4 ms·
Do you mean privilage escalation or have I misunderstood? i.e. you could for example exploit one of the recent Exchange vulnerabilities then use this to get SYS
by Neil44 4y ago
Do you mean privilage escalation or have I misunderstood? i.e. you could for example exploit one of the recent Exchange vulnerabilities then use this to get SYSTEM and own the box.
- 3np 4y agoThe first line in the README: > Windows x64 kernel-mode handcrafted shellcode to replace primary access token of executing process with SYSTEM process token for Elevation of Privilege(EoP). So yes, privilege escalation.
- Perolan2 4y agoNo, not just privilege escalation. This is shellcode that needs to be inserted into a vulnerable driver, as it has to run from kernel space. Being privileged isn’t enough to run this function.
- readams 4y agoNo, this is the code that you inject using your vulnerability. The vulnerability is the privilege escalation part and this is what you do with your privilege. Exploiters call this shellcode since a common way this manifests is that the code will launch a root shell. Shellcode can be hard to write since it might be a small amount of code you can execute, you might not be able to jump precisely to your code, it might have to use a limited range of values (such as correctly parsing as something else) or other challenges.