> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/windows-vulnerabilities/kernel-exploitation.md).

# Windows 内核利用

Windows 内核利用针对可将用户上下文提升为更高权限的本地漏洞。在测试漏洞利用之前，务必先确定确切版本、架构和已安装补丁。

```cmd
systeminfo
```

内核漏洞利用威力强大，但也很脆弱。在检查凭据、服务、计划任务、令牌权限和应用程序配置错误之后再使用它们。

## 基线检查

```cmd
systeminfo | findstr /B /C:"OS Name" /C:"OS Version" /C:"System Type"
wmic qfe list brief
whoami /priv
```

保存完整 `systeminfo` 输出以供离线分析：

```cmd
systeminfo > C:\Windows\Temp\systeminfo.txt
```

## 漏洞利用建议工具

在可能的情况下，从你的攻击机上运行建议工具，然后手动验证每一个候选项。

```bash
python3 wes.py --update
python3 wes.py systeminfo.txt --exploits-only
searchsploit windows kernel local
```

如果允许文件传输，目标主机上的辅助工具会很有用：

```cmd
Watson.exe
winPEASx64.exe systeminfo
```

## 常见旧版目标

| 漏洞              | 常见目标范围                                | 备注                             |
| --------------- | ------------------------------------- | ------------------------------ |
| `MS16-032`      | Windows 7-10 / Server 2008-2012 R2    | Secondary Logon 问题。在测试前确认补丁状态。 |
| `MS15-051`      | Windows 7 / 8.1 / Server 2008-2012 R2 | Win32k 本地权限提升。架构很重要。           |
| `CVE-2018-8120` | Windows 7 SP1 / Server 2008 R2 SP1    | 检查相关的 2018 安全汇总更新。             |
| `CVE-2019-0803` | 较旧的未打补丁 Windows 7-10 版本               | 验证确切版本和漏洞利用的可靠性。               |

## 安全说明

* 在运行任何东西之前，先匹配操作系统版本、架构、语言和缺失的 KB 补丁。
* 优先使用经过源码审查或在实验室测试过的构建版本，而不是随意下载的预编译二进制文件。
* 对于不稳定的漏洞利用，出现崩溃是可以预期的；在实验室环境中尽可能创建快照。
* 记录漏洞利用名称、哈希、来源、目标版本和结果，以便报告。

<table data-view="cards" data-full-width="false" data-search="false"><thead><tr><th></th><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><h3><i class="fa-server" style="color:$primary;">:server:</i></h3></td><td><h4>Windows Server 2012 - MS16-032</h4></td><td>在易受攻击的 Windows Server 2012 R2 实验室目标上利用 MS16-032 Secondary Logon 本地权限提升。</td><td><a href="/pages/13589544d2642822c716149d9b109c7c2341c4dd">/pages/13589544d2642822c716149d9b109c7c2341c4dd</a></td></tr><tr><td><h3><i class="fa-windows" style="color:$primary;">:windows:</i></h3></td><td><h4>Windows 7 Enterprise - MS11-046</h4></td><td>在未打补丁的 Windows 7 Enterprise 实验室目标上验证 MS11-046 本地权限提升。</td><td><a href="/pages/e890570225fd98d7c8467f887176b6e33e5dbe43">/pages/e890570225fd98d7c8467f887176b6e33e5dbe43</a></td></tr><tr><td><h3><i class="fa-server" style="color:$primary;">:server:</i></h3></td><td><h4>Windows Server 2003 - Churrasco</h4></td><td>在兼容的 Windows Server 2003 实验室目标上使用 Churrasco 进行本地权限提升。</td><td><a href="/pages/1820fb0abd8014a307f5b847ec8540d01561f80c">/pages/1820fb0abd8014a307f5b847ec8540d01561f80c</a></td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/windows-vulnerabilities/kernel-exploitation.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.