Windows Kernel Exploitation - Race Condition and Use-After-Free in KTM

OpenSecurityTraining2 via YouTube

Start learning Write review

Details

Start learning

Provider

YouTube
Pricing

Free Video
Languages

English
Duration & workload

14 hours 30 minutes
Sessions

On-Demand
Level

Advanced

Found in

Master advanced Windows kernel exploitation techniques through this comprehensive 14.5-hour course that demonstrates how to exploit a race condition vulnerability leading to a use-after-free in the Kernel Transaction Manager (KTM) component. Learn the systematic approach exploit developers should take when attacking previously unknown Windows kernel components, starting with binary diffing techniques to identify CVE-2018-8611 and progressing through complete exploitation development. Explore KTM fundamentals including objects, states, and transaction management while building practical skills through hands-on labs covering resource manager creation, transaction commits, and code analysis. Develop expertise in vulnerability analysis by understanding the TmRecoverResourceManager function, identifying the specific vulnerability and its patch, and learning to reach vulnerable code paths. Master race condition exploitation using WinDbg, understand KENLISTMENT object manipulation, and implement both heap spraying and heap feng shui techniques for reliable exploitation. Practice advanced memory manipulation strategies including pool manipulation for data control, delayed free bypass techniques, and exploitation methods with and without memory holes. Build detection mechanisms for successful race condition wins, develop strategies for escaping vulnerable loops, and implement address leak discovery techniques. Complete the exploitation chain by learning privilege escalation strategies, implementing arbitrary read/write primitives, and comparing different approaches including arbitrary increment techniques for achieving system-level access.

Syllabus

Exploitation 4011, Windows Kernel Exploitation: Race Condition + UAF in KTM 01 Introduction
Exploitation 4011, Windows Kernel Exploitation: Race + UAF in KTM 02 Lab Setup Debug Environment
Exploitation 4011, Windows Kernel Exploitation: Race + UAF in KTM 03 1 Binary Diffing Updates
Exploitation 4011, Windows Kernel Exploitation: Race + UAF in KTM 03 2 Binary Diffing CVE-2018-8611
Exploitation 4011, Windows Kernel: Race + UAF in KTM 03 3 Lab Binary Diffing CVE-2018-8611
Exploitation 4011, Windows Kernel: Race + UAF in KTM 03 4 Lab Binary Diffing CVE-2018-8611 Solution
Exploitation 4011, Windows Kernel Exploitation: Race Condition + UAF in KTM 04 1 KTM Basics
Exploitation 4011, Windows Kernel Exploitation: Race Condition + UAF in KTM 04 2 KTM Objects
Exploitation 4011, Windows Kernel Exploitation: Race Condition + UAF in KTM 04 3 KTM States
Exploitation 4011, Windows Kernel: Race + UAF in KTM 04 4 Lab KTM CreateResourceManager
Exploitation 4011, Windows Kernel: Race + UAF in KTM 04 5 Lab KTM CreateResourceManager Solution
Exploitation 4011, Windows Kernel: Race + UAF in KTM 04 6 Lab KTM CommitSingleEnTx
Exploitation 4011, Windows Kernel: Race + UAF in KTM 04 7 Lab KTM CommitSingleEnTx Solution
Exploitation 4011, Windows Kernel: Race + UAF in KTM 04 8 Lab KTM CommitMultiEnTx
Exploitation 4011, Windows Kernel: Race + UAF in KTM 04 9 Lab KTM CommitMultiEnTx Solution
Exploitation 4011, Windows Kernel Exploitation: Race + UAF in KTM 04 10 Improving Reversed Code
Exploitation 4011, Windows Kernel: Race + UAF in KTM 04 11 Lab Better Binary Diffing
Exploitation 4011, Windows Kernel: Race + UAF in KTM 04 12 Lab Better Binary Diffing Solution
Exploitation 4011, Windows Kernel: Race + UAF in KTM 05 1 Understanding TmRecoverResourceManager
Exploitation 4011, Windows Kernel Exploitation: Race + UAF in KTM 05 2 Vulnerability and Patch
Exploitation 4011, Windows Kernel: Race + UAF in KTM 05 3 Lab Reaching Vulnerable Code
Exploitation 4011, Windows Kernel: Race + UAF in KTM 05 4 Lab Reaching Vulnerable Code Solution
Exploitation 4011, Windows Kernel Exploitation: Race + UAF in KTM 06 1 Winning The Race With WinDbg
Exploitation 4011, Windows Kernel Exploitation: Race + UAF in KTM 06 2 How to Free a KENLISTMENT
Exploitation 4011, Windows Kernel: Race + UAF in KTM 06 3 Lab Winning The Race With WinDbg
Exploitation 4011, Windows Kernel: Race + UAF in KTM 06 4 Lab Winning The Race With WinDbg Solution
Exploitation 4011, Windows Kernel: Race + UAF in KTM 07 1 Heap Spray vs Feng Shui
Exploitation 4011, Windows Kernel: Race + UAF in KTM 07 2 Delayed Free and Bypass
Exploitation 4011, Windows Kernel: Race + UAF in KTM 07 3 Exploitation With and Without Holes
Exploitation 4011, Windows Kernel: Race + UAF in KTM 07 4 Data Control with Pool Manipulation
Exploitation 4011, Windows Kernel Exploitation: Race + UAF in KTM 07 5 Lab Bad Fengshui
Exploitation 4011, Windows Kernel Exploitation: Race + UAF in KTM 07 6 Lab Bad Fengshui Solution
Exploitation 4011, Windows Kernel Exploitation: Race + UAF in KTM 07 7 Lab Good Fengshui
Exploitation 4011, Windows Kernel Exploitation: Race + UAF in KTM 07 8 Lab Good Fengshui Solution
Exploitation 4011, Windows Kernel Exploitation: Race + UAF in KTM 07 9 Lab Triggering UAF
Exploitation 4011, Windows Kernel Exploitation: Race + UAF in KTM 07 10 Lab Triggering UAF Solution
Exploitation 4011, Windows Kernel Exploitation: Race + UAF in KTM 07 11 4 KTM Objects
Exploitation 4011, Windows Kernel: Race + UAF in KTM 07 12 Vulnerable Function Functionality
Exploitation 4011, Windows Kernel Exploitation: Race + UAF in KTM 07 13 Patch Analysis
Exploitation 4011, Windows Kernel Exploitation: Race + UAF in KTM 07 14 Why Heap Feng Shui
Exploitation 4011, Windows Kernel Exploitation: Race + UAF in KTM 07 15 Component Used For Feng Shui
Exp4011 07 16 Why Named Pipe For Feng Shui
Exploitation 4011, Windows Kernel: Race + UAF in KTM 07 17 How Use WinDbg To Win The Race
Exploitation 4011, Windows Kernel: Race + UAF in KTM 07 18 How To Exploit with SMAP enabled
Exploitation 4011, Windows Kernel: Race + UAF in KTM 07 19 Can We Create a 100 Reliable Exploit
Exploitation 4011, Windows Kernel: Race + UAF in KTM 07 20 How To Mitigate The Named Pipe Technique
Exploitation 4011, Windows Kernel Exploitation: Race + UAF in KTM 08 1 Race Win Detection
Exploitation 4011, Windows Kernel Exploitation: Race + UAF in KTM 08 2 Lab Race Win Detection
Exploitation 4011, Windows Kernel: Race + UAF in KTM 08 3 Lab Race Win Detection Solution
Exploitation 4011, Windows Kernel: Race + UAF in KTM 09 1 Escaping The Vulnerable Loop Strategy
Exploitation 4011, Windows Kernel: Race + UAF in KTM 09 2 Lab Address Leak Discovery and Loop Escape
Exploitation 4011 Windows Kernel: Race + UAF in KTM 09 3 Lab Address Leak Discovery and Loop Escape2
Exploitation 4011, Windows Kernel Exploitation: Race + UAF in KTM 10 Understanding The Address Leak
Exploitation 4011, Windows Kernel Exploitation: Race + UAF in KTM 10 2 Teaser Remaining of Exp4011
Exploitation 4011, Windows Kernel Exploitation: Race + UAF in KTM 11 Winning the Race Condition
Exploitation 4011, Windows Kernel: Race + UAF in KTM 12 1 Privilege Escalation Strategies
Exploitation 4011, Windows Kernel: Race + UAF in KTM 12 2 Lab Arbitrary Read Write
Exploitation 4011, Windows Kernel: Race + UAF in KTM 12 3 Lab Arbitrary Read Write Solution
Exploitation 4011, Windows Kernel Exploitation: Race + UAF in KTM 12 4 Lab Privilege Escalation
Exploitation 4011, Windows Kernel: Race + UAF in KTM 12 5 Lab Privilege Escalation Solution
Exploitation 4011, Windows Kernel Exploitation: Race + UAF in KTM 13 1 Arbitrary Increment Primitive
Exploitation 4011, Windows Kernel Exploitation: Race + UAF in KTM 13 2 Arbitrary Read Primitive
Exploitation 4011, Windows Kernel Exploitation: Race + UAF in KTM 13 3 Arbitrary Increment Trick
Exploitation 4011, Windows Kernel: Race + UAF in KTM 13 4 Privilege Escalation Comparison
Exploitation 4011, Windows Kernel Exploitation: Race + UAF in KTM 13 5 Lab Increment Primitive
Exploitation 4011, Windows Kernel: Race + UAF in KTM 13 6 Lab Increment Primitive Solution