Deferred #DB Exception Handling in x86 Operating-System Kernels

This repository contains a single Metasploit module (Ruby file) that exploits CVE-2018-8897, a privilege escalation vulnerability in Microsoft Windows (x64, except XP). The module is designed for local exploitation via an existing Meterpreter session. It supports two exploitation methods: uploading and executing a precompiled exploit binary and payload EXE, or in-memory DLL injection using a reflective DLL. The module is highly weaponized, leveraging Metasploit's payload generation and session management. It provides SYSTEM-level code execution on vulnerable systems. The code references several file paths used for payload and exploit delivery, and is configurable via module options. The structure is typical for a Metasploit local exploit, with clear separation of setup, validation, file management, and exploitation logic.

This repository is a full-featured local privilege escalation exploit for CVE-2018-8897, targeting Microsoft Windows systems vulnerable to the MOV SS and POP SS vulnerability. The exploit is implemented in C++ with critical components in x64 assembly. The main entry point is 'movss_popss.cpp', which orchestrates the attack by checking system compatibility, locating kernel modules (ntoskrnl.exe and CI.dll), resolving necessary kernel symbol offsets, and preparing the process environment. The exploit leverages two CPU cores: one to execute the exploit and another to corrupt the stack at a precise moment, enabling the attacker to hijack kernel execution flow. The assembly payload disables SMEP, steals the SYSTEM process token for privilege escalation, disables Driver Signature Enforcement (DSE), and returns to user mode with SYSTEM privileges, spawning a shell. The codebase is modular, with separate files for memory management, process manipulation, symbol resolution, and low-level hardware/OS interaction. No network endpoints are present; all actions are performed locally. The exploit is operational and includes a working payload, but is not part of a larger exploitation framework.

This repository is a proof-of-concept (PoC) exploit for CVE-2018-8897, a vulnerability in the handling of the POP SS instruction on Windows systems. The exploit is implemented in C++ with supporting assembly routines. The main exploit logic resides in Main.cpp, which orchestrates the attack by preparing kernel shellcode, manipulating processor state, and triggering the vulnerability via a crafted ROP chain and context manipulation. The payload, executed in kernel mode, escalates the current process's privileges to SYSTEM by replacing its token with that of the SYSTEM process. After successful exploitation, the code spawns a SYSTEM-level command shell (cmd.exe). The exploit requires the target to be unpatched for CVE-2018-8897 and KVA Shadowing to be disabled. The codebase is structured with several header files for kernel and memory routines, a main exploit file, and supporting assembly for low-level operations. No network endpoints are present; the attack vector is purely local privilege escalation.

This repository contains a proof-of-concept (PoC) local exploit for CVE-2018-8897, a vulnerability in the handling of the POP/MOV SS instructions on Windows systems. The exploit is implemented in C++ (movss.cpp) with a supporting assembly routine (vuln.asm). The main C++ file sets up a hardware breakpoint on the stack segment selector and invokes the assembly code to trigger the vulnerability. If the system is vulnerable, executing the exploit will cause the machine to bugcheck (crash), resulting in a local denial of service. The project is structured as a Visual Studio solution with appropriate project and filter files for building the exploit on Windows x64. No network or remote attack vectors are present; the exploit must be run locally on the target machine.