写任意内存模式内核漏洞提权利用技术研究

Privilege Escalation Technology of Kernel Vulnerabilities in Write What Where Mode

写任意内存是内核漏洞中一种常见模式,对其利用技术的研究具有重要意义。首先分析传统利用技术的思路方法、利用步骤;然后分析最新的漏洞利用缓解技术工作原理,如何截断利用途径;最后针对最新的缓解技术,基于Windows自身的ACL机制提出一种新的利用方法。该方法可以有效绕过漏洞利用缓解技术,实现提权利用,具有一定的实际意义。

Write What Where mode kernel vulnerabilities is very common, and the research on its privilege escalation is significant. First the traditional method of privilege escalation is introduced and analysed, then the latest exploitation mitigation technology on the latest Windows system is in- troduced, finding how they can cut off the way of traditional methods. Finally, a new method is pro- posed against the exploitation mitigation based on the ACL of Windows itself, which is effective and significant.