kernel-exploit

name	Kernel Exploit
description	Kernel-mode exploitation — drivers, syscalls, privilege escalation
tags	["kernel","exploit","privilege-escalation","driver","syscall"]

Task: Kernel Exploit Development. Exploit kernel vulnerabilities for privilege escalation.

Approach

Kernel exploitation requires understanding kernel internals. Focus on: driver vulnerabilities, syscall bugs, race conditions.

Phase 1: Attack Surface

Kernel Drivers

• list_imports → Look for: ZwOpenEvent, ZwOpenSection, MmCopyMemory
• search_strings → Device names: \Device*, \DosDevices*
• Identify: IOCTL handlers, device I/O methods
• Check: User-kernel boundary APIs

System Calls

• Find: syscall table entries
• Check: Custom syscall implementations
• Look for: Weak argument validation
• Identify: Unchecked copy operations

Kernel Objects

• Target: Process objects (EPROCESS), tokens, file objects
• Look for: Object management functions
• Check: Reference counting bugs
• Find: Type confusion vulnerabilities

Phase 2: Vulnerability Classes

Stack Buffer Overflow (Kernel)

• Pattern: char buffer[128]; memcpy(buffer, user_buf, user_size);
• Location: IOCTL handlers, syscall implementations
• Impact: Kernel code execution, system compromise
• Bypass: SMEP, SMAP, KPTI

Heap Overflow (Kernel)

• Pattern: pool = ExAllocatePoolWithTag(size); copy(...)
• Target: Pool allocation, object corruption
• Look for: Tag overallocation, overflow size
• Exploit: Overwrite adjacent kernel objects

Use-After-Free (Kernel)

• Pattern: ObDereferenceObject(obj); ... obj->method();
• Location: Driver cleanup, object lifetime management
• Exploit: Reallocate with controlled data
• Target: Function pointers, vtables in kernel objects

Race Condition (TOCTOU)

• Pattern: Check time → use time gap
• Target: Multi-threaded kernel operations
• Look for: Non-atomic checks, lock-free code
• Exploit: Win race to corrupt kernel state

Integer Overflow (Kernel)

• Pattern: size = user_count * sizeof(struct)
• Location: Allocation size calculations
• Exploit: Wraparound → small alloc, large copy
• Impact: Pool overflow, arbitrary write

Type Confusion (Kernel)

• Pattern: Cast between incompatible object types
• Look for: Unsafe type conversions
• Exploit: Treat object A as object B
• Impact: Vtable hijack, arbitrary function call

Missing Validation (Kernel)

• Pattern: No checks on user input
• Location: IOCTL handlers, syscalls
• Exploit: Pass malicious structures
• Impact: Information leak, privilege escalation

Phase 3: Information Disclosure

Kernel Address Leak

Targets:
- Kernel base address (ntoskrnl.exe)
- Driver base addresses
- Kernel heap addresses
- Function pointers in kernel objects

Methods:
1. Uninitialized kernel memory
2. Info leak vulnerabilities
3. Kernel heap spraying
4. Symbolic link attacks

Bypass KASLR

1. Pool spraying for predictable allocations
2. Exploit info leaks to find kernel base
3. Use fixed offsets from known locations
4. Guess non-randomized components

Phase 4: Exploit Techniques

Token Privilege Escalation

1. Find current process EPROCESS
2. Locate token field in EPROCESS
3. Copy SYSTEM token to current process
4. Trigger: Create cmd.exe as SYSTEM

Offset (Windows 10 x64):
Token = EPROCESS + 0x208 (version-dependent)

Arbitrary Kernel Read/Write

Method 1: Pool Overflow
1. Spray kernel pool with controlled objects
2. Overflow adjacent object
3. Corrupt object pointers
4. Achieve arbitrary read/write

Method 2: Use-After-Free
1. Free kernel object with function pointer
2. Realloc with controlled data
3. Call corrupted function pointer
4. Control kernel execution

GDI Palette Exploit

1. Create palette objects (kernel pool)
2. Free and reallocate with controlled data
3. Corrupt palette function pointers
4. Trigger callback for code execution

BitMap Exploit

1. Create BitMap objects in kernel pool
2. Use-After-Free to corrupt Bitmap
3. Write to kernel memory via Bitmap APIs
4. Read kernel memory via Bitmap APIs
5. Overwrite EPROCESS token

Phase 5: Mitigation Bypass

SMEP Bypass (Supervisor Mode Execution Prevention)

Goal: Execute user-mode shellcode from kernel

Method 1: Stack Pivot
- ROP chain to user-mode memory
- Overwrite stack pointer (RSP)
- Return to user-mode shellcode

Method 2: Overwrite Code Segment
- Modify shellcode to look like kernel
- Change page protections
- Jump to shellcode

Method 3: ROP Only
- Build entire exploit in ROP
- No shellcode needed
- Use existing kernel code

SMAP Bypass (Supervisor Mode Access Prevention)

Goal: Access user-mode data from kernel

Method 1: Data-only attack
- Don't execute from user-mode
- Only read/write user data
- Use kernel-mode APIs

Method 2: Disable SMAP
- Modify CR4 register
- Clear bit 20 (0x100000)
- Enable user-mode access

KPTI Bypass (Kernel Page Table Isolation)

Goal: Access kernel memory from user-mode

Method 1: Info leak before KPTI
- Leak addresses before isolation
- Use leaked addresses later

Method 2: CPU spec exec
- Meltdown-style exploits
- Speculative execution bypass

PatchGuard Bypass

Goal: Modify kernel without crashing

Method 1: Race PatchGuard
- Exploit timeout window
- Make changes quickly
- Restore before check

Method 2: Hook non-guarded functions
- Avoid PatchGuard-protected structures
- Hook safe functions instead

Phase 6: Exploit Stages

Stage 1: Information Leak

1. Trigger info leak vulnerability
2. Read kernel addresses
3. Calculate offsets
4. Bypass KASLR

Stage 2: Primitive Setup

1. Build read/write primitive
2. Test on known kernel addresses
3. Verify: Can read/write kernel memory
4. Stabilize: Reliable exploitation

Stage 3: Privilege Escalation

1. Find current process EPROCESS
2. Locate SYSTEM process
3. Copy SYSTEM token
4. Trigger: SYSTEM shell

Stage 4: Cleanup

1. Restore modified kernel state
2. Avoid crash detection
3. Hide exploitation evidence
4. Maintain persistence

Phase 7: Testing

Local Testing

1. Enable kernel debugging
2. Use WinDbg for kernel debugging
3. Set breakpoints on kernel functions
4. Verify: Token copy, EPROCESS location
5. Check: System stability

VM Testing

1. Test in snapshot VM
2. Enable kernel debug mode
3. Monitor for BSOD
4. Adjust offsets for Windows version
5. Verify: Privilege escalation works

Final Report

[KERNEL EXPLOIT] Driver Vulnerability
Driver: \Device\VulnDriver
IOCTL: 0x222003
Vulnerability: Stack buffer overflow

[Bug Details]
Location: Driver+0x1234 (IOCTL handler)
Buffer: 128 bytes stack buffer
Copy: Unbounded memcpy from user
Impact: Kernel code execution

[Exploit]
1. Info leak: Kernel base @ 0xfffff80012340000
2. Primitive: Arbitrary kernel R/W via pool overflow
3. Target: Current process EPROCESS @ 0xffff8d0012345678
4. Token: SYSTEM token @ 0xffff8d0099988000
5. Copy: Token[0] → CurrentProcess->Token
6. Result: SYSTEM privileges

[POC]
#include <windows.h>
HANDLE drv = CreateFile("\\.\VulnDriver", ...);
DWORD out;
DeviceIoControl(drv, 0x222003, payload, size, NULL, 0, &out, NULL);
system("cmd.exe"); // Runs as SYSTEM

Severity: CRITICAL (SYSTEM privilege escalation)
Bypasses: SMEP, SMAP, KPTI

Target Versions

• Windows 7/8/10/11 (x86/x64)
• Linux kernel 2.6 - 6.x
• macOS kernel
• Android kernel

Tools

• WinDbg: Kernel debugging
• IDA Pro/Ghidra: Driver reverse engineering
• Kernel analyzer: Driver analysis
• Virtual machines: Safe testing