In this document is detailed technique of exploiting Windows kernel. But writer is talking about accessing kernel memory & doing exploit from user-mode application at the same time. Can I do this from user-mode application, or do I need to do it from driver? Thanks.
You need admin rights to normally get code into the kernel, and code is usually executed by a driver. Code in user mode cannot by design execute in kernel, so you have to find a bypass vulnerability to get past the user-mode barrier. If you can find such a vulnerability you can execute from user mode.
Other attack vectors are to find an EOP vulnerability, elevate to admin, and install a malicious driver.
The document uses Windows API (
NtOpenThreadToken ...) to have the pointer of Kernel Objects like _EPROCESS, _TOKEN, OBJECT_HEADER. This is done from User land.
Knowing the pointer address allows altering these object, but this can be done from the Kernel land only, for example by exploiting a Driver or a some Kernel API vulnerability that could allow for arbitrary write.