- leaking `rtlSetAllBits()` address on ring0 by leaking the base address of `ntoskrnl.exe` module via `EnumDeviceDrivers()` function.
8
8
- crafting the gadget's parameter `BitMapHeader` in such a way that will allow us to overwrite the `access_token.privileges` of the exploit.
9
9
- allocating the crafted `BitMapHeader` via `NtSetInformationThread()` primitive and leaking the allocation address in the big pool via `NtQuerySystemInformation()` function with `SystemBigPoolInformation` parameter.
10
-
- to interact with the vulnerable function we first enum printers on the system via `EnumPrinters()` load one of them then hook the calls to the usermode callback function `DrvEnablePDEV()`whileproxyingtheothercallstothedriver.
10
+
- to interact with the vulnerable function we first enum printers on the system via `EnumPrinters()` load thedriverofoneofthemone of them then hook the calls to the usermode callback function `DrvEnablePDEV()`.
11
+
- in the hook we proxy the call to the original `DrvEnablePDEV()` function, do the exploit stuff then return whats returned from the proxied call to the GDI.
11
12
- triggering the UAF via a second call to `ResetDC()` in the hooked `DrvEnablePDEV()`.
12
13
- reclaim the freed `PDC` object via spraying a crafted object of the same size using the `CreatePalette()` primitive.
13
14
- abusing the new aquired `SeDebugPrivilege` privilege to get `NT AUTHORITY\SYSTEM` via injecting shellcode to `winlogon.exe` process.
