Windows Kernel Exploitation

This course demonstrates the approach you should take in attacking a previously unknown component in the Windows kernel. After detailing the Windows kernel internals applicable to exploiting such a vulnerability, the focus is on labs that teach you what it takes to exploit a realworld vulnerability.

This class focuses on exploiting CVE-2018- 8611 on Windows 10 x64 1809 (RS5), a fairly complex race condition that leads to a use-after-free on the non-paged kernel pool. The vulnerability is in the Kernel Transaction Manager (KTM) driver (tm. sys), a kernel component that has not yet received much public scrutiny.