Kernel Exploitation Resources

Windows

1. https://labs.mwrinfosecurity.com/blog/windows-8-kernel-memory-protections-bypass/
2. https://labs.mwrinfosecurity.com/blog/a-tale-of-bitmaps/
3. https://dl.packetstormsecurity.net/papers/general/SMEP_overview_and_partial_bypass_on_Windows_8.pdf
4. https://www.coresecurity.com/blog/ms16-039-windows-10-64-bits-integer-overflow-exploitation-by-using-gdi-objects
5. https://www.coresecurity.com/system/files/publications/2016/05/Windows%20SMEP%20bypass%20U%3DS.pdf
6. https://cansecwest.com/slides/2016/CSW2016_Economou-Nissim_GettingPhysical.pdf
7. https://blogs.technet.microsoft.com/mmpc/2017/03/27/detecting-and-mitigating-elevation-of-privilege-exploit-for-cve-2017-0005/
8. https://www.virusbulletin.com/uploads/pdf/conference_slides/2015/OhFlorio-VB2015.pdf
9. https://blogs.technet.microsoft.com/mmpc/2017/01/13/hardening-windows-10-with-zero-day-exploit-mitigations/
10. http://www.codemachine.com/article_kernelstruct.html
11. http://www.codemachine.com/article_x64deepdive.html
12. https://www.coresecurity.com/system/files/publications/2016/10/Abusing-GDI-Reloaded-ekoparty-2016_0.pdf
13. https://www.coresecurity.com/blog/abusing-gdi-for-ring0-exploit-primitives
14. http://www.fuzzysecurity.com/tutorials/expDev/22.html
15. http://blog.trendmicro.com/trendlabs-security-intelligence/one-bit-rule-system-analyzing-cve-2016-7255-exploit-wild/
16. https://labs.mwrinfosecurity.com/assets/BlogFiles/mwri-securitay-2017-samdb-a-window-into-ring0.pdf
17. https://www.blackhat.com/docs/asia-16/materials/asia-16-Wang-A-New-CVE-2015-0057-Exploit-Technology-wp.pdf
18. https://media.blackhat.com/bh-us-11/Mandt/BH_US_11_Mandt_win32k_WP.pdf
19. https://github.com/55-AA/CVE-2016-3308
20. https://www.nccgroup.trust/globalassets/newsroom/uk/blog/documents/2015/07/exploiting-cve-2015.pdf
21. https://github.com/sam-b/windows_kernel_address_leaks/blob/master/notes/gSharedInfo.md
22. https://2016.zeronights.ru/wp-content/uploads/2016/12/Win10LPE.pdf
23. https://blogs.technet.microsoft.com/yongrhee/2009/06/23/pool-tag-list/
24. http://picturoku.blogspot.com/2011/12/bit-away-from-kernel-execution.html
25. https://improsec.com/blog//windows-kernel-shellcode-on-windows-10-part-4-there-is-no-code
26. https://twitter.com/FuzzySec/status/882025887071440897
27. http://trackwatch.com/kernel-pool-overflow-exploitation-in-real-world-windows-7/
28. http://trackwatch.com/windows-kernel-pool-spraying/
29. http://slides.com/theduck/deck#/
30. http://www.iceswordlab.com/2017/06/14/Automatically-Discovering-Windows-Kernel-Information-Leak-Vulnerabilities_en/
31. http://illmatics.com/Windows%208%20Heap%20Internals%20(Slides).pdf
32. http://2014.zeronights.org/assets/files/slides/data-only-pwning-windows-kernel.pptx
33. https://github.com/MortenSchenk/BHUSA2017
34. http://trackwatch.com/kernel-pool-overflow-exploitation-in-real-world-windows-10/