Fep Blog πŸ”¬
blog / tags / modules / projects /
Pwn
  • Stack
    • Stack Pivoting to ROP
  • Heap (from how2heap)
    • Foundations
      • Overview: Chunk Anatomy
      • Heap Vulnerability Cheatsheet
      • First-Fit Algorithm
      • T-Cache Index Calculation
      • Decrypting Safe-Linking
      • Safe-Linking Double Protection Bypass
    • Tcache Attacks
      • Tcache Poisoning
      • Tcache House of Spirit
      • Tcache Metadata Poisoning
      • House of Io
      • House of Water
    • Fastbin Attacks
      • Fastbin Double-Free
      • Fastbin Dup into Stack
      • Fastbin Dup with malloc_consolidate
      • House of Spirit
    • Unsorted Bin Attacks
      • Unsorted Bin Attack
      • Unsorted Bin into Stack
      • Unsafe Unlink
    • Small & Large Bin Attacks
      • House of Lore
      • Large Bin Attack
    • Stashing & Hybrid Attacks
      • Tcache Stashing Unlink Attack
      • Fastbin Reverse into Tcache
      • House of Storm
    • Consolidation & Overlap
      • Overlapping Chunks
      • Overlapping Chunks (Consolidation)
      • Poison Null Byte
      • House of Einherjar
      • mmap Overlapping Chunks
    • Top Chunk Attacks
      • House of Force
      • sysmalloc: _int_free on Top Chunk
      • House of Orange
      • House of Tangerine
    • Arena & Metadata Hijacking
      • House of Mind
      • House of Gods
    • Advanced & Leakless
      • House of Roman
  • FSOP
    • Overview
    • Arbitrary Read
    • Arbitrary Write
    • Hijacking Control Flow
    • Overlapping Structures
    • Hijacking with Argument
  • Sandboxing
    • Sandboxing Overview
    • Chroot without chdir
    • Escaping via Pre-opened File Descriptor
    • Chdir('/') after chroot
    • Bypassing flag-string check with openat
    • Bypassing chroot with linkat
    • Chroot Escape via fchdir
    • Classic Chroot Escape
    • Chroot Escape via openat and ..
    • Cross-Arch Syscall Confusion
    • Side-Channel Leak via Exit Code
    • Sandbox Bypass via Parent-Child IPC
    • Mount Namespace and pivot_root Escape
    • Mount Namespace Escape via Procfs
    • Mount Namespace Escape via Pre-mounted Procfs
    • Mount Namespace Escape via FD Leak
    • Mount Namespace Escape via Manual Procfs Mount
  • Kernel
    • Environment Setup
    • Device Driver Lifecycle
    • IOCTL Interaction
    • Proc Filesystem Interaction
    • Secret Procfs Challenge
    • Procfs Rooting Challenge
    • Procfs Dmesg Challenge
    • Procfs Overflow Challenge
    • Procfs Ioctl Challenge
    • Procfs Indirect Call Challenge
    • Procfs Shellcode Challenge
    • Procfs Ioctl Struct Challenge
  • Pwn Cheatsheet
Back to Modules
Table of Contents
  • Kernel

Kernel

β€œKernel exploitation involves exploiting vulnerabilities in the operating system kernel, providing the highest level of privilege on a system. This section covers the setup of testing environments and common kernel-space exploitation techniques.”

Mount Namespace Escape via Manual Procfs Mount
Environment Setup
Table of Contents
  • Kernel
© 2026 β€’ Fep Blog πŸ”¬
Press Esc or click anywhere to close