Hacker News Reader

In case anyone doesn't get it, this isn't an exploit in itself. It's a function you can use to gain system (root) privileges once you've found a bug in the Windows kernel that that gives you remote code execution.

View on HN

Do you mean privilage escalation or have I misunderstood? i.e. you could for example exploit one of the recent Exchange vulnerabilities then use this to get SYSTEM and own the box.

The first line in the README:

> Windows x64 kernel-mode handcrafted shellcode to replace primary access token of executing process with SYSTEM process token for Elevation of Privilege(EoP).

So yes, privilege escalation.

No, not just privilege escalation. This is shellcode that needs to be inserted into a vulnerable driver, as it has to run from kernel space. Being privileged isn’t enough to run this function.

No, this is the code that you inject using your vulnerability. The vulnerability is the privilege escalation part and this is what you do with your privilege. Exploiters call this shellcode since a common way this manifests is that the code will launch a root shell.

Shellcode can be hard to write since it might be a small amount of code you can execute, you might not be able to jump precisely to your code, it might have to use a limited range of values (such as correctly parsing as something else) or other challenges.

Reply on news.ycombinator.com