Once WinDBG is installed, we will configure kernel symbols to make life a bit easier. Our debugging machine will primarily consist of WinDBG, which will be used as our kernel debugger, however I recommend trying out WinDBG preview if you have not had the chance, if only for the slick UI :) To exploit the driver, we will set up 2 virtual machines within VirtualBox, a debugging VM and an exploitation VM. Available on github here, the project provides a Windows driver with a range of vulnerabilities added to be exploited. If you want to learn about Windows driver exploitation, few resources are better than the HackSys Extreme Vulnerable Driver.

This post will start off by laying the groundwork for future posts, and walking through a simple stack overflow exploit in the Windows kernel. If you haven’t had chance to read it, I’d recommend that you pause and give it a quick glance as some of this walkthrough will rely on concepts introduced previously. « Back to home Exploiting Windows 10 Kernel Drivers - Stack Overflowįollowing on from my earlier post in which we walked through creating an exploit for the WARBIRD vulnerability, over the next few posts I’m going to be looking at Windows kernel exploitation.

Windows driver loader