{"Id":"51808fa6-89a4-4f4d-aabc-0a7b0e99e34d","Tags":["kdriver.sys"],"Verified":"TRUE","Author":"Michael Haag","Created":"2023-07-22","MitreID":"T1068","CVE":[""],"Category":"vulnerable driver","Commands":{"Command":"","Description":"Confirmed vulnerable driver from Microsoft Block List","OperatingSystem":"Windows","Privileges":"kernel","Usecase":"Elevate privileges"},"Resources":["https://gist.github.com/mgraeber-rc/1bde6a2a83237f17b463d051d32e802c"],"Detection":[{"type":"","value":""}],"Acknowledgement":{"Handle":"","Person":""},"KnownVulnerableSamples":[{"Authentihash":{"MD5":"ff295de93e6b6dcc3938d50901a7240d","SHA1":"484c72dd4fd91083b249f3ccc733a3c8335e583f","SHA256":"0c7809ac1fa074408518ddc0ac118912c9cd43ed9c89213bc4d59043016b040c"},"Company":"","Copyright":"","CreationTimestamp":"2020-08-16 23:38:03","Date":"","Description":"","ExportedFunctions":"","FileVersion":"","Filename":"","ImportedFunctions":["NtQuerySystemInformation","RtlInitUnicodeString","ExAllocatePool","ExAllocatePoolWithTag","ExFreePoolWithTag","IofCompleteRequest","IoCreateDevice","IoCreateSymbolicLink","IoDeleteDevice","IoDeleteSymbolicLink","_wcsicmp","RtlInitString","RtlAnsiStringToUnicodeString","RtlFreeUnicodeString","IoGetDeviceObjectPointer","ZwClose","MmIsAddressValid","ZwOpenDirectoryObject","ZwQueryDirectoryObject","ObReferenceObjectByName","ZwQuerySystemInformation","__C_specific_handler","MmHighestUserAddress","IoDriverObjectType","KeQueryTimeIncrement","KeStackAttachProcess","KeUnstackDetachProcess","PsGetProcessWow64Process","PsGetProcessPeb","MmUnlockPages","MmGetSystemRoutineAddress","MmUnmapLockedPages","IoFreeMdl","ZwTerminateProcess","PsGetProcessImageFileName","ObOpenObjectByPointer","PsReferenceProcessFilePointer","IoQueryFileDosDeviceName","ZwQueryVirtualMemory","MmProbeAndLockPages","PsLookupProcessByProcessId","MmMapLockedPagesSpecifyCache","IoAllocateMdl","IoGetCurrentProcess","MmCopyVirtualMemory","KeClearEvent","KeSetEvent","KeWaitForSingleObject","MmMapLockedPages","ObReferenceObjectByHandle","PsSetCreateProcessNotifyRoutineEx","PsSetCreateThreadNotifyRoutine","PsRemoveCreateThreadNotifyRoutine","PsSetLoadImageNotifyRoutine","PsRemoveLoadImageNotifyRoutine","ExEventObjectType","ObRegisterCallbacks","ObUnRegisterCallbacks","ObGetFilterVersion","IoThreadToProcess","strcmp","PsProcessType","PsThreadType","RtlGetVersion","ObfReferenceObject","ObGetObjectType","ExEnumHandleTable","ExfUnblockPushLock","_snprintf","vsprintf_s","ZwCreateFile","ZwWriteFile","PsLookupThreadByThreadId","NtQueryInformationThread","PsGetThreadProcess","DbgPrint","KeDelayExecutionThread","KdDisableDebugger","KdChangeOption","PsCreateSystemThread","PsTerminateSystemThread","KdDebuggerEnabled","PsGetVersion","KeInitializeEvent","RtlCopyUnicodeString","ObfDereferenceObject","ExReleaseFastMutex","ExAcquireFastMutex","MmBuildMdlForNonPagedPool","WdfVersionBindClass","WdfVersionBind","WdfVersionUnbind","WdfVersionUnbindClass"],"Imports":["ntoskrnl.exe","WDFLDR.SYS"],"InternalName":"","MD5":"70053ab9df31eb2dcd6f5b001386a8d2","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"","PDBPath":"","Product":"","ProductVersion":"","Publisher":"","RichPEHeaderHash":{"MD5":"ffdf660eb1ebf020a1d0a55a90712dfb","SHA1":"3e905e3d061d0d59de61fcf39c994fcb0ec1bab3","SHA256":"2b3f99a94b7a7132854be769e27b331419c53989ef42f686d6f5ba09ddefefd6"},"SHA1":"b1266873fa36a2104fd5d7f498a9957bc3d9d450","SHA256":"603ccc97a198b004f9fa56deed2295d1b2d42ef01f22d80a00cb28bcf1b85646","Sections":{".text":{"Entropy":6.183070832014416,"Virtual Size":"0x6ed0"},".rdata":{"Entropy":4.768973580594352,"Virtual Size":"0x159c"},".data":{"Entropy":0.807954115503613,"Virtual Size":"0x15f8"},".pdata":{"Entropy":7.83996638727823,"Virtual Size":"0x684"},"PAGE":{"Entropy":5.929327209049661,"Virtual Size":"0xb7a"},"INIT":{"Entropy":5.3523212488458185,"Virtual Size":"0xe54"},".upx0":{"Entropy":7.037246397744446,"Virtual Size":"0x124190"},".reloc":{"Entropy":3.9077681077271933,"Virtual Size":"0xcc"},".rsrc":{"Entropy":2.9056718289000636,"Virtual Size":"0x22c"}},"Signature":"","Signatures":{},"Imphash":"a74f61fdcea718cb9579907b2caf54ab","LoadsDespiteHVCI":"FALSE"}]}