WinKernel-Resources

A list of excellent resources for anyone trying to deepen their understanding with regards to Windows Kernel Exploitation and general low level security.

Some resources, links, books, and papers related to mostly Windows Internals and anything Windows kernel related really.

Important Info

• React OS Win32k
• Geoff Chappell - Kernel-Mode Windows
• HEVD Vulnerable driver
• FLARE Kernel Shellcode Loader
• Vergilius - Undocumented kernel structures
• Windows X86-64 System Call Table
• Vulnerable Driver Megathread

Must watch

• ⭐ Kernel Mode Threats and Practical Defenses
• ⭐ Morten Schenk - Taking Windows 10 Kernel Exploitation to the next level
• ⭐ The Life & Death of Kernel Object Abuse
• ⭐ Windows 10 Mitigation Improvements

Windows Rootkits

Talks / video recordings

• 11 part playlist - Rootkits: What they are, and how to find them
• Hooking Nirvana
• Alex Ionescu - Advancing the State of UEFI Bootkits
• BlueHat v18 || Return of the kernel rootkit malware (on windows 10)
• Numchecker: A System Approach for Kernel Rootkit Detection
• DEF CON 26 - Ring 0 Ring 2 Rootkits Bypassing Defenses
• Black Hat Windows 2001 - Kernel Mode Rootkits
• Black Hat Windows 2004 - DKOM (Direct Kernel Object Manipulation)
• RTFM SigSegv1 - From corrupted memory dump to rootkit detection

Articles / papers

• Dissecting Turla Rootkit Malware Using Dynamic Analysis
• A quick insight into the Driver Signature Enforcement
• WINDOWS DRIVER SIGNING BYPASS BY DERUSB
• A Basic Windows DKOM Rootkit
• Manipulating ActiveProcessLinks to Hide Processes in Userland

Windows kernel mitigations

Talks / video recordings

• BlueHat v18 || Hardening hyper-v through offensive security research
• BYPASS CONTROL FLOW GUARD COMPREHENSIVELY - this is cfg not kCFG
• BlueHat v18 || Mitigation Bypass: The Past, Present, and Future
• Windows Offender Reverse Engineering Windows Defender's Antivirus Emulator
• Windows 10 Mitigation Improvements (really good talk)
• Overview of Windows 10 Requirements for TPM, HVCI and SecureBoot
• Examining the Guardians of Windows 10 Security - Chuanda Ding
• Analysis of the Attack Surface of Windows 10 Virtualization-Based Security
• A Dive in to Hyper-V Architecture & Vulnerabilities
• the last kaslr leak
• BlueHat v18 || A mitigation for kernel toctou vulnerabilities
• REcon 2013 - I got 99 problems but a kernel pointer ain't one
• SMEP: What is it, and how to beat it on Windows
• BlueHat IL 2020 - David Weston - Keeping Windows Secure
• Advancing Windows Security — David Weston
• OffensiveCon18 - The Evolution of CFI Attacks and Defenses

Articles / papers

General mitigation papers

• Hardening Windows 10 with zero-day exploit mitigations
• TAKING WINDOWS 10 KERNEL EXPLOITATION TO THE NEXT LEVEL

kASLR

• KASLR Bypass Mitigations in Windows 8.1
• Devlopment of a new Windows 10 KASLR bypass - in one winDBG command

SMEP

• Bypassing Intel SMEP on Windows 8 x64 Using Return-oriented Programming
• Return Oriented Programming Tutorial
• Stack Buffer Overflow (SMEP Bypass)
• Windows 10 x64 and Bypassing SMEP
• SMEP: What is it, and how to beat it on Windows

CET

• Security Analysis of Processor Instruction Set Architecture for Enforcing Control-Flow Integrity
• A Technical Look at Intel’s Control-flow Enforcement Technology
• Control-flow Enforcement Technology Specification
• Intel CET Answers Call to Protect Against Common Malware Threats
• R.I.P ROP: CET Internals in Windows 20H1

Windows kernel shellcode

Articles / papers

• Loading Kernel Shellcode
• Windows Kernel Shellcodes - a compendium
• Windows Kernel Shellcode on Windows 10 – Part 1
• Windows Kernel Shellcode on Windows 10 – Part 2
• Windows Kernel Shellcode on Windows 10 – Part 3
• Panic! At The Kernel - Token Stealing Payloads Revisited on Windows 10 x64 and Bypassing SMEP
• Token Abuse for Privilege Escalation in Kernel
• Introduction to Shellcode Development
• Introduction to Windows shellcode development – Part 1
• DoublePulsar Initial SMB Backdoor Ring 0 Shellcode Analysis
• Exploring Injected Threads

Windows kernel exploitation

Talks / video recordings

• HITB2016AMS - Kernel Exploit Hunting And Mitigation
• Ilja van Sprundel: Windows drivers attack surface
• REcon 2015 - This Time Font hunt you down in 4 bytes
• Exploiting a Windows 10 PagedPool off-by-one overflow (WCTF 2018)
• Windows kernel exploitation techniques - Adrien Garin - LSE Week 2016
• Hackingz Ze Komputerz - Exploiting CAPCOM.SYS - Part 1
• Hackingz Ze Komputerz - Exploiting CAPCOM.SYS - Part 2
• The 3 Way06 Practical Windows Kernel Exploitation
• Reverse Engineering and Bug Hunting on KMDF Drivers
• Binary Exploit Mitigation and Bypass History - not just kernel
• Morten Schenk - Taking Windows 10 Kernel Exploitation to the next level
• REcon 2015 - Reverse Engineering Windows AFD.sys
• Windows Kernel Graphics Driver Attack Surface
• Understanding TOCTTOU in the Windows Kernel Font Scaler Engine
• Black Hat USA 2013 - Smashing The Font Scaler Engine in Windows Kernel

Articles / papers

• Kernel Exploit Sample Hunting and Mining Contents
• The entire GreyHatHacker site has great writeups
• BlueKeep: A Journey from DoS to RCE (CVE-2019-0708)
• Exploiting SMBGhost (CVE-2020-0796) for a Local Privilege Escalation
• Windows Drivers are True’ly Tricky
• Taking apart a double zero-day sample discovered in joint hunt with ESET
• Sharks in the Pool :: Mixed Object Exploitation in the Windows Kernel Pool
• Kernel Pool Overflow Exploitation in Real World: Windows 10
• Kernel Pool Overflow Exploitation in Real World - Windows 7
• Kernel Pool Exploitation on Windows 7
• Easy local Windows Kernel exploitation
• Exploiting CVE-2014-4113
• Pwn2Own 2014 - AFD.sys Dangling Pointer Vulnerability
• Symantec Endpoint protection 0day
• Analysing the NULL SecurityDescriptor kernel exploitation mitigation in the latest Windows 10 v1607 Build 14393
• nt!_SEP_TOKEN_PRIVILEGES - Single Write EoP Protect
• Token Abuse for Privilege Escalation in Kernel

Windows kernel GDI exploitation

Talks / video recordings

• Abusing GDI for ring0 exploit primitives Evolution
• Demystifying Windows Kernel Exploitation by Abusing GDI Objects
• CommSec D1 - The Life & Death of Kernel Object Abuse
• Kernel Object Abuse by Type Isolation

Articles / papers

• Turning CVE-2017-14961 into full arbitrary read / write with PALETTE objects
• Zero-day exploit (CVE-2018-8453) used in targeted attacks
• [The zero-day exploits of Operation WizardOpium](https://securelist.com/the-zero-day-exploits-of-operation-wizard