PagedPoolSession challenge

[w4fz5uck5]

Hi, i'm trying for a long time to solve PagedPoolSession challenge, but i can't find a way to heap spraying this vulnerability, also actually there's no solution in source-code exploit path. Please, someone can help me with some hint or explanation about how we can perform this exploit? very thanks and loved all of those other challenges <3

[hacksysteam]

Hi @w4fz5uck5

We used PagedPoolSession overflow in Windows 10 RS2-3 with Bitmap objects for arbitrary read-write. I'm not sure which objects can be used at the moment.

But if you are just looking for exercise, then install Windows 10 RS2 and read more about Bitmap and Palette objects.

https://www.coresecurity.com/core-labs/articles/abusing-gdi-for-ring0-exploit-primitives