> For the complete documentation index, see [llms.txt](https://notes.cavementech.com/pentesting-quick-reference/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.cavementech.com/pentesting-quick-reference/privilege-escalation/windows-priv-esc/kernel-exploits.md). # Kernel Exploits {% embed url="" %} ### What is Kernel

### Kernel exploits Kernel exploits should be our last resource, since it might but the machine in an unstable state or create some other problem with the machine. **Identify the hotfixes/patches** ```bash systeminfo # or wmic qfe get Caption,Description,HotFixID,InstalledOn ``` **Python to Binary** If we have an exploit written in python but we don't have python installed on the victim-machine we can always transform it into a binary with pyinstaller. Good trick to know. ### Escalation with Metasploit Check for exploits ``` run post/multi/recon/local_exploit_suggester ``` #### Syntax Breakdown * `run`: A Meterpreter command used to execute a script or a post-exploitation module within the current session. * `post/`: Indicates that this is a post-exploitation module, designed to be used after a system has already been compromised. * `multi/recon/`: Specifies the category of the module. Multi means it works across multiple platforms (e.g., Windows, Linux, Android), and Recon indicates it is used for reconnaissance/gathering information. * `local_exploit_suggester`: The specific name of the module (sometimes nicknamed "Lester").

Kitrapod is very good. Try it for a few times

Kitrap0d Information - ### Manual Kernel Exploitation MS10-059 Exploit -