Windows Kernel Exploitation.

Static & dynamic analysis, exploits & vuln reasearch.
Mitigations bypass's

Contents

Introduction:

HEVD-Vanilla-Bug-Class's:
Exploits & Vuln Note's in order to reproduce & reuse.

• HEVD-Vanilla-Bug-Class's
  [+] Compiled-win7x86
  * Type Confusion.
  * Arbitrary Overwrite.
  * Null Pointer Dereference.
  * Pool OverFlow.
  * Stack OverFlow.
  * Use After Free.
  * Uninitialized Stack Variable.
  

kd & dev:

• ShellCode: pl.asm
  
• kernelLeaks: leak bitmap bAddr with HMValidateHandle
  

Mitigations Bypass:

Click Here!
* [RS3-Compatible] ROP Based SMEP Bypass including Gadgets & full debugging info: SmepBypassX64Win10RS3.c
* [<= RS2-Compatible] BitMap Arbitrary OverWrite: GdiExp.cc

tutorial:

• Rop tutorial: Click Here!
  

External Resources:

• HEVD & Basics:
  [+] HackSysExtremeVulnerableDriver.
  [+] B33F tuto.
  [^] Some of the Vuln Note's in the code were taken from there.
  [+] ShellCoding & kd.
  
• Mitigations:
  [+] SMEP:
  * wiki.
  * j00ru.
  * Enrique Nissim & Nicolas Economou.
  * PTE-OverWrite.
  * return oriented Programming.
  [+] k-ASLR:
  * Morten Schenk.
  [+] ReadWrite Primitives:
  * abusing gdi objects.
  

Software:

• kd.
  
• Symbols.
  
• Ida.
  
• NASM.
  
• Hxd.
  

Other:

• data struct.
  
• diffing (bindiff).
  
• diffing (diaphora).
  

See Also:

• Smep PoC.
  
• GdiExp.
  

Tnx Note!

many tnx to all the great ppl b4 me that did much work already!
& all others...

about author:

twitter: @_akayn