A New CVE-2015-0057 Exploit Technology
summary
Demonstrates working exploit techniques that turn CVE-2015-0057’s user‑mode callback use‑after‑free into reliable kernel primitives, with a live demo yielding SYSTEM on unpatched Windows 8.1. Uses heap layouts that spray TagPropList/TagWindow/TagMenu objects; 32‑bit chains overwrite PSP_INFO to achieve relative reads/writes while 64‑bit reconstructs HIP headers and uses a misalignment object to reach arbitrary kernel memory. Also documents practical kernel info leaks via GShellInfo disclosure and shows the exact steps and fields to overwrite to avoid crashes.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:34Context and Timeline
- 2:35Vulnerability Overview
- 6:12Execution Flow Analysis
- 8:26Object Selection
- 12:39Obstacles and Challenges
- 14:06NCC Group's Method
- 20:0964-bit Exploitation
- 25:10Alternative Techniques
- 27:03Advanced 64-bit Method
- 32:56Live Demonstration
- 38:32Conclusion
- 40:17GDI Information Leak
- 45:24Final Insights
related talks
25mData-Only Pwning Microsoft Windows Kernel
46mD2T2 - Over The Edge: Pwning The Windows Kernel
40mCommSec D1 - The Life & Death of Kernel Object Abuse
51mExploiting Hardware Glitches And Side Channels In Perfect Software
57mThe Anatomy of an Exploit
38mClose Encounters of the Advanced Persistent Kind: Leveraging Rootkits for Post-Exploitation
01h 05mClassic Vulnerabilities
33mExploring a New Class of Kernel Exploit Primitive