{"Id":"1ce0aa79-8719-447c-908b-75547f2ccc98","Tags":["SysFile_X64.sys"],"Verified":"TRUE","Author":"Michael Haag","Created":"2026-04-17","MitreID":"T1068","Category":"vulnerable driver","Commands":{"Command":"sc.exe create SysFile_X64 binPath=C:\\windows\\temp\\SysFile_X64.sys type=kernel && sc.exe start SysFile_X64","Description":"SysFile_X64.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode.","Usecase":"Elevate privileges","Privileges":"kernel","OperatingSystem":"Windows 10"},"Resources":["https://github.com/magicsword-io/LOLDrivers/issues/325","https://github.com/KeServiceDescriptorTable/vulnerable-drivers"],"Detection":[],"Acknowledgement":{"Person":"","Handle":"@rainbowdynamix, @DbgPrint"},"KnownVulnerableSamples":[{"Filename":"SysFile_X64.sys","MD5":"9ddff9a4ec7e38e4e05fd16e2b1037ff","SHA1":"b980dec0bdf7b0925240d002626e56876afeec72","SHA256":"5b204e0a24b5ea67e79329a8c4eb0513cd52a0e7407b99530323fff4c5b59e34","Signature":"","Date":"","Publisher":"","Company":"","Description":"","Product":"","ProductVersion":"","FileVersion":"","MachineType":"AMD64","OriginalFilename":"","Authentihash":{"MD5":"79ce391f46d8dcd51232db3c3e53241a","SHA1":"96c3b210c05511481b8490535828d4ef2ee73a09","SHA256":"fdd8e305c7aaaf1c8ef047373db48069126a6f3ec9dc3c6b2dc30fc621c84b03"},"RichPEHeaderHash":{"MD5":"39942df5b3c8bb85b97243f4cbf3ea69","SHA1":"c577d1281948e59fdf429906e917ac8c2ba95c04","SHA256":"28d01fabc734eaa3e48a564092f73f2e59146e246e5044269d1fcb514d86526a"},"Sections":{".text":{"Entropy":6.445989857270667,"Virtual Size":"0x39bc"},".rdata":{"Entropy":4.839598906980494,"Virtual Size":"0xfdc"},".data":{"Entropy":1.381129998079401,"Virtual Size":"0x4e8"},".pdata":{"Entropy":4.168752708833916,"Virtual Size":"0x2b8"},"PAGE":{"Entropy":6.2122353477284395,"Virtual Size":"0x1c8c"},"INIT":{"Entropy":4.982962064724441,"Virtual Size":"0x5fe"},".reloc":{"Entropy":3.6963562746565986,"Virtual Size":"0x38"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2024-09-29 03:10:26","InternalName":"","Copyright":"","Imports":["ntoskrnl.exe","HAL.dll","WDFLDR.SYS"],"ExportedFunctions":"","ImportedFunctions":["__C_specific_handler","MmGetSystemRoutineAddress","IoDeleteSymbolicLink","ZwClose","ZwSetSecurityObject","IoDeviceObjectType","IoCreateDevice","ObOpenObjectByPointer","RtlGetDaclSecurityDescriptor","RtlGetGroupSecurityDescriptor","RtlGetOwnerSecurityDescriptor","RtlGetSaclSecurityDescriptor","ExFreePoolWithTag","SeCaptureSecurityDescriptor","_snwprintf","IoDeleteDevice","SeExports","RtlCreateSecurityDescriptor","_wcsnicmp","ExAllocatePoolWithTag","wcschr","RtlAbsoluteToSelfRelativeSD","RtlAddAccessAllowedAce","RtlLengthSid","IoIsWdmVersionAvailable","RtlSetDaclSecurityDescriptor","ZwOpenKey","ZwSetValueKey","ZwQueryValueKey","ZwCreateKey","RtlFreeUnicodeString","IoCreateSymbolicLink","IofCompleteRequest","MmUnmapIoSpace","RtlCopyUnicodeString","MmMapIoSpace","DbgPrintEx","RtlLengthSecurityDescriptor","RtlInitUnicodeString","HalGetBusDataByOffset","HalSetBusDataByOffset","WdfVersionBind","WdfVersionUnbind","WdfVersionUnbindClass","WdfVersionBindClass"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=BE, O=GlobalSign nv,sa, OU=Root CA, CN=GlobalSign Root CA","ValidFrom":"1998-09-01 12:00:00","ValidTo":"2028-01-28 12:00:00","Signature":"d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"040000000001154b5ac394","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"fd24b9ad19e04280e429def1dc76b718","SHA1":"5a6d07b6371d966a2fb6ba92828ce5512a49513d","SHA256":"e836109d8138d686c7a4662cceb810cc397c795d5779d70d6c40a315a08db7af","SHA384":"abc87089506939c28cc4601abbdd96d4b024448425a2b1f171d41fc9ac46d83f8e566873ce3519bbaa45d9e88cff332e"}},{"Subject":"OU=GlobalSign Root CA , R3, O=GlobalSign, CN=GlobalSign","ValidFrom":"2018-09-19 00:00:00","ValidTo":"2028-01-28 12:00:00","Signature":"2370e9cfe2bef559ae94426fc44333aacd3f3ab96417f262064b48f140880617a1feabd15f3cc633f2f38edd1f1d3ecc1a6099820bacc7fc7e9a872aa57d0fa657eeac3b6a85d6debd4063f8ada6c888b012fcf641df0f09971e38ea539fbe05f43eead39f501276be098bc20b487d1e2e51f68d53d3ab1f401b8a8eed7dfb4f7956705f0cd38e1bb3a7700d372b9795abdae0126b1c40cec5c77eedc26258ec77ed7322c28af5864388adea136efdd8fe422fb97d5ead18ef9490ca3d27ab26949975c7cbd37bf7ca4cd3af5121925b847d2b9f153f74cb51e89e830e166f1be746ce23bdf9e4a28bd2396baa791c912ce261242d8e2a487090c41ec5e8e070","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"01ee5f169dff97352b6465d66a","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"51c3959a45cecf3d21a3effb05762573","SHA1":"ecfcd25fd0525448a74875ba271566bc0bfbf061","SHA256":"de1da11668f0a8d5e13346ed3ab2755f5d25bebffcfd1d0bde5b9f87bc292c91","SHA384":"f0eab75baf1f24a53d63bd795cd07292a312f603513c8cb0f40fe5acbdb477ed72607d309fad21471a16f6223fb3a838"}},{"Subject":"C=BE, O=GlobalSign nv,sa, CN=GlobalSign Code Signing Root R45","ValidFrom":"2020-07-28 00:00:00","ValidTo":"2029-03-18 00:00:00","Signature":"acf7cc158b3079a81d0b28881909d71c7ffe86bd7b5a336e0d670e7b62d9e1185cb0bd135d1d23ae39507637aa44fd5f01235986564cccadbc64131430a420a8e03fe89c72dc7ef3d80c23baa82daa3cf6ec9f87310765f539a7518275e1f22f97f6d1e165968364fea11d51fbb5249bf5d27769bc852c5cfa5877d1aea7b10be2d677bba9b4344aa96f3df4f30d955de6f97a45b02517312edbf70f68e6831fa9f7e5d49d988cd3614b2fc3287e7ade930eb47da00a6d92c4b4663f7da758eeacf7ecc30801ab38fc0a1ca9c597b288c8090219f65c9a1af14d6c30d4b306ab0060480d78abcf17ad9293622077756cbdc832b4dc4debd9dfc1909629bdc17f","SignatureAlgorithmOID":"1.2.840.113549.1.1.12","IsCertificateAuthority":true,"SerialNumber":"7803184245708a41cf6f01b8eeb4a954","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"a33260428269bc902bc1cd280e4b1837","SHA1":"254209ca172cffcc67bd2a88996556d2f09538f0","SHA256":"a67411358594f2cf016741a63fd49f36de917f86531b3e3a43eb6a421c654868","SHA384":"fec727af43d1569995cea26e8eb97167165842a5b185304425a92c03b71254c5d51222837515f33e60cb8ed2e8c625ba"}},{"Subject":"C=BE, O=GlobalSign nv,sa, CN=GlobalSign GCC R45 EV CodeSigning CA 2020","ValidFrom":"2020-07-28 00:00:00","ValidTo":"2030-07-28 00:00:00","Signature":"2575a009c939bab7a139892f189fabd6eb1d4be8947c0d07689b1c9def71b6176a6b024fb33f864587cc659b4ce35806022266d56102c5638fd4a2f1b65e250b7796e9cd7140338829eceef3a26dbc4db53e064bc97333ca08142d3d4ce8b0ba75a6742da4583a6c1349f8a5150a149685b16a68342542af9656f410fa247df12b72c116e16bebe6a998c73e5af4d0189dfd74978677462a3d237d28738aaeef2b1b9abf6c53a7149e3c8771c05e8ec8fbd32a9233ea574d5e075ecac118ac812d1a21fa6ecf97617bdf717a3aca63f7d530443732febb4385dcbafca6ca33192b776ddbcb05f07e5f752ea2b6bf35aa3663c9ce64d9bdfcbc2cf3495600c8122bc627bb37af57efc4cf1e29c4f4e22dce2a61cf57edf50a40e2f518d61ee9902fcad3875f938a481a111de537859f2e66629a5e814e95ac555743dc538b257e3c610f8a0bbaf53fa6d78ef704565e21bb9fd76a7180bf96de7203d8d8222bf327164f38e851400cae92efbe3d7df780c64c36578495a7841548300e5227088d8ea2bd22c719c9a6ca0ea87a36db6aba615f112495a4e28e68ee19a949995ed0b434bdd6f940c710973152393529118724d3c4fba963cb7748d5fa62fc24e0047a4ed0e46edece9e385026f4217165d70925d4c907007ab8c7f377e8c5d4e255d0d31ef67f52e2498db911720c88442633660144dfe4330e21de62894807daf5","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"77bd0e05b7590bb61d4761531e3f75ed","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"65fd1dac1f115d9507f4e1840c8cb36a","SHA1":"c7cf5607e19b22fe60c055e71d9b555d70f71f66","SHA256":"d9c7db0b704f07089440c56e69a0f31d730edf77cfbf7514630e8b5390a270fe","SHA384":"defe810317bd1215b4d1ee0ec8a5fb38b21d094ef1173cae670956cd899232638e4f9473fd947bd550a4a77300bbb2ab"}},{"Subject":"BUSINESS_CATEGORY=Private Organization, serialNumber=914401067695460534, JURISDICTION_OF_INCORPORATION_C=CN, JURISDICTION_OF_INCORPORATION_SP=Guangdong, JURISDICTION_OF_INCORPORATION_L=Guangzhou, C=CN, ST=广东省, L=广州市, STREET_ADDRESS=天河区华夏路30号1205,1212房, O=广州商科信息科技有限公司, CN=广州商科信息科技有限公司","ValidFrom":"2023-10-30 08:04:18","ValidTo":"2024-10-30 08:04:18","Signature":"79b8ef28dc0f2014fda666d523cc689b092d5b3e6227564dae987938df2a238886b3f33d83ada2a4cc45c218a0cf15747028ea598e706b1bd82b48e3813ac6e5e281991b4f7c484bd9726ec732280f78c7a9148c6d83845ae62786dc8a052d7380dd90051f8c04250e6ccf3abfb50a843e6c6e4e0a5aaa0e36d5fbe7c010e5e4ee5b140cff539a923f2a68ea41a062ee84aa11c60ad13a8c0d5b3c7621e677c4fba8178f8e8ab1f6459a5568cd1a10e6a2468abf68d7fda45587e1b26ba93a2ece122e343fb0ca36a0b5348dcdc279a75cebd11437c06f423a9cc912e0a7ffc8f16f4d2074a7734861c7c89f06ed8876cc35cbae0f3c8911327b21a2af0b09bafaffa408a74b3351a166d7977fd8abedc574f0bf07594824e6e1e8e3b54caa8c6ff7a4aeb316235d968c0fe070ab6c331dc431113013c6492c746209679b5ac514fd2bde465bb64672772774c76d82bb2f657f1ab43e0a07d4b38764afe7ab920a6e91e8ea9fa532ab1511d3f654aab5bbfb739fe168364bece0207af3448a2a6a3ccee96d27678e69e137cb51d9994b544cd2595c42e950d59243d815779e97f8b9b5af37afacfae2e3d9bd8f68c5018dae784fd5922d0abe5a66f43bbcd795fc6fa0d96f6ab9eac93e1a36e8c7ce334359589345480ec5e2a931ff1cedced25ca9ddb954ede0331cab6b29318eb30c7b52c853f2a892846044bfe8b588a4da","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"43133f1fd45b5fda266fc028","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"1bd663ea88470d89c6e064fc3c082de9","SHA1":"3c132a5e26eb9a25df7df13a05c382b7fea814e4","SHA256":"927ffa67d6b31c46c83a97f0efe2bb8f524ffb599b8087cca65ad84a5f2e7dd1","SHA384":"9d08c36d891a9938f16b4cc7ea47313746624f6c79bd6bdf705b789ff02148c62c2c63cb8ba47c62330a25e8f8c64c9a"}}],"Signer":[{"SerialNumber":"43133f1fd45b5fda266fc028","Issuer":"C=BE, O=GlobalSign nv,sa, CN=GlobalSign GCC R45 EV CodeSigning CA 2020","Version":1}]}],"LoadsDespiteHVCI":"FALSE","Imphash":"f7455c9aef32ded0c517c29637a75058"}]}