> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/windows/windows-privilege-escalation/when-userland-isnt-enough-kernel-exploits.md).

# When Userland Isn't Enough: Kernel Exploits

Once code crosses into kernel or kernel-adjacent execution, normal user controls stop helping much. That often means `SYSTEM`, arbitrary file operations, credential access, driver loading, or direct interaction with protected OS components.

In Windows privilege escalation, this class of bug is especially valuable for three reasons:

1. It can turn a low-privileged foothold into full local compromise.
2. It often bypasses assumptions built around user-mode isolation.
3. It can expose strong post-exploitation primitives, not just code execution.

## Why this matters in practice

You do not always need a classic memory corruption bug in `ntoskrnl.exe` for a "kernel exploit" to be operationally useful. In real engagements, the more important question is this: **does the bug let you break a boundary enforced by the OS itself?**

That boundary might involve the kernel, a privileged service, a driver path, or a protected filesystem action. If it does, the result is often the same — you move from constrained user access to meaningful system control.

## Examples

* [HiveNightmare](/breakpoint/windows/windows-privilege-escalation/when-userland-isnt-enough-kernel-exploits/cve-2021-36934-hivenightmare.md) shows how readable shadow copies can expose the `SAM`, `SYSTEM`, and `SECURITY` hives. That turns a permissions mistake into credential theft and rapid privilege escalation.
* [PrintNightmare](/breakpoint/windows/windows-privilege-escalation/when-userland-isnt-enough-kernel-exploits/cve-2021-1675-printnightmare.md) shows how a trusted driver installation path can be abused to load attacker-controlled code as `SYSTEM`.
* [CVE-2020-0668](/breakpoint/windows/windows-privilege-escalation/when-userland-isnt-enough-kernel-exploits/cve-2020-0668.md) shows why even an arbitrary file move can be enough. A small primitive can still become full compromise when the OS performs the action with elevated rights.

## Takeaway

Kernel exploits are important because they collapse defensive layers quickly. They let an attacker convert limited access into durable control over the host.

That is why patch level, driver exposure, and privileged service behavior matter so much during Windows privilege escalation.