News for hackers. Stuff that matters.

A comment on Windows x64 handcrafted token stealing kernel-mode shellcode. Parent comment

Re:Windows x64 handcrafted token stealing kernel-mode shellcode by 3np on Tuesday July 05, 2022 @05:25AM (#31986124)
The first line in the README:

> Windows x64 kernel-mode handcrafted shellcode to replace primary access token of executing process with SYSTEM process token for Elevation of Privilege(EoP).

So yes, privilege escalation.

[ Parent | on HN ]
Re:Windows x64 handcrafted token stealing kernel-mode shellcode by Perolan2 on Tuesday July 05, 2022 @11:28AM (#31989360)
No, not just privilege escalation. This is shellcode that needs to be inserted into a vulnerable driver, as it has to run from kernel space. Being privileged isn’t enough to run this function.
[ Parent | on HN ]