0x01 – Killing Windows Kernel Mitigations(wetw0rk.github.io) |
0x01 – Killing Windows Kernel Mitigations(wetw0rk.github.io) |
We’ve learned how to exploit a Stack Overflow in Windows 7 (x86) but what has changed since then?
Truthfully a lot, but the core fundamental problem exists and as such we as hackers will always find a way to exploit them.
As part of this tutorial, I will be releasing my technique on bypassing SMEP and VBS I have dubbed Violet Phosphorous. I personally have not seen these mitigations bypassed in this manner so I’m claiming it.
To prove its effectiveness, I installed the latest Windows 11 (x64) build (24H2) and successfully elevated my privileges to NT AUTHORITY/SYSTEM.
The king is dead, long live the king!
LONG LIVE THE STACK OVERFLOW!
Any comment on reporting to Microsoft or perhaps motivation for this research?
Obviously this is hard, so post-exploit mitigations will likely continue to still make things harder for attackers for quite a while at least.
The mitigation known as Shadow Stack might have something to say here.
Having said that, being a microkernel, seL4 ends up pushing a bunch of potentially buggy code to use space. There are real benefits to that, but if you can exploit the page table server, the system is pretty much yours.