This page holds the location of my kernel research that was presented at Defcon 34 in the Malware village! This is a BYOVD framework, so you would be able to just swap out the code required to communicate with your driver, and then all the attacks will function! It’s designed for attacking Windows kernel under VBS. Please read more in the github. The following pages cover the different code execution methods that I have developed in greater detail. ...
This page holds the location of my research within ClickOnce and AppLaunch.exe. This was presented at Defcon34 at Red Team Village! The below whitepaper describes the attack in great detail. It’s not an academic paper but more of an explination of the attack, but fully written out and edited. Access it through: https://nathan2.com/files/clicktools.pdf The talk was not recorded, however, a copy of the presentation in pptx and pdf formate are available below: ...
Intro I have been doing a lot of kernel research to try to create a tool to immediantly weaponize vulnerable drivers. One article that came up for me was an SSDT Hijack, and it was done by Juan Sacco. It is available here. https://www.exploitpack.com/blogs/news/bypassing-kernel-code-execution-a-data-only-ssdt-hijack-under-hvci-but-how Please read this article fully before you read this. But if your anything like me, you probably won’t, and are wondering on why I wrote this when that article is already out there. ...
In this article I will cover a new implementation of an attack to use virtual kernel read write primitives to allow for Code Execution on HVCI enabled machines. This attack method will function and complete on machines without shadow stacks without issue. This will complete the payload on machines with Shadow Stacks, but blue screen afterwards. This attack eventually leads to sending a message or data exfiltration through the kernel using ZwOpenFile. ...
Intro This post is explaining how I was able to achieve kernel code execution within a windows machine with both HVCI and Shadow Stacks. By using a r/w virtual kernel address primitive, I am able to create an (previously undocumented) method of executing kernel commands. I’m 90% sure this has not been done before in this way, however I would be surprised if no one else has thought of this or implemented it in some way. ...