Demystifying Windows Kernel Exploitation by Abusing GDI Objects
Complete walkthroughs of Windows kernel exploitation using GDI bitmap objects with released exploits.
Summary
Kernel Exploitation Challenge
Windows kernel exploitation is difficult to learn due to limited walkthroughs. Full exploitation process documentation is rare but necessary for skill development.
GDI Object Abuse
The presentation provides detailed steps for developing privilege escalation exploits. GDI bitmap objects provide abuse vectors for achieving kernel code execution.
Exploit Development Process
Reversing Microsoft patches, identifying bugs, developing PoCs, and turning them into code execution demonstrates complete exploitation methodology. Complete exploitation processes are rare and valuable.
Released Exploits
A Windows 8.1 x64 exploit using GDI bitmap objects is released. A previously unreleased Windows 7 SP1 x86 exploit using novel GDI object abuse techniques is also provided, advancing the field.
Related talks
Black Hat·38 min
Barnaby Jack
Analysts investigate attack surfaces and defenses concerning USA 2005 - Remote Windows Kernel Exploitation - Step In To the Ring 0.
Main Stage·38 min
HexRabbit Chen
Exploiting netfilter nftables vulnerabilities in the Linux kernel to achieve privilege escalation under kernelCTF mitigations.
Main Stage·44 min
Wanjunjie Zhang · Yisheng He
Abusing Advanced Local Procedure Call (ALPC) security mechanisms to bypass isolation and compromise Windows RPC services.