Home/Talks/From User to SYSTEM: How I Exploited a Vulnerable Kernel Driver

From User to SYSTEM: How I Exploited a Vulnerable Kernel Driver

Name: From User to SYSTEM: How I Exploited a Vulnerable Kernel Driver
Uploaded: 2026-11-07T00:00:00.000Z
Duration: 1 h 44 min 22 s
Channel: Vojtěch Hron
Description: How I wrote a privilege escalation exploit from scratch for a real signed Windows driver, ktapi.sys. From kernel foundations - protection rings, virtual and physical memory, page tables, through reverse engineering in Ghidra and stealing the SYSTEM token to a working PoC. I close with the defenses that actually work against this class of attack, abused by ransomware too: HVCI, WDAC, LOLDrivers.

CzechOpenAlt 2026November 7, 20261 h 44 min

Download the videoMP4 · 460 MBSlidesPDF · 2 MB

How I wrote a privilege escalation exploit from scratch for a real signed Windows driver, ktapi.sys. From kernel foundations - protection rings, virtual and physical memory, page tables, through reverse engineering in Ghidra and stealing the SYSTEM token to a working PoC. I close with the defenses that actually work against this class of attack, abused by ransomware too: HVCI, WDAC, LOLDrivers.