Organizer
Partner Company
How CVE-2018-8611 can be exploited to achieve privilege escalation on Windows 10 1809 and earlier.
Aaron Adams
NCC Group
Abstract
This talk will discuss how CVE-2018-8611 can be exploited to achieve privilege escalation on Windows 10 1809 and earlier. This research was done without getting a chance to analyze the in-the-wild 0day exploit that lead to the bug being patched by Microsoft, but rather by patch diffing and following some minimal public information as a starting point.
This presentation will go through the following:
- Windows Kernel Transaction Manager (KTM) internals
- Analyzing and winning the CVE-2018-8611 race condition vulnerability
- Abusing a fairly restrictive while loop to build a limited write primitive
- Building an arbitrary read primitive
- Escalating privileges and escaping the loop
Speaker Info
Aaron Adams(@fidgetingbits) is a security researcher in NCC Group's Exploit Development Group. He has been working with computer security for over 15 years, over that time working on vulnerability and malware analysis, code auditing, reverse engineering, and exploitation. Since joining NCC Group he has published some research on exploiting public vulnerabilities in the Windows kernel, Samba, Xen, Cisco ASA, etc..