Select a matching application, driver or kernel exploit

Needs: Affected build/patch/architecture, required service/driver/configuration and compatible exploit assumptions

PowerShell commands

# Baseline
Get-ItemProperty 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*',
                 'HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*' -ErrorAction SilentlyContinue |
  Select-Object DisplayName,DisplayVersion,Publisher,InstallLocation

Windows commands

REM Baseline
systeminfo
driverquery /v

Prefer deterministic credential/permission/configuration paths. Then verify exact privileged application or driver version/configuration. Use kernel exploits last after exact build, architecture, cumulative update, mitigations, prerequisites, source and crash risk are checked. Avoid Win32_Product; it is slow and can trigger MSI repair.

Verify → Verify target hostname and resulting effective token; preserve reviewed PoC modifications privately.

If it fails → A crash or compilation success does not prove escalation. Wrong build, missing driver or mitigations require another supported path. More detail ↓

If → then

A product/version clue, advisory or component-specific public PoC → Match a public exploit to the actual component and configuration
Needs: Exact vulnerable build/configuration, required access and endpoint behavior; reviewable source and a verifiable expected effect
An existing C/C++ or platform-specific PoC matches the candidate → Compile and minimally adapt an existing native or memory-corruption PoC
Needs: Correct compiler/target architecture, runtime dependencies, documented payload constraints and validated exploit-specific constants
A new Windows session or claimed administrator/SYSTEM transition → Establish Windows token, host and process context
Needs: A functioning command channel and the actual effective token/process context

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Select a matching application, driver or kernel exploit

USE WHEN: An exact vulnerable local component is present after simpler paths are assessed
STARTING ACCESS: A verified Windows foothold with a known token, integrity level and groups
RESULT: A justified local exploit and independently verified higher-privilege result

Recognize the clue

Collect OS build/patch and relevant installed driver/application versions before comparing any local-exploit requirement.

Get-ComputerInfo | Select-Object OsBuildNumber,OsArchitecture
Get-HotFix
Get-CimInstance Win32_SystemDriver | Select-Object Name,State,PathName

SYNTHETIC EXAMPLE OUTPUT

OS build: BUILD
Driver: DRIVER_NAME at DRIVER_PATH
Affected driver version: not yet established

Means: The exact component/build is the candidate evidence; an OS-family name or one missing KB is insufficient.

Confirm: Verify vendor patch state, required driver/service/feature, architecture and PoC assumptions.

After validation: The affected configuration and compatible reviewed artifact are confirmed: select the bounded exploit test.
Ruled out in this context: The driver/feature is absent or the installed version is fixed: reject that candidate.
Still inconclusive: An incomplete update inventory leaves vulnerability unconfirmed.

Troubleshooting: A crash or compilation success does not prove escalation. Wrong build, missing driver or mitigations require another supported path.

Additional prerequisite checks

Get-ComputerInfo | Select-Object WindowsProductName,WindowsVersion,OsBuildNumber
Get-HotFix
Get-CimInstance Win32_SystemDriver | Select-Object Name,State,PathName

Prefer deterministic credential/permission/configuration paths. Then verify exact privileged application or driver version/configuration. Use kernel exploits last after exact build, architecture, cumulative update, mitigations, prerequisites, source and crash risk are checked. Avoid Win32_Product; it is slow and can trigger MSI repair.

Why it works

OS family names and missing-update lists are candidate evidence. Vendor patch state, driver version and mitigations determine applicability.

Worked example · hypothetical

Observation: an enumerator names a driver exploit. Test: inspect the installed driver version and exploit requirements. Illustrative output: the required driver is absent. Interpretation: reject the route and return to permission/application evidence.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗