Exploiting a Windows 10 PagedPool Off-by-One Overflow (WCTF 2018)

A single byte written past the end of a PagedPool allocation in a Windows 10 x64 kernel driver, followed all the way to SYSTEM. The target is searchme.sys from the WCTF 2018 "Searchme" challenge, and the route taken deliberately avoids pool metadata entirely. Large kernel pool chunks are page-aligned and frequently adjacent, so the stray byte lands on the first byte of the neighbouring object — a…