Join us at hack.lu 2026 — Info & Registration
Duration: 30 min
Type: Talk
Speakers: Juan Sacco
Abstract
This session presents a modern Windows 11 exploit chain for achieving kernel code execution on systems with VBS, HVCI, and kCET enabled, using SSDT and Shadow SSDT hook-based techniques.
Beginning with a recap on Windows Kernel structures and components, then diving into vulnerable kernel driver behavior and vulnerability hunting, we will show how to identify and abuse kernel read/write primitives, reasoning about mitigation, and transform primitives into reliable kernel code execution.
Description
The talk covers current exploit classes under VBS/HVCI/kCET, including data-only attacks and the reach of them when combined with data-only-gadgets, kernel object manipulation, suspended-thread based execution, COP/JOP and ROP in kernel context and SSDT and Shadow SSDT table-hooking techniques.
We will also introduce the custom tooling and plugins built during this research, explain why existing tools were insufficient, and release the tooling on GitHub. Case studies will include real-world vulnerabilities and zero-days discovered during the project.
The session ends with a live demo on a hardened Windows 11 system with VBS, HVCI, and kCET enabled, demonstrating a complete exploit chain resulting in NT AUTHORITY\SYSTEM access, data-only-gadgets and arbitrary kernel code execution through SSDT and Shadow SSDT hooks.