drivers vulnerabilities can allow an attacker to execute arbitrary code in the kernel mode. The goal of kernel or driver exploitation is often to somehow gain higher privileges (in the most cases SYSTEM). Possible kernel shellcodes, that can be used for LPE: • Token stealing (replacing token of some process with SYSTEM token); • Nulling out ACLs (null DACL means that everybody can access an object); • Changing objects’ ACLs (gives full access to arbitrary object, e.g. to the process with SYSTEM privileges, disable auditing); • Changing tokens (new groups, new “super” privileges, increasing integrity level, changing user SID);