{"Id":"1ab1ec8c-1231-4ba4-8804-4a2cda103bb8","Tags":["gametersafe.sys"],"Verified":"TRUE","Author":"Michael Haag","Created":"2023-07-22","MitreID":"T1068","CVE":[""],"Category":"vulnerable driver","Commands":{"Command":"","Description":"Confirmed vulnerable driver from Microsoft Block List","OperatingSystem":"Windows","Privileges":"kernel","Usecase":"Elevate privileges"},"Resources":["https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"],"Detection":[{"type":"","value":""}],"Acknowledgement":{"Handle":"","Person":""},"KnownVulnerableSamples":[{"Authentihash":{"MD5":"406e0fb11faa06f2f417c75310932f75","SHA1":"39f934078a060bad2d58b5dba8f8884903d697a7","SHA256":"3e9b62d2ea2be50a2da670746c4dbe807db9601980af3a1014bcd72d0248d84c"},"Company":"","Copyright":"","CreationTimestamp":"2020-02-08 04:17:56","Date":"","Description":"","ExportedFunctions":"","FileVersion":"","Filename":"","ImportedFunctions":["IoDeleteSymbolicLink","RtlImageNtHeader","RtlInitAnsiString","MmGetSystemRoutineAddress","ExAllocatePoolWithTag","IoCreateDevice","MmFreePagesFromMdl","ExFreePoolWithTag","MmMapLockedPagesSpecifyCache","IofCompleteRequest","ZwQueryInformationFile","MmAllocatePagesForMdl","ZwClose","__C_specific_handler","MmUnlockPages","MmProbeAndLockPages","IoFreeIrp","IoAllocateMdl","KeSetEvent","IoFreeMdl","IoAllocateIrp","KeInitializeEvent","KeWaitForSingleObject","ZwWriteFile","IoDeleteDevice","RtlInitUnicodeString","_vsnprintf","RtlFreeUnicodeString","RtlRandomEx","ZwCreateFile","ZwQuerySystemInformation","RtlImageDirectoryEntryToData","RtlCopyUnicodeString","RtlAnsiStringToUnicodeString","ExAllocatePool","IoCreateSymbolicLink","RtlCompareUnicodeString","WskCaptureProviderNPI","WskRegister","WskReleaseProviderNPI","WskDeregister","WdfVersionBind","WdfVersionBindClass","WdfVersionUnbind","WdfVersionUnbindClass"],"Imports":["ntoskrnl.exe","NETIO.SYS","WDFLDR.SYS"],"InternalName":"","MD5":"7d0b8d03f0c985e27e5dc7263fa3f0ae","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"","PDBPath":"","Product":"","ProductVersion":"","Publisher":"","RichPEHeaderHash":{"MD5":"14a8a59145530d446445ab8773b70769","SHA1":"2a1725f87c33b0ce9056410d2f7d87f2e949a337","SHA256":"1d4731833137290604bc7b4cf7e5c46113a41673141fdf195b7d12d72180d1fb"},"SHA1":"d057e709ae69b3bbb66e199b0e0858429790f995","SHA256":"e2ec3b2a93c473d88bfdf2deb1969d15ab61737acc1ee8e08234bc5513ee87ea","Sections":{".text":{"Entropy":5.501194029641816,"Virtual Size":"0x1f20"},".rdata":{"Entropy":4.049029918506814,"Virtual Size":"0x7cc"},".data":{"Entropy":0.6333325201297626,"Virtual Size":"0xf80"},".pdata":{"Entropy":7.347119965741041,"Virtual Size":"0x1b0"},"INIT":{"Entropy":5.119013096767569,"Virtual Size":"0x64a"},".vmp0":{"Entropy":7.023334874263105,"Virtual Size":"0x12b6c0"},".reloc":{"Entropy":3.84520519396212,"Virtual Size":"0xcc"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA","ValidFrom":"2011-04-15 19:45:33","ValidTo":"2021-04-15 19:55:33","Signature":"208cc159ed6f9c6b2dc14a3e751d454c41501cbd80ead9b0928b062a133f53169e56396a8a63b6782479f57db8b947a10a96c2f6cbbda2669f06e1acd279090efd3cdcac020c70af3f1bec787ed4eb4b056026d973619121edb06863e09712ab6fa012edd99fd2da273cb3e456f9d1d4810f71bd427ca689dccdd5bd95a2abf193117de8ac3129a85d6670419dfc75c9d5b31a392ad08505508bac91cac493cb71a59da4946f580cfa6e20c40831b5859d7e81f9d23dca5b18856c0a86ec22091ba574344f7f28bc954aab1db698b05d09a477767eefa78e5d84f61824cbd16da6c3a19cc2107580ff9d32fde6cf433a82f7ce8fe1722a9b62b75fed951a395c2f946d48b7015f332fbbdc2d73348904420a1c8b79f9a3fa17effaa11a10dfe0b2c195eb5c0c05973b353e18884ddb6cbf24898dc8bdd89f7b393a24a0d5dfd1f34a1a97f6a66f7a1fb090a9b3ac013991d361b764f13e573803afce7ad2b590f5aedc3999d5b63c97eda6cb16c77d6b2a4c9094e64c54fd1ecd20ecce689c8758e96160beeb0ec9d5197d9fe978bd0eac2175078fa96ee08c6a2a6b9ce3e765bcbc2d3c6ddc04dc67453632af0481bca8006e614c95c55cd48e8e9f2fc13274bdbd11650307cdefb75e0257da86d41a2834af8849b2cfa5dd82566f68aa14e25954feffeaeeefea9270226081e32523c09fcc0f49b235aa58c33ac3d9169410","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"61204db4000000000027","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"8e3ffc222fbcebdbb8b23115ab259be7","SHA1":"ee20bff28ffe13be731c294c90d6ded5aae0ec0e","SHA256":"59826b69bc8c28118c96323b627da59aaca0b142cc5d8bad25a8fcfd399aa821","SHA384":"f2dab7e56a33298654924501499487f6ba72c7d9477476a186e1ed7a9be031fade0e35ac09eff5e56bbbab95ae5374e7"}},{"Subject":"C=CN, ST=, L=, O=, OU=, CN=","ValidFrom":"2019-07-02 00:00:00","ValidTo":"2020-07-08 12:00:00","Signature":"bbe447c3c9823460c47f5f8015ac71baf97943df9fb662e2a359f35f116c0701139e659661e758f5a5c8fcc0f7a41cb19b6328a357c2fe27492365f70c98c71bb943693f6120749ebaf0fb8d92d43623b37ed9f2c56003f054b090d85220febcf15a0e6261f05326b62bb9685b8e2b51dba2fde2407231f1fa44b1110c318611d4ea8e2c0f93cc6fe1886f5fa9ac8528aab31cee82f20dd3d1488633aa93a7fbb1d13b3b1871e567f59b312d6f56564656421b2bb2691d3b7ecbf9f5ee87bbd5927308269e0316c6573c7c84770ebd999f5a7379f55093b05591b1a78a3aded16995248aad311d675fafa73a860f95e0ec16516c22dfc8194d524ac5898e04ad","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"0c59d46580f039af2c4ab6ba0ffed197","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"87b3e146e36d621cfa581f15a59a08de","SHA1":"5f65a1d664ca1ca64b7634143bad885981e94d0c","SHA256":"b20fb8bcfcf6b544cbabc685aa3c19f61918f96a05192cd2987e897e13a9344c","SHA384":"3e298d8234d5106393c8146940d42b52e09ff15022ab512c6ac87164d4b1a9f7a0193c779198020ba923380a44f043b8"}},{"Subject":"C=US, O=DigiCert, CN=DigiCert Timestamp Responder","ValidFrom":"2014-10-22 00:00:00","ValidTo":"2024-10-22 00:00:00","Signature":"9d257e1b334db226815c9b86ce23200f8087e588ffffb1d46a2c31ed3a17197117cda91bbc5a1639009de36c84e45a40fbde06018c37fa9bb19d247efe20a457ad5bb79ab06026ea6957215d342f1f71b0839419056b359010a07b97c7f63fe7e21141a6bd62d9f0273d381d286f3a5209f0ec7062d3624bb0e073a692c0d38e31d82fe36d171306eee403b614abf38f43a7719d21dd14ca155d9241daf90f81d199740d26c40e7f1bb5f5a0f1c677062815e9d893e55516f0bb0aab1cdb5c482766c8a38b0a1ce595daaec42e59a061dddaf36da261e98a0b6dec1218bdf755544003922b6bc251c20a48afb0d46ee0f4140a3a1be38f3dcaaf6a8d7bdcd844","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"03019a023aff58b16bd6d5eae617f066","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"a752afee44f017e8d74e3f3eb7914ae3","SHA1":"8eca80a6b80e9c69dcef7745748524afb8019e2d","SHA256":"82560fa7efec30b5ff82af643e6f3bf3d46868bbd5e7d76f93db185e9e3553a1","SHA384":"e8b11408c88f877ade4ca51114a175fb5dfd2d18d2a66be547c1c9e080fa8f592c7870e30dfab1c04d234993dd0907f3"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance Code Signing CA,1","ValidFrom":"2011-02-11 12:00:00","ValidTo":"2026-02-10 12:00:00","Signature":"49eb7c60beaeefc97cb3c5ba4b64df1669e286fa29d9de98857d406626332f4455aaaa90e935700a34bed3ae542e8e6500d67a32203e6c26b898a939b1bc95c7aae9f5ee4666c6b3e812f8b3979dff74588234997550ac448fe892ce7d8b0f3196c7dcd31130987416c6e56b4576a39401cd33007a48f66f8631c9562b3322d5f801b644ce8cb4ca88d2e416e3e7f6e23ee109c09d7943437f555c05ad9310c62c0d6bc09eea78e5d277d6b8da9a987fba4c922b9dbda488b1ddafc34cd2979b03c6ae5f1b440f333715e3cbff2f56d316a45b55679da2cadb346c0c734ab57ba4b6b3e935027870ec007acbfc4b4f2236bb1484c98f91dd0f3c758cca0b88e7","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"02c4d1e58a4a680c568da3047e7e4d5f","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"829995f702421dea833a24fb2c7f4442","SHA1":"1d7e838accd498c2e5ba9373af819ec097bb955c","SHA256":"92914d016cc46e125e50c4bd0bd7f72db87eed4ba68f3c589b4e86aa563108db","SHA384":"dbb72e38c3bc17b08aa00535ebd48502058ce6ecfd24bd4dd45c7b33e3d523510a4a649d86dfc77436c58754bd0754ea"}},{"Subject":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID CA,1","ValidFrom":"2006-11-10 00:00:00","ValidTo":"2021-11-10 00:00:00","Signature":"46503ec9b72824a7381db65b29af52cf52e93147ab565c7bd50d0b41b3efec751f7438f2b25c61a29c95c350e482b923d1ba3a8672ad3878ac755d1717347247859456d1ebbb368477cc24a5f3041955a9e7e3e7ab62cdfb8b2d90c2c0d2b594bd5e4fb105d20e3d1aa9145ba6863162a8a833e49b39a7c4f5ce1d7876942573e42aabcf9c764bed5fc24b16e44b704c00891efcc579bc4c1257fe5fe11ebc025da8fefb07384f0dc65d91b90f6745cdd683ede7920d8db1698c4ffb59e0230fd2aaae007cee9c420ecf91d727b716ee0fc3bd7c0aa0ee2c08558522b8eb181a4dfc2a21ad49318347957771dcb11b4b4b1c109c7714c19d4f2f5a9508291026","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"06fdf9039603adea000aeb3f27bbba1b","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"4e5ad189638cf52ba9cd881d4d44668c","SHA1":"cdc115e98d798b33904c820d63cc1e1afc19251d","SHA256":"37560fb9d548ab62cc3ed4669a4ab74828b5a108e67e829937ffb2d10a5f78dd","SHA384":"173bfb77183785621ef15f43ea807338cea6a02e8183317d9ef050c7237adda3fa2a5bdcd5a4c96da9f2c55900675b9f"}}],"Signer":[{"SerialNumber":"0c59d46580f039af2c4ab6ba0ffed197","Issuer":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance Code Signing CA,1","Version":1}]}],"Imphash":"120ea3462d2c279afe9f2bc72643da04","LoadsDespiteHVCI":"FALSE"}]}