HEVD Exploitation: Double Fetch on Windows 11 (Kernel Privilege Escalation)
This write-up demonstrates how to exploit a double-fetch vulnerability in the HackSys Extreme Vulnerable Driver (HEVD) on Windows 11. We analyze the vulnerable IOCTL handler that performs multiple reads of user-controlled input without proper synchronization, leading to a race condition between the kernel and user space.
We then walk through crafting a reliable race condition exploit, bypassing common mitigations such as SMEP, ASLR, and KASLR, and ultimately escalate privileges by modifying the current process token in kernel space. The result is a stable local privilege escalation leveraging a subtle timing vulnerability.
HEVD Exploitation: Stack Overflow on Windows 11 (Kernel Privilege Escalation)
This write-up demonstrates how to exploit a stack-based buffer overflow in the HackSys Extreme Vulnerable Driver (HEVD) on Windows 11. Starting from driver setup and loading, we trace the vulnerable IOCTL handler that allows user-controlled input to overwrite stack memory in kernel space.
We then walk through gaining control over RIP, bypassing common mitigations such as SMEP, ASLR and DEP and building a reliable exploit chain. Finally, we craft a kernel-mode payload that elevates privileges by manipulating the current process token, turning the vulnerability into a stable local privilege escalation.