Data-Only Pwning Microsoft Windows Kernel
summary
New technique targets Windows 8.1 kernel pool: it turns a single pool overflow into arbitrary memory read/write, hijack of execution flow and adjacent read/write by corrupting object headers and coercing object type indexes into different type handlers. Pool spraying with event/file/key objects yields concrete primitives — for example one QueryDirectory call gives 25 reads from one call and a WorkerFactory corruption produces infinite arbitrary writes. The exploit copies a SYSTEM token with only read/write primitives, avoiding kernel shellcode or ROP, and works around many allocator mitigations.
AI-written summary · about
chapters (11)
- 0:00Introduction to kernel bugs
- 0:36Pool overflow basics
- 2:13Windows pool architecture
- 4:23Object metadata corruption
- 6:16Mitigations in Windows 8.1
- 8:31Type confusion attacks
- 10:48Hijacking execution flow
- 13:04Memory read/write primitives
- 15:39Data-only payload techniques
- 19:25Future mitigation strategies
- 21:51Conclusion and Q&A
related talks
40mCommSec D1 - The Life & Death of Kernel Object Abuse
52mA New CVE-2015-0057 Exploit Technology
33mExploring a New Class of Kernel Exploit Primitive
39mProxying to Kernel:Streaming vulnerabilities from Windows Kernel
46mD2T2 - Over The Edge: Pwning The Windows Kernel
38mClose Encounters of the Advanced Persistent Kind: Leveraging Rootkits for Post-Exploitation
35mThe Pool Party You Will Never Forget: New Process Injection Techniques Using Windows Thread Pools
50mExploiting the Hyper-V IDE Emulator to Escape the Virtual Machine