Microsoft Windows - 'POP/MOV SS' Privilege Escalation

Author: Can Bölük
type: local
platform: windows
port: 
date_added: 2018-05-22 
date_updated: 2018-07-13 
verified: 1 
codes: CVE-2018-8897 
tags: 
aliases:  
screenshot_url:  
application_url: 

Demo exploitation of the POP SS vulnerability (CVE-2018-8897), leading to unsigned code execution with kernel privilages.

- KVA Shadowing should be disabled and the relevant security update should be uninstalled.
- This may not work with certain hypervisors (like VMWare), which discard the pending #DB after INT3.

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44697.zip