kernel-exploitation

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). This repository is an explicit, actionable kernel exploitation playbook describing privilege escalation (commit_creds, modprobe_path), kernel ROP, mitigation bypasses (CR4 flip/SMEP, KPTI trampoline), heap spraying and cross-cache UAF techniques — clearly intended to achieve unauthorized root/kernel code execution and data access.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The SKILL.md includes a runtime setup command that downloads and builds remote kernel source (wget https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.1.tar.xz), which fetches and results in execution of external code as part of the skill's required environment setup.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill provides step-by-step, actionable instructions to bypass kernel mitigations and perform local privilege escalation (commit_creds, modprobe_path overwrite, initramfs modification, kernel ROP), which directly instructs compromising the host machine's state.