Hitch a free ride to Ring 0 on Windows. Why exploit 0-days when you can exploit kn0wn-days?
https://zerosum0x0.blogspot.com/2017/07/puppet-strings-dirty-secret-for-free.html
You will need to obtain a copy of capcom.sys. Some code borrowed from https://github.com/tandasat/ExploitCapcom