Skip to content

Idov31/EtwLeakKernel

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

5 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

EtwLeakKernel

This repository contains a PoC for a program that utilizes ETW to leak kernel memory addresses. It does so by creating a consumer (could be to almost any provider as almost all of them leak kernel addresses) and requesting a stack trace from it. Once the stack trace is received, it is parsed to extract the kernel memory addresses. Since Microsoft do not consider administrator to kernel as a security boundary, this situation won't change any time soon. Might be useful in some exploitation scenarios (e.g. wanting to leak the kernel base address if you know that an ETW provider leaks a kernel address which is in a certain offset from the kernel base address or any other interesting address for that matter) or just as a party trick.

Bare in mind that administrative privileges are required to start consuming from ETW providers. If there is already a program that consumes ETW events that normal user has access to the trace, the normal user will be able to leak kernel addresses as well. It does not provide any leak of actual kernel data, just kernel addresses (unless in maybe an extreme edge cases).

poc

Usage

You can see an example of how to use in EtwLeakKernel. You can also use any other ETW consumer and request the stack, in this example it is using Microsoft-Windows-Kernel-Network.

Setup

Requirements

Cloning

git clone https://github.com/Idov31/EtwLeakKernel --recursive

About

Leaking kernel addresses from ETW consumers. Requires Administrator privileges.

Topics

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

 
 
 

Contributors

Languages