Share on

Journey to freedom: Escaping from VirtualBox and Unchaining Objects in the Windows Kernel

REGISTER

Talk overview:

Exploiting a hypervisor is already a challenge ; chaining it with a Windows kernel LPE to achieve full host compromise makes it even harder. At Pwn2Own Vancouver 2024, we broke free from VirtualBox and escalated our privileges on the Windows host, turning a controlled guest VM into full administrator access on the host.

The first part of our journey focuses on a VirtualBox escape: how we identified and exploited multiple vulnerabilities, bypassed mitigations, and executed arbitrary code on the host. The second half will cover our privilege escalation on the host Windows’ kernel, achieved by ingeniously exhausting the OS memory to force a specific allocation failure, while keeping the whole system alive.

We’ll conclude with an inside look at the Pwn2Own contest itself: our exploit setup, the hardware surprises, and how everything came together. If you’re into hypervisor and kernel exploitation, or just enjoy a good hacking war story, this talk is for you.

Corentin Bayet is the CTO of REverse Tactics and a seasoned security researcher with over 7 years of experience in vulnerability research and exploitation. His expertise lies in low-level technologies, including operating systems, kernels, and hypervisors. Corentin has publicly demonstrated multiple VM escapes at high-profile events like Pwn2Own. He has also delivered talks and papers on bug hunting in virtualization and exploitation on Windows kernel.
REGISTER
Corentin Bayet
CTO of REverse Tactics and a seasoned security researcher with over 7 years of experience in vulnerability research and exploitation
Corentin Bayet is the CTO of REverse Tactics and a seasoned security researcher with over 7 years of experience in vulnerability research and exploitation. His expertise lies in low-level technologies, including operating systems, kernels, and hypervisors. Corentin has publicly demonstrated multiple VM escapes at high-profile events like Pwn2Own. He has also delivered talks and papers on bug hunting in virtualization and exploitation on Windows kernel.