01. Windows Kernel Exploits
Overview¶
Windows kernel exploitation is a technique used during privilege escalation when a low-privileged user has already obtained access to a Windows system.
The goal is to identify vulnerabilities in the Windows kernel or kernel-mode components that can be exploited to execute code with higher privileges, commonly resulting in NT AUTHORITY\SYSTEM access.
Privilege escalation is an important part of the penetration-testing process because an initial foothold does not always provide administrative privileges.
Privilege Escalation¶
Privilege escalation is the process of moving from a lower-privileged account to a higher-privileged account by exploiting a vulnerability, weakness, or misconfiguration.
On Windows, common privilege levels include:
A successful kernel exploit can allow an attacker to move from a normal user context to SYSTEM-level privileges.
The screenshots demonstrate this process using a Windows 7 SP1 virtual machine.
Windows Kernel¶
The Windows kernel is the core component of the operating system. It manages system resources, memory, hardware, processes, and other low-level functionality.
Windows operates primarily using two execution modes:
User Mode¶
Applications and many services operate in user mode.
They have restricted access to system resources and hardware.
Kernel Mode¶
Kernel-mode components have highly privileged access to system resources, memory, and hardware.
A vulnerability in a kernel-mode component can therefore have significant security consequences.
+-----------------------------+
| User Mode |
| Applications / Services |
+-----------------------------+
|
v
+-----------------------------+
| Windows Kernel |
| Kernel-mode components |
+-----------------------------+
|
v
+-----------------------------+
| Hardware |
+-----------------------------+
Windows Kernel Exploitation¶
Windows kernel exploits generally target vulnerabilities in kernel-mode components.
Depending on the vulnerability, exploitation may allow arbitrary code execution or privilege escalation.
A typical penetration-testing workflow is:
Initial Access
|
v
Identify Windows Version
|
v
Enumerate Patches / Hotfixes
|
v
Identify Potential Kernel Vulnerabilities
|
v
Find a Suitable Exploit
|
v
Transfer Exploit to Lab Target
|
v
Execute Exploit
|
v
Verify Privilege Level
The exact exploit depends on the Windows version, architecture, installed patches, and vulnerability being investigated.
Lab Environment¶
The demonstration uses a Windows 7 SP1 virtual machine.
The Meterpreter session running under the following account:
The session is running on a 64-bit Windows system.
The initial privilege level can be checked with:
Example output:
This confirms that the session does not initially have SYSTEM privileges.
First gain the initial access.
Checking Process Privileges¶
Meterpreter provides the getprivs command to display enabled process privileges.
Example:
The screenshot shows privileges such as:
SeChangeNotifyPrivilege
SeIncreaseWorkingSetPrivilege
SeShutdownPrivilege
SeTimeZonePrivilege
SeUndockPrivilege
This information can help determine the current security context before attempting privilege escalation.
Metasploit Local Exploit Suggester¶
Metasploit includes the local_exploit_suggester post module.
Its purpose is to examine the compromised system and identify local exploit modules that may be applicable.
Search for the module:
The relevant module is:
Load the module:
View the available options:
The important option shown in the demonstration is:
Set the Meterpreter session:
Then execute:
Interpreting Exploit Suggestions¶
The module performs local checks against the target and reports potential vulnerabilities.
Example output from the demonstration includes:
exploit/windows/local/bypassuac_dotnet_profiler
exploit/windows/local/bypassuac_sdclt
exploit/windows/local/cve_2019_1458_wizardopium
exploit/windows/local/cve_2020_1054_drawiconex_lpe
exploit/windows/local/ms10_092_schelevator
exploit/windows/local/ms16_014_wmi_recv_notif
The important point is that the suggester provides candidates. A result indicating that a target appears vulnerable should still be validated before relying on it.
MS16-014 WMI Receive Notification Example¶
The demonstration selects:
The existing Meterpreter session is assigned:
A listener port can be configured according to the lab setup:
The module can then be executed:
In the demonstration, Metasploit reports that the exploit DLL was injected and a new Meterpreter session was created.
The resulting session is then checked with:
The important result is:
This demonstrates successful privilege escalation from the original user context to SYSTEM.
Windows Exploit Suggester¶
Another tool shown in the demonstration is Windows-Exploit-Suggester.
Its purpose is to compare Windows patch information against a vulnerability database and identify potential missing security updates and corresponding public exploits.
Repository:
The tool requires system information collected from the Windows target.
For example, the demonstration saves Windows system information to:
The vulnerability database can then be updated:
The update creates a database containing Windows security bulletin information.
Running Windows Exploit Suggester¶
The demonstration uses the Windows 7 SP1 database together with the collected systeminfo output.
Example:
The tool analyzes the supplied system information and compares installed hotfixes against known security bulletins.
Example output identifies:
and reports potential missing security updates such as:
The output can also indicate whether a public proof of concept or Metasploit module is available.
MS16-135¶
The demonstration focuses on:
The vulnerability information identifies kernel-mode components as the affected area.
The Windows-Exploit-Suggester output can provide references to publicly available exploit research associated with the vulnerability.
The important concept is the relationship between:
Obtaining an Exploit in the Lab¶
The demonstration uses a public Windows kernel exploit repository:
The repository contains Windows kernel exploit references organized by security bulletin and CVE.
For MS16-135, the demonstration uses an executable associated with the vulnerability.
The exploit is transferred into the controlled Windows lab environment.
Transferring the Exploit¶
The demonstration uses an existing Meterpreter session to move the executable to the target.
The target's temporary directory is selected:
The local executable is uploaded:
Meterpreter reports that the file was successfully transferred:
The file can then be accessed from the Windows temporary directory.
Executing the Kernel Exploit¶
From the Windows shell, the uploaded executable is located in:
The executable is started:
The program requests the target operating-system version.
The demonstration identifies Windows 7 using:
The executable then performs the kernel exploitation process against the vulnerable Windows installation.
Verifying Privilege Escalation¶
After the exploit completes, the current Windows security context can be checked with:
The demonstration returns:
This confirms that the previously low-privileged session has been elevated to SYSTEM.
The privilege transition can therefore be represented as:
Metasploit vs Manual Exploitation¶
The demonstration shows two approaches.
Metasploit-Based Approach¶
Metasploit can automate much of the process:
Meterpreter Session
|
v
local_exploit_suggester
|
v
Identify Potential Exploit
|
v
Select Metasploit Module
|
v
Execute Module
|
v
SYSTEM Session
This approach is convenient when a compatible Metasploit module exists.
Manual Exploit Approach¶
The manual approach provides more control over the individual stages:
Enumerate System
|
v
Windows Exploit Suggester
|
v
Identify Vulnerability
|
v
Obtain Appropriate PoC/Exploit
|
v
Transfer to Target
|
v
Execute
|
v
Verify with whoami
This approach is useful for understanding how kernel privilege escalation works beyond automated exploitation frameworks.
Important Considerations¶
Kernel exploits are highly dependent on the target environment.
Before using an exploit in an authorized lab, verify:
Operating System
Architecture
Service Pack
Installed Hotfixes
Kernel Version
Vulnerable Component
Exploit Compatibility
A kernel exploit designed for one Windows build may fail on another build or potentially crash the system.
Kernel exploitation should therefore be performed only against systems where you have explicit authorization.
Key Commands¶
Meterpreter¶
getuid
getprivs
sessions
search suggester
use post/multi/recon/local_exploit_suggester
show options
set SESSION <id>
run
Windows Exploit Suggester¶
Windows¶
Meterpreter File Transfer¶
Summary¶
Windows kernel exploitation is a privilege-escalation technique that takes advantage of vulnerabilities in kernel-mode components.
The overall methodology demonstrated in the lab is:
Initial Meterpreter Access
|
v
Identify Current User
|
v
Enumerate Windows System
|
v
Identify Missing Patches
|
v
Find Potential Kernel Vulnerabilities
|
v
Validate Exploit Compatibility
|
v
Use Metasploit or a Suitable PoC
|
v
Execute in the Authorized Lab
|
v
Verify with getuid / whoami
|
v
NT AUTHORITY\SYSTEM
The key lesson is that successful privilege escalation depends on accurate system enumeration, correct vulnerability identification, exploit compatibility, and careful verification of the resulting privilege level.