Skip to content
Home

Windows kernel privilege escalation

Find missing patches with WES-NG or Windows Exploit Suggester, then run the matching kernel exploit to reach SYSTEM.

msfconsole·1 min read··INE Certification

When UAC bypass or token impersonation isn’t available, kernel exploitation is the nuclear option for Windows privilege escalation as it targets an unpatched kernel vulnerability to run arbitrary code at SYSTEM level.

Step 1: gather system info from your existing low-priv session

# From a meterpreter shell
shell
systeminfo  # This outputs a full report on the windows system
exit

# Or from a plain cmd.exe
systeminfo > C:\Temp\sysinfo.txt

Step 2: identify missing patches → candidate exploits

# WES-NG
wes.py --update
wes.py sysinfo.txt --muc-lookup

# Metasploit's built-in suggester
use post/multi/recon/local_exploit_suggester
set SESSION <id>
run

# Try getsystem first as it attempts a few automated techniques
getsystem

Step 3: search for and run the matching exploit module

# Inside msfconsole
search platform:windows local privilege escalation
search cve:2019 platform:windows local

use <exploit_module>
set SESSION <id>
run
  • Always confirm the exact Windows build (systeminfo → OS Version and Build Number) before picking an exploit.
  • Run the checker/suggester before the exploit module, and test against a throwaway session before a production target if possible.
  • The Windows Kernel Exploits collection organizes public PoC code by CVE if you need a standalone exploit instead of an MSF module.