2024 | [free2free](./2024/IERAE_CTF_2024/Pwn_free2free) | solved / writeup | Easy-Medium (2) | double free | heap overlap | Dirty Pipe, `/etc/passwd` overwrite |
| DownUnderCTF 2024 | [Faulty Kernel](./2024/DownUnderCTF_2024/Pwn_Faulty_Kernel) | solved / writeup | Easy-Medium (15) | page cache map/write | pipe_buffer page cache mapping | page cache overwrite (`/etc/passwd`) |
| IrisCTF 2024 | [Memory](./2024/IrisCTF_2024/Pwn_Memory) | writeup | Easy-Medium (42) | kernel-to-user access side-channel via get_user() | timing oracle for secret-dependent userland address access | recover in-kernel flag bytes via page-fault timing side-channel |
| TPCTF 2023 | [core revenge](./2023/TPCTF_2023/Pwn_core_revenge) | solved / writeup | Easy-Medium (11) | kmalloc-64 UAF | pipe-based kernel leak + AAW | add_key + Dirty Pipe-style page cache overwrite of `/bin/busybox`|
| HITCON CTF 2023 Quals | [Full Chain - Wall Rose](./2023/HITCON_CTF_2023_Quals/Pwn_Full_Chain-Wall_Rose) | solved / writeup | Easy-Medium (17) | global pointer double-free | pipe_buffer overlap | Dirty Pipe / init_cred overwrite |
| idekCTF 2022 | [Sofire=good](./2023/idekCTF_2022/Pwn_Sofire=good) | solved / writeup | Easy-Medium (7) | global UAF | ptmx reclaim + stale list R/W | `core_pattern` overwrite |
| TAMUctf 2022 | [Shmeeky](./2022/TAMUctf_2022/Pwn_Shmeeky) | solved / writeup | Easy-Medium (7) | integer overflow in size calculation | OOB read/write via shmvec_get/shmvec_set | modprobe_path overwrite |
| GrabCON CTF 2021 | [Paas](./2021/GrabCON_CTF_2021/Pwn_Paas) | solved / writeup | Easy-Medium (1) | kernel format string | cpu_entry_area leak + pipe capture + AAW | modprobe_path overwrite |
| LINE CTF 2021 | [pprofile](./2021/LINE_CTF_2021/Pwn_pprofile) | solved / writeup | Easy-Medium (7) | put_user misuse | constrained kernel write + oracle leak | modprobe_path overwrite |
| Union CTF 2021 | [nutty](./2021/Union_CTF_2021/Pwn_nutty) | solved / writeup | Easy-Medium (10) | heap OOB read + signed arithmetic overflow | tty_struct leak + heap OOB write | modprobe_path overwrite |
| GACTF2020 | [forest](./2020/GACTF2020/Pwn_forest) | solved | Easy-Medium (1) | customizable UAF + double free | seq_operations reclaim | `CC(PKC(0))` + kernel ROP |
| ASIS CTF Quals 2020 | [Shared House](./2020/ASIS_CTF_Quals_2020/Pwn_Shared_House) | solved / writeup | Easy-Medium (7) | off-by-one NULL | freelist poisoning | modprobe_path overwrite / kernel ROP |
| zer0pts CTF 2020 | [meowmow](./2020/zer0pts_CTF_2020/Pwn_meowmow) | solved / writeup | Easy-Medium (9) | forward OOB R/W | tty_struct leak + fake tty_operations + AAW | modprobe_path overwrite |
| CTF@AC26 Quals | [Event Horizon](./2026/CTF%40AC26-Quals/Pwn_Event_Horizon) | solved | Medium (31) | custom microcode VM bug | custom VM analysis, kernel code execution path | TBD |
| UofTCTF 2026 | [uprobe](./2026/UofTCTF_2026/Pwn_uprobe) | writeup | Medium (14) | SUID uprobe arbitrary byte patch | single-byte code patch (INT3 / 0xcc) | passwd path redirection |
| HeroCTF_v7 | [Safe Device](./2025/HeroCTF_v7/Pwn_Safe_Device) | solved / writeup | Medium (7) | stack overflow | kernel stack ROP | aarch64 kernel ROP, modprobe_path overwrite |
| GlacierCTF 2025 | [Flip Flip Hooray!](./2025/GlacierCTF_2025/Pwn_Flip_Flip_Hooray!) | solved / author writeup | Medium (18) | arbitrary kernel address 1-bit XOR via custom syscall | one-shot blind bit flip => multi-shot by flipping flips_left | modprobe_path overwrite via stable physmap/direct-map alias |
| DownUnderCTF 2025 | [backdoor](./2025/DownUnderCTF_2025/Pwn_backdoor) | solved / writeup | Medium (18) | custom syscall | kbase leak and kernel memory write | modprobe_path overwrite |
| MaltaCTF 2025 Quals | [Write Flag Where](./2025/MaltaCTF_2025_Quals/Pwn_Write_Flag_Where) | solved / writeup | Medium (16) | custom syscall | physical memory write via direct map | call `modify_ldt` |
| D^3CTF 2025 | [d3kheap2](./2025/D^3CTF_2025/Pwn_d3kheap2) | solved / author writeup | Medium (6) | refcount bug / double free | cross-cache overlap with msg_msg and pipe_buffer | DirtyPipe-like `/bin/busybox` page cache overwrite |
| LA CTF 2025 | [messenger](./2025/LA_CTF_2025/Pwn_messenger) | solved / writeup | Medium (10) | 3-byte overflow of msgutil | pipe_buffer page corruption | cred search, cred overwrite |
| IrisCTF 2025 | [Checksumz](./2025/IrisCTF_2025/Pwn_Checksumz) | solved / writeup | Medium (39) | OOB read/write | relative OOB R/W + kernel leak | `core_pattern` overwrite |
| HeroCTF v6 | [Buafllet](./2024/HeroCTF_v6/Pwn_Buafllet) | solved / writeup | Medium (4) | kmalloc-8192 UAF | UAF R/W + AAW | tty struct => modprobe_path / Pipe => Dirty Pipe |
| SCTF 2024 | [kno_puts revenge](./2024/SCTF_2024/Pwn_kno_puts_revenge) | solved / writeup | Medium (20) | race condition / UAF write | userfaultfd race + kmalloc-1024 freelist poisoning, msg_msg leak, tty_struct overlap | fake tty_operations, modprobe_path overwrite |
| PatriotCTF 2024 | [DirtyFetch](./2024/PatriotCTF_2024/Pwn_DirtyFetch) | solved / writeup | Medium (9) | uninitialized stack leak + double-fetch race | canary/KASLR leak + race-won oversized length => kernel stack overflow | kernel ROP, `CC(PKC(0))` |
| cr3 CTF 2024 | [mov-cr3](./2024/cr3_CTF_2024/Pwn_mov-cr3) | solved / writeup | Medium (10) | arbitrary CR3 write | kernel AAR + cross-AS AAR | task->mm->pgd => CR3 pivot |
| bi0sCTF 2024 | [palindromatic](./2024/bi0sCTF_2024/Pwn_palindromatic) | solved / writeup | Medium (5) | OOB + double free | buddy reclaim + pipe_buffer + msg_msg overlap | Dirty Pipe, `/etc/passwd` overwrite |
| BackdoorCTF 2023 | [EmpDB](./2023/BackdoorCTF_2023/Pwn_EmpDB) | solved / writeup | Medium (15) | race UAF | userfaultfd race | modprobe_path overwrite |
| Bauhinia CTF 2023 | [Kernpass](./2023/Bauhinia_CTF_2023/Pwn_Kernpass) | solved / writeup | Medium (10) | race condition leading to customizable UAF | userfaultfd race + CONFIG_SLAB_FREELIST_HARDENED bypass via deterministic heap overlap | kmalloc-32 freelist poisoning => modprobe_path overwrite |
| bi0sCTF 2022 | [k32](./2023/bi0sCTF_2022/Pwn_k32) | solved / writeup | Medium (1) | uninitialized heap read + heap object reuse | heap leak + kernel text leak + RIP control | seq_operations overlap + register spill + stack pivot + `CC(PKC(0))` |
| CrewCTF 2022 | [qKarachter](./2022/CrewCTF_2022/Pwn_qKarachter) | solved / writeup | Medium (6) | state inconsistency + u8 overflow + invalid kfree | double free + overlapping objects | modprobe_path overwrite |
| Securinets CTF Quals 2022 | [xblob](./2022/Securinets_CTF_Quals_2022/Pwn_xblob) | solved / writeup | Medium (4) | TOCTOU open race + UAF | UAF + kernel heap leak + AAW | modprobe_path overwrite |
| zer0pts CTF 2022 | [kRCE](./2022/zer0pts_CTF_2022/Pwn_kRCE) | solved / writeup | Medium (8) | signedness OOB | OOB => AAR/AAW => task traversal => stack leak | `CC(PKC(0))` + KPTI trampoline + userland ROP |
| SUSCTF 2022 | [kqueue's revenge](./2022/SUSCTF_2022/Pwn_kqueue's_revenge) | solved / writeup | Medium (19) | queue UAF | seq_operations leak + userfaultfd reclaim + RIP control | `CC(PKC(0))` kernel ROP |
| hxp CTF 2021 | [日本旅行](./2021/hxp_CTF_2021/Pwn_日本旅行) | writeup | Medium (4) | double PTRACE_SYSCALL / ptrace state desync | syscall path-filter bypass | unchecked openat("/flag.txt") + sendfile |
| Hack.lu CTF 2021 | [Stonks Socket](./2021/Hack.lu_CTF_2021/Pwn_Stonks_Socket) | writeup | Medium (12) | UAF race on sk_user_data | kernel RIP control via freed 32-byte object / function pointer call | userland shellcode => `CC(PKC(0))` |
| ASIS CTF Quals 2021 | [Mini memo](./2021/ASIS_CTF_Quals_2021/Pwn_Mini_memo) | solved / writeup | Medium (16) | partial heap OOB (3-byte) | msg_msg overlap => pipe_buffer leak => freelist poisoning | modprobe_path overwrite |
| TSG CTF 2021 | [lkgit](./2021/TSG_CTF_2021/Pwn_lkgit) | solved / writeup | Medium (7) | duplicate-hash race UAF | userfaultfd race + kmalloc-32 UAF write / seq_operations leak | modprobe_path overwrite |
| Circle City Con CTF 2021 | [sockcamp](./2021/Circle_City_Con_CTF_2021/Pwn_sockcamp) | solved / writeup | Medium (3) | single-bit flip in task_struct | thread flag corruption (TIF_SECCOMP) | inject shellcode => `CC(PKC(0))` |
| 3kCTF-2021 | [klibrary](./2021/3kCTF-2021/Pwn_klibrary) | solved / writeup | Medium (2) | race-based UAF | userfaultfd + tty_struct overlap | tty_ops hijack + modprobe_path overwrite |
| Midnight Sun CTF 2021 Quals | [Brohammer](./2021/Midnight_Sun_CTF_2021_Quals/Pwn_Brohammer) | solved / writeup | Medium (18) | arbitrary 1-bit kernel write | physmap PTE permission flip | `CC(PKC(0))` |
| DiceCTF 2021 | [hashbrown](./2021/DiceCTF_2021/Pwn_hashbrown) | solved / writeup | Medium (7) | resize race + value UAF | userfaultfd race + pipe_buffer UAF read/write | `/bin/busybox` page cache overwrite |
| HITCON CTF 2020 | [atoms](./2020/HITCON_CTF_2020/Pwn_atoms) | solved / writeup | Medium (17) | missing vm_open() refcount bug | fork()+munmap() UAF + msg_msg reclaim | lock corruption => watchdog-triggered flag output |
| GACTF2020 | [easy_kernel](./2020/GACTF2020/Pwn_easy_kernel) | solved / writeup | Medium (2) | UAF + stack OOB R/W | tcache poisoning + stack leak + stack BOF | .fini hijack => kernel ROP |
| InCTF 2020 | [lab9](./2020/InCTF_2020/Pwn_lab9) | solved | Medium (5) | heap OOB XOR write | freelist poisoning + tty_struct overlap | modprobe_path overwrite |
| TRX CTF 2026 | [krwd](./2026/TRX_CTF_2026/Pwn_krwd) | writeup | Medium-High (15) | deferred user pointer in delayed_work | cross-mm usercopy via kworker active_mm | BusyBox modprobe FSOP |
| THJCC CTF 2026 | [僕と契約して、魔法少女になってよ！](./2026/THJCC_CTF_2026/Pwn_僕と契約して、魔法少女になってよ！) | solved / writeup | Medium-High (3) | single-byte OOB overwrite | `struct file` corruption | `struct file->f_mode` overwrite |
| UofTCTF 2026 | [extended-eBPF](./2026/UofTCTF_2026/Pwn_extended-eBPF) | writeup | Medium-High (39) | eBPF variable-shift range confusion | map value OOB R/W | modprobe_path overwrite |
| BackdoorCTF 2025 | [skernel](./2025/BackdoorCTF_2025/Pwn_skernel) | writeup | Medium-High (5) | kmalloc-64 UAF | race-assisted OOB leak/write | kernel ROP, `commit_creds(&init_cred)` |
| BackdoorCTF 2025 | [vibe-kode](./2025/BackdoorCTF_2025/Pwn_vibe-kode) | writeup | Medium-High (4) | workqueue UAF race | FUSE-assisted kmalloc-4k UAF write | dirty pagetable + TSS I/O bitmap abuse + QEMU fw_cfg physical write |
| CrewCTF 2025 | [barelyontime](./2025/CrewCTF_2025/Pwn_barelyontime) | writeup | Medium-High (3) | logic bug, UAF | UFFD-assisted UAF race | kernel text overwrite |
| corCTF 2025 | [zenerational-aura](./2025/corCTF_2025/Pwn_zenerational-aura) | solved / writeup | Medium-High (5) | crash syscall | KASLR bypass via prefetch | kernel panic log oracle |
| Full Weak Engineer CTF 2025 | [cknote](./2025/Full_Weak_Engineer_CTF_2025/Pwn_cknote) | solved / writeup | Medium-High (2) | kmalloc-32 UAF | UAF read/write, freelist manipulation | cred overwrite |
| DownUnderCTF 2025 | [Rolling Around](./2025/DownUnderCTF_2025/Pwn_Rolling_Around) | solved / writeup | Medium-High (4) | custom eBPF ALU verifier bug | eBPF stack OOB + AAR/AAW | modprobe_path overwrite |
| MaltaCTF 2025 Quals | [secure-dwarf](./2025/MaltaCTF_2025_Quals/Pwn_secure-dwarf) | solved / writeup | Medium-High (8) | custom DWARF bytecode | AAR primitive | read flag in kernel memory |
| TsukuCTF 2025 | [new_era](./2025/TsukuCTF_2025/Pwn_new_era) | solved / writeup | Medium-High (4) | 1-byte NULL overflow in kmalloc-1k object | pipe_buffer->page LSB overwrite + PageJack page UAF | `struct file->f_mode` overwrite => `/etc/passwd` overwrite |
| DiceCTF 2025 Quals | [oboe](./2025/DiceCTF_2025_Quals/Pwn_oboe) | writeup | Medium-High (16) | single-byte OOB overwrite | refcount overwrite | kernel ROP, `commit_creds(&init_cred)` |
| KalmarCTF 2025 | [decore](./2025/KalmarCTF_2025/Pwn_decore) | writeup | Medium-High (10) | executable path in `core_pattern` | race condition | replace target file with symlink |
| TRX CTF 2025 | [/dev/mem](./2025/TRX_CTF_2025/Pwn_dev_mem) | solved / writeup | Medium-High (4) | `/dev/mem` access | KASLR bypass, physical memory R/W | task list traversal, cred overwrite |
| HITCON CTF 2024 Quals | [Seccomp Hell](./2024/HITCON_CTF_2024_Quals/Pwn_Seccomp_Hell) | writeup | Medium-High (15) | hidden backdoor / intended kernel interface | CPL3=>CPL0 via LDT call gate | manual cred + seccomp patch |
| Codegate CTF 2024 Preliminary | [PhysicalTest](./2024/Codegate_CTF_2024_Preliminary/Pwn_PhysicalTest) | writeup | Medium-High (?) | global backing_vma misuse / wrong VMA zap | stale mmap mapping to freed physical pages | fops hijack => stack pivot => kernel ROP => `CC(IC)` |
| KalmarCTF 2024 | [msrable](./2024/KalmarCTF_2024/Pwn_msrable) | solved / writeup | Medium-High (9) | MSR exposure | LSTAR leak + FMASK abuse + entry hijack | CR4 disable => `CC(IC)` => KPTI return |
| KalmarCTF 2024 | [Maestro](./2024/KalmarCTF_2024/Pwn_Maestro) | writeup | Medium-High (11) | uncleared DF in syscall / kernel mmap overwrite | kernel EIP control | zero-page shellcode or mmap-based kernel memory overwrite |
| N1CTF 2023 | [n1sub](./2023/N1CTF_2023/Pwn_n1sub) | writeup | Medium-High (4) | UAF with dangling pointer / broken slot management | fixed-offset 4-byte decrement on reclaimed `pipe_buffer->flags` | pipe_buffer reclaim => Dirty Pipe-style page cache overwrite of `/bin/busybox` |
| SECCON CTF 2023 Quals | [umemo](./2023/SECCON_CTF_2023_Quals/Pwn_umemo) / [kmemo](./2023/SECCON_CTF_2023_Quals/Pwn_kmemo) | solved / writeup | Medium-High (20/5) | UAF + mmap ownership corruption | object reuse => AAR / AAW | modprobe_path overwrite |
| zer0pts CTF 2023 | [flipper](./2023/zer0pts_CTF_2023/Pwn_flipper) | solved / writeup | Medium-High (5) | OOB 1-bit flip | single-bit heap corruption | cred capability bit flip / file refcount corruption |
| UIUCTF 2023 | [Zapping a Setuid (1/2)](./2023/UIUCTF_2023) | writeup | Medium-High (?) | SUID / namespace abuse | SUID binary relocation + library hijack / Cross-namespace mount graft + SUID preservation | loader hijack / mount-tree SUID bypass |
| HITCON CTF 2022 | [⛓️ Fourchain - Kernel](./2022/HITCON_CTF_2022/Pwn_Fourchain-Kernel) | writeup | Medium-High (12) | race / UAF | userfaultfd + UAF => msg_msg / pipe_buffer / sk_buff | DirtyCred / kernel ROP |
| SECCON CTF 2022 Quals | [babypf](./2022/SECCON_CTF_2022_Quals/Pwn_babypf) | solved / writeup | Medium-High (10) | eBPF shift range verifier bug | eBPF stack corruption + AAR/AAW | modprobe_path overwrite |
| DownUnderCTF 2022 | [just-in-kernel](./2022/DownUnderCTF_2022/Pwn_just-in-kernel) | writeup | Medium-High (11) | custom VM/JIT instruction-boundary bypass | JIT immediate shellcode + stack pivot | kernel ROP + `CC(PKC(0))` |
| LINE CTF 2022 | [ecrypt (fixed)](./2022/LINE_CTF_2022/Pwn_ecrypt%20%28fixed%29) | solved / writeup | Medium-High (7) | broken mmap() + kernel pointer exposure | key_ptr overwrite + crypto oracle + AAW | direct cred overwrite |
| hxp CTF 2021 | [trusty user diary](./2021/hxp_CTF_2021/Pwn_trusty_user_diary) | solved / writeup | Medium-High (8) | missing FOLL_WRITE in GUP | pinned page write / COW bypass | page cache corruption => busybox shellcode injection |
| SECCON CTF 2021 | [kone_gadget](./2021/SECCON_CTF_2021/Pwn_kone_gadget) | writeup | Medium-High (5) | backdoored syscall (RIP control + RSP=0) | seccomp JIT + CR4 SMEP/SMAP bypass | stack pivot + `CC(PKC(0))` / panic dump via `jmp flag.txt` |
| pbctf 2021 | [Nightclub](./2021/pbctf_2021/Pwn_Nightclub) | solved / writeup | Medium-High (8) | NULL-terminated heap OOB | msg_msg m_ts corruption + heap leak + SLUB freelist corruption | modprobe_path overwrite |
| InCTF 2021 | [MultiStorage](./2021/InCTF_2021/Pwn_MultiStorage) | solved / writeup | Medium-High (1) | TOCTOU race + heap OOB write | page-cross heap overflow + heap feng shui | cred overwrite |
| Google Capture The Flag 2021 | [EBPF](./2021/Google_Capture_The_Flag_2021/Pwn_EBPF) | writeup | Medium-High (20) | eBPF verifier type confusion | forged PTR_TO_MAP_VALUE => AAR/AAW | modprobe_path overwrite |
| Pwn2Win CTF 2021 | [Accessing the Truth](./2021/Pwn2Win_CTF_2021/Pwn_Accessing_the_Truth) | writeup | Medium-High (8) | UEFI password stack overflow | RIP control in UEFI context | UEFI shellcode reads initramfs.cpio and scans flag |
| hxp CTF 2020 | [kernel-rop](./2020/hxp_CTF_2020/Pwn_kernel-rop) | solved / writeup | Medium-High (4) | stack leak + stack BOF | stack leak => kernel ROP | FG-KASLR => ksymtab => `CC(IC)` |
| SECCON 2020 Online CTF | [kstack](./2020/SECCON_2020_Online_CTF/Pwn_kstack) | solved / writeup | Medium-High (4) | race double free | UFFD heap reuse + seq_operations leak + AAW | seq_operations pivot + `CC(PKC(0))` ROP |
| HITCON CTF 2020 | [spark](./2020/HITCON_CTF_2020/Pwn_spark) | writeup | Medium-High (10) | UAF by missing node refcount on graph link | fake spark_node reclaim => OOB distance-array read/write | cred overwrite via spark_graph_query() |
| TastelessCTF 2020 | [yaknote](./2020/TastelessCTF_2020/Pwn_yaknote) | solved | Medium-High (1) | OOB index (signed/unsigned) | type confusion => AAR/AAW | modprobe_path overwrite |
| Pwn2Win CTF 2020 | [Trusted Node](./2020/Pwn2Win_CTF_2020/Pwn_Trusted_Node) | writeup | Medium-High (12) | TA command interface / function-pointer disclosure / client-side misuse | TA code pointer leak + hidden function invocation | use leaked TA address to call get_secret through android_get_increment |
| KalmarCTF 2026 | [faulty](./2026/KalmarCTF_2026/Pwn_faulty) | under analysis / TBD | High (2) | race condition (TOCTOU) | TBD | TBD |
| tkbctf5 | [Hungry Goats](./2026/tkbctf5/Pwn_Hungry_Goats) | writeup | High (1) | sk_buff data_len corruption | controlled `put_page()` => page UAF | page UAF overlap => cred overwrite |
| DiceCTF 2026 Quals | [cornelslop](./2026/DiceCTF_2026_Quals/Pwn_cornelslop) | writeup | High (6) | RCU UAF race | RCU callback hijack | cross-cache pipe reclaim + IOPL fw_cfg initrd dump |
| WannaGame Championship 2025 | [Johnny Sins](./2025/WannaGame_Championship_2025/Pwn_Johnny_Sins) | writeup | High (2) | pipe_buffer page UAF via tee/link_pipe off-by-one | page UAF | ret2pt_regs via fake file_operations |
| N1CTF 2025 | [N1khash](./2025/N1CTF_2025/Pwn_N1khash) | writeup | High (7) | delayed work UAF | control-flow hijack + stack pivot | UAF reclaim + ROP + modprobe_path overwrite |
| ASIS CTF Quals 2025 | [File No!](./2025/ASIS_CTF_Quals_2025/Pwn_File_No!) | writeup | High (8) | file->private_data R/W for regular files | seq_file private_data leak/hijack via procfs regular file | fake seq_file + seq_operations hijack + stack pivot ROP |
| ToH CTF 2025 | [kRWX](./2025/ToH_CTF_2025/Pwn_kRWX) | solved / author writeup | High (0) | arbitrary function pointer overwrite | LKM text leak + KCFI-checked one-shot indirect call | KCFI-compatible seccomp BPF JIT code execution |
| bi0sCTF 2025 | [Kernel-Mailinglists](./2025/bi0sCTF_2025/Pwn_Kernel-Mailinglists) | writeup | High (1) | uninitialized lhead in broadcast mail | unlink pointer write + kernel heap leak | cross-cache reclaim into cred_jar and cred field nullification |
| D^3CTF 2025 | [d3kshrm](./2025/D^3CTF_2025/Pwn_d3kshrm) | author writeup | High (1) | OOB page mapping in mmap fault handler | OOB struct page pointer mapping / read-only file page remap as RW | DirtyPage-like read-only file overwrite via pipe_buffer + splice |
| KalmarCTF 2025 | [Maestro Revenge](./2025/KalmarCTF_2025/Pwn_Maestro_Revenge) | writeup | High (4) | missing userspace stack validation in signal delivery | kernel memory overwrite | AccessProfile overwrite / privilege bypass |
| PwnMe CTF Quals 2025 | [Hidden Key Recovery](./2025/PwnMe_CTF_Quals_2025/Pwn_Hidden_Key_Recovery) | under analysis / TBD | High (6) | SMM secret + DMA write | physical write-what-where (TBD) | SMM code patch / password-check bypass (TBD) |
| N1CTF 2024 | [heap_master](./2024/N1CTF_2024/Pwn_heap_master) | writeup | High (7) | UAF / stale pointer after kfree | Cross-cache UAF on struct file / PTE corruption | DirtyPage-style PTE hijack, DMA-BUF assisted physical memory access, kernel text patch, nsjail escape |
| idekCTF 2024 | [kernel module golf](./2024/idekCTF_2024/Pwn_kernel_module_golf) | writeup | High (1) | unprivileged load_module() exposure | msg_msg heap grooming + forged ELF relocations | 345-byte ELF module golf => module->init hijack => commit_creds(init_cred) |
| UIUCTF 2024 | [Syscalls 2](./2024/UIUCTF_2024/Pwn_Syscalls_2) | writeup | High (8) | kernel logic / policy bypass | I/O via io_uring without normal fd allocation | io_uring-based flag read / FD creation restriction bypass |
| L3HCTF 2024 | [kpid](./2024/L3HCTF_2024/Pwn_kpid) | writeup | High (1) | `find_vpid()` reference-count misuse / `put_pid()` without `get_pid()` | `struct pid` UAF + refcount increment primitive | Dirty Pagetable + DMA-BUF arbitrary physical memory R/W |
| m0leCon CTF 2023 Finals | [keasy](./2023/m0leCon_CTF_2023_Finals/Pwn_keasy) | writeup | High (?) | struct file UAF with a dangling FD caused by calling fput() after fd_install() | cross-cache the freed files_cache slab page into a PTE page, then use dup() and DMA-BUF Heap to gain arbitrary physical read/write | overwrite do_symlinkat() with kernel shellcode to gain root privileges, switch namespaces, replace current->fs, and escape nsjail |
| Azure Assassin Alliance CTF 2023 | [easy netlink](./2023/Azure_Assassin_Alliance_CTF_2023/Pwn_easy_netlink) | under analysis / TBD | High (2) | undersized LZO output buffer in ADD_MSG; additionally, unlocked object lookups allow Type/Title race-condition UAFs (TBD) | ariable-size kmalloc heap overflow, or kmalloc-256/kmalloc-512 UAF (TBD) | not determinable from bbs.ko alone; likely heap spraying and adjacent-object corruption using the LZO overflow, followed by a kernel pointer leak and control-flow or data-only privilege escalation (TBD) |
| TeamItaly CTF 2023 | [kSMS - Secure Message Storage](./2023/TeamItaly_CTF_2023/Pwn_kSMS-Secure_Message_Storage) | author writeup | High (0) | Out-of-bounds read and UAF in the kernel module | information disclosure (KASLR/heap leak) and arbitrary function call | bypassing kCFI by spoofing struct subprocess_info to trigger root command execution |
| hxp CTF 2022 | [one_byte](./2023/hxp_CTF_2022/Pwn_one_byte) | author writeup | High (5) | 1-byte arbitrary kernel write | one-shot 1-byte write-what-where | LDT call gate => ring0 shellcode |
| N1CTF 2022 | [Babyuefi](./2022/N1CTF_2022/Pwn_Babyuefi) | writeup | High (5) | UEFI UiApp stack OOB / uninitialized length | stack leak + stack overwrite | UEFI boot option hijack to root shell |
| N1CTF 2022 | [File](./2022/N1CTF_2022/Pwn_File) | under analysis / TBD | High (1) | struct file refcount bug | struct file UAF / dangling fd | DirtyCred-style struct file replacement |
| N1CTF 2022 | [Praymoon](./2022/N1CTF_2022/Pwn_Praymoon) | writeup | High (0) | kmalloc-512 double free | user_key_payload OOB read / setxattr + userfaultfd reclaim | AF_PACKET pg_vec USMA text patch |
| corCTF 2022 | [Cache of Castaways](./2022/corCTF_2022/Pwn_Cache_of_Castaways) | writeup | High (2) | 6-byte OOB write in isolated slab cache | cross-cache overflow | leakless cred->uid overwrite via buddy allocator feng shui |
| Azure Assassin Alliance CTF 2022 | [kkk](./2022/Azure_Assassin_Alliance_CTF_2022/Pwn_kkk) | under analysis / TBD | High (4) | parser logic bug | hidden IOCTL reach (TBD) | kernel heap corruption (TBD) |
| pbctf 2021 | [Access Key](./2021/pbctf_2021/Pwn_Access_Key) | under analysis / TBD | High (1) | 8-bit refcount overflow | UAF-style kmalloc-64 heap overlap (TBD) | Secret bypass => controlled kernel function call (TBD) |
| corCTF 2021 | [Fire of Salvation](./2021/corCTF_2021/Pwn_Fire_of_Salvation) | author writeup | High (0) | duplicated rule shallow copy UAF | kmalloc-4k UAF + msg_msg AAR/AAW + UFFD-assisted AAW | task_struct walk + current->cred / real_cred overwrite with init_cred |
| corCTF 2021 | [Wall of Perdition](./2021/corCTF_2021/Pwn_Wall_of_Perdition) | author writeup | High (0) | duplicated firewall rule UAF | kmalloc-64 UAF + msg_msg AAR + pipe_buffer RIP + FG-KASLR bypass | RetSpill ROP + __ksymtab symbol resolution + `CC(PKC(0))` |
| TRX CTF 2026 | [🍼🤏🤏 revenge](./2026/TRX_CTF_2026/Pwn_🍼🤏🤏_revenge) | writeup | Very-High (1) | per-CPU stack pointer corruption | per-CPU stack pivot | FSGSBASE + SWAPGS stack pivot |
| WannaGame Championship 2025 | [Matrix](./2025/WannaGame_Championship_2025/Pwn_Matrix) | author writeup | Very-High (0) | eBPF verifier range bug | BPF stack pointer corruption => AAR/AAW | current cred replacement via init_task |
| TRX CTF 2025 | [🍼🤏](./2025/TRX_CTF_2025/Pwn_🍼🤏) | author writeup | Very-High (0) | unrestricted `wrmsr` ioctl | arbitrary MSR write | fake syscall GS / fake kernel stack + kernel ROP |
| m0leCon CTF 2024 Teaser | [🍼 One dream 🍼](./2024/m0leCon_CTF_2024_Teaser/Pwn_One_dream) | under analysis / TBD | Very-High (0) | one-shot arbitrary low-byte text patch | repeatable byte patch via LKM self-patching (TBD) | ARM64 kernel/LKM text self-modification (TBD) |
| HITCON CTF 2024 Quals | [Halloween](./2024/HITCON_CTF_2024_Quals/Pwn_Halloween) | author writeup | Very-High (1) | auth bypass + malformed write state corruption + shared grip race | OOB read/leak + jump-table OOB RIP control | kernel ROP via jump-table OOB => send_to_socket(flag) |
| KalmarCTF 2023 | [hyper-k](./2023/KalmarCTF_2023/Pwn_hyper-k) | under analysis / TBD | Very-High (1) | EPT management bug / guest-accessible hypervisor memory via GPA namespace confusion | writable EPT paging structures / guest-controlled second-stage translation (TBD) | VMFUNC/EPTP switching abuse => host physical memory AAR/AAW (TBD) |
| WMCTF2022 | [Ubuntu-rev](./2022/WMCTF2022/Pwn_Ubuntu-rev) | under analysis / TBD | Very-High (0) | nf_tables set element validation bug inspired by CVE-2022-1972 | stack or kernel memory OOB write via crafted nftables netlink messages (TBD) | TBD |

Note: `CC(PKC(0))` means `commit_creds(prepare_kernel_cred(0))`.

`CC(IC)` means `commit_creds(&init_cred)`.

## Techniques Covered

- QEMU-based kernel exploit testing
- LKM reverse engineering
- Use-After-Free
- stack overflow
- kernel ROP
- KPTI trampoline
- ret2usr
- KASLR bypass
- FG-KASLR bypass
- __ksymtab symbol resolution
- SMEP / SMAP bypass
- modprobe_path overwrite
- core_pattern abuse
- freelist poisoning
- cred overwrite
- race condition exploitation
- userfaultfd-assisted exploitation
- FUSE page-fault blocking
- custom syscall abuse
- custom VM / bytecode bugs
- kmalloc cache reclaim
- tty_struct hijacking
- pipe_buffer reclaim
- Dirty Pipe style exploitation
- msg_msg spraying
- seq_operations overlap
- sk_buff exploitation
- arbitrary read/write
- page cache overwrite
- kernel text overwrite
- mmap-based dangling mapping
- eBPF verifier / eBPF VM exploitation
- DWARF bytecode VM exploitation
- /dev/mem exploitation
- ret2pt_regs
- RCU UAF exploitation
- MSR abuse
- io_uring abuse
- CR3 / page table manipulation
- EPT / second-stage translation abuse
- DirtyCred
- LDT / call gate exploitation
- UEFI exploitation
- COW bypass
- seccomp JIT abuse
- hypervisor exploitation

## Build and Run

Most exploits are intended to be compiled statically and executed inside the provided QEMU/initramfs environments.

Example:

```bash
gcc exp01.c -o exp01 -static
```

```bash
musl-gcc exp01.c -o exp01 -static
```

## Exploit Verification Note

Exploit code in this repository is mainly intended for local CTF/QEMU environments.

Unless explicitly stated otherwise, exploits authored or modified in this repository were primarily tested locally against the provided challenge environment.
They are not guaranteed to work on the original remote servers, patched challenge instances, different kernel builds, or different runtime configurations.

Remote services may use different kernels, mitigations, time limits, file systems, network wrappers, or deployment settings.
Some exploits may require adjustment, stabilization, or additional environment-specific tuning.

本リポジトリ内の exploit code は、主にローカルの CTF/QEMU 環境での検証を目的としています。

特に明記していない限り、本リポジトリで作成・修正した exploit は、配布された challenge 環境に対してローカルでの動作確認を中心に行っています。
元の remote server、修正後の challenge instance、異なる kernel build、異なる実行環境での動作は保証していません。

remote 環境では kernel、mitigation、time limit、filesystem、network wrapper、deployment 設定などが異なる場合があり、追加の調整・安定化・環境依存の修正が必要になることがあります。

## Large Files Policy

Large distribution files such as rootfs images, disk images, VM images, or archives may be omitted from this repository when they exceed GitHub's normal file size limit.
In such cases, only the minimum files required for analysis are included, and an external download link or a note about the original distribution is provided when available.

GitHub の通常のファイルサイズ上限を超える大きな配布ファイルについては、本リポジトリに直接含めない場合があります。
その場合は、解析に必要な最小限のファイルのみを配置し、可能であれば外部リンクまたは元配布ファイルに関するメモを記載します。

## Challenge Template

- `README.md` — metadata and short summary
- `distribution/` — original challenge files
- `exploit/` — exploit source code and helper scripts, if available
- `writeup/` — original writeups, notes, and external references

Original challenge files are preserved for archival and analysis purposes.
Some files may be intentionally vulnerable or unsafe to run outside isolated CTF/QEMU environments.

配布ファイルはアーカイブおよび解析目的で、可能な限り元の状態に近い形で保存しています。
一部のファイルは意図的に脆弱または危険な挙動を含むため、隔離された CTF/QEMU 環境以外では実行しないでください。

## References

- [Learning Linux Kernel Exploitation - Part 1](https://lkmidas.github.io/posts/20210123-linux-kernel-pwn-part-1/)
- [Learning Linux Kernel Exploitation - Part 2](https://lkmidas.github.io/posts/20210128-linux-kernel-pwn-part-2/)
- [Learning Linux Kernel Exploitation - Part 3](https://lkmidas.github.io/posts/20210205-linux-kernel-pwn-part-3/)
- [Pawnyable - Linux Kernel Exploitation](https://pawnyable.cafe/linux-kernel/)
- [Kernel Exploitで使える構造体集](https://ptr-yudai.hatenablog.com/entry/2020/03/16/165628)

## Acknowledgements

I would like to express my sincere gratitude to all CTF challenge authors who created these excellent kernel exploitation challenges.

Many of the techniques, exploit strategies, and implementation details in this repository were learned from public writeups, author writeups, and shared research notes.
I deeply appreciate the authors of those writeups for documenting their approaches and making their knowledge available to the community.

This repository is intended as a personal learning archive and technical index.
All credit for the original challenges belongs to the respective CTF organizers and challenge authors.
All credit for referenced writeups belongs to their original authors.

## 謝辞

素晴らしい Kernel Exploit 問題を作成してくださった CTF 運営・問題作者の皆様に深く感謝します。

本リポジトリに含まれる多くの技術、exploit 方針、実装上の知見は、公開 writeup、author writeup、各種技術メモから多くを学んだものです。
解法や考察を公開し、知識を共有してくださった writeup 作者の皆様にも心より感謝します。

本リポジトリは、個人の学習記録および技術索引として整理しているものです。
各 CTF 問題の権利とクレジットは、それぞれの CTF 運営・問題作者に帰属します。
参照した writeup のクレジットは、それぞれの原著者に帰属します。

Kernel-Exploit-Dojo

Kernel-Exploit-Dojo Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Kernel-Exploit-Dojo

Kernel-Exploit-Dojo Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README