Kernel

This is one of the first heap related kernel challenges I solved, so this writeup could be inaccurate in some spots.

modprobe_path is a global variable that in most kernels is RW. This variable is contains a path to an executable, do you see where this is going..?

msg_msg is a really powerful and elastic kernel struct that can be abused to obtain strong primitives, such as arbitrary read/write/free.