5 ms·
In case anyone doesn't get it, this isn't an exploit in itself. It's a function you can use to gain system (root) privileges once you've found a bug in the Wind
by nly 4y ago
In case anyone doesn't get it, this isn't an exploit in itself. It's a function you can use to gain system (root) privileges once you've found a bug in the Windows kernel that that gives you remote code execution.
- deleted 4y ago[deleted]
- Neil44 4y agoDo you mean privilage escalation or have I misunderstood? i.e. you could for example exploit one of the recent Exchange vulnerabilities then use this to get SYSTEM and own the box.
- 3np 4y agoThe first line in the README: > Windows x64 kernel-mode handcrafted shellcode to replace primary access token of executing process with SYSTEM process token for Elevation of Privilege(EoP). So yes, privilege escalation.
- Perolan2 4y agoNo, not just privilege escalation. This is shellcode that needs to be inserted into a vulnerable driver, as it has to run from kernel space. Being privileged isn’t enough to run this function.
- readams 4y agoNo, this is the code that you inject using your vulnerability. The vulnerability is the privilege escalation part and this is what you do with your privilege. Exploiters call this shellcode since a common way this manifests is that the code will launch a root shell. Shellcode can be hard to write since it might be a small amount of code you can execute, you might not be able to jump precisely to your code, it might have to use a limited range of values (such as correctly parsing as something else) or other challenges.