{"Id":"a7d2a088-b00b-4f5c-96ca-7a98070dddd5","Tags":["RCFlCtrl.sys"],"Verified":"TRUE","Author":"Andrea Monzani","Created":"2026-10-25","MitreID":"T1068","Category":"vulnerable driver","Commands":{"Command":"sc.exe create RCFlCtrl binPath=C:\\windows\\temp\\RCFlCtrl.sys type=kernel && sc.exe start RCFlCtrl","Description":"RCFlCtrl.sys, labeled as \"RedCastle Control Driver\", is a vulnerable kernel driver that can be used to terminate arbitrary processes via IOCTL 0x85000158","Usecase":"Elevate privileges","Privileges":"kernel","OperatingSystem":"Windows 10"},"Resources":["https://doi.org/10.1016/j.cose.2026.105194"],"Detection":[],"Acknowledgement":{"Person":"Andrea Monzani, Davide Netti, Antonio Parata","Handle":""},"KnownVulnerableSamples":[{"Filename":"RCFlCtrl.sys","MD5":"e53dd75097a7afbb9bdf68713d47df01","SHA1":"8f0cb2d25448e326f4dcdb0d452b968938383d49","SHA256":"04bdcd0c70fb07e1c551be3078cf0e82cf53dd4dba3752b74e5db4a715933d16","Imphash":"e6952bf01526fcb4c51de27a2dd72f93","Authentihash":{"MD5":"21bcb4976b54a45dda39a23df45fa4e8","SHA1":"8350ef2c3d6e4a89674b70fd77735015156e1318","SHA256":"7a91bee028b7db8d24a406115c973a3d05e8403d8dda50293a802f5e7610ae97"},"RichPEHeaderHash":{"MD5":"01b15724a35610fe5fc3abfd7d2a65bd","SHA1":"fc4e632f0320373a70f45616a6469f4c2184064b","SHA256":"bdb7061981edd672beb18cc3e6e129616c81aeb95a1269542fcf4b11f1fb2efd"},"Sections":{".text":{"Entropy":6.264028074769076,"Virtual Size":"0x13282"},".rdata":{"Entropy":5.119024646599587,"Virtual Size":"0xa90"},".data":{"Entropy":0.9617069852488362,"Virtual Size":"0xc44"},".pdata":{"Entropy":4.904960046345334,"Virtual Size":"0x87c"},"INIT":{"Entropy":5.191098235722947,"Virtual Size":"0x6b2"},".rsrc":{"Entropy":3.326830882969923,"Virtual Size":"0x408"},".reloc":{"Entropy":1.6437323213424917,"Virtual Size":"0x140"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2019-11-28 11:55:45","Description":"","Company":"","InternalName":"","OriginalFilename":"","FileVersion":"","Product":"","ProductVersion":"","Copyright":"","MachineType":"AMD64","Imports":["ntoskrnl.exe"],"ExportedFunctions":"","ImportedFunctions":["ExAllocatePoolWithTag","ExFreePoolWithTag","RtlCopySid","strncpy","IoGetCurrentProcess","_stricmp","ExAcquireResourceExclusiveLite","_strnicmp","KeLeaveCriticalRegion","RtlEqualSid","KeEnterCriticalRegion","ExReleaseResourceLite","_vsnprintf","RtlCompareMemory","ExDeleteResourceLite","MmIsAddressValid","ExInitializeResourceLite","ExAcquireResourceSharedLite","ProbeForWrite","PsSetCreateProcessNotifyRoutine","ExReleaseFastMutex","ExAcquireFastMutex","KeInitializeEvent","ExSystemTimeToLocalTime","RtlTimeToTimeFields","PsLookupProcessByProcessId","PsReferenceImpersonationToken","PsReferencePrimaryToken","ZwClose","ZwOpenProcess","ObfDereferenceObject","ZwTerminateProcess","ObOpenObjectByPointer","RtlLengthSid","strrchr","RtlValidSid","ZwQueryInformationToken","RtlTimeToSecondsSince1970","RtlInitUnicodeString","RtlUnicodeStringToAnsiString","DbgPrint","IoBuildDeviceIoControlRequest","IoDeleteSymbolicLink","IoDeleteDevice","MmMapLockedPagesSpecifyCache","IoGetDeviceObjectPointer","IofCompleteRequest","IoCreateSymbolicLink","IoCreateDevice","IofCallDriver","KeBugCheckEx","__C_specific_handler"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=BE, O=GlobalSign nv,sa, CN=GlobalSign CodeSigning CA , G3","ValidFrom":"2016-03-16 00:00:00","ValidTo":"2024-03-16 00:00:00","Signature":"3b41bbc84f561182b719e3d96dc185ae9e690ec84326234b8d44c8e87d5f070e5341d563444a890bb874ac7db578792f8426e2d7f7bad1ae2dfd69cffa7c64dc24162a4adac097a9bbd5dd88e7a1929a0aa5f6f7bace85d6e4e3d455deeddc3e211f1bc87788cffc65fb05b48f12a630d30d66982f6c2e6f85187c8ff5f6fbb1ab10e183270885b07321ba5d2cba8330b73984dd5db67fd28bb455534c42a2bc4a6c78395b631ca37827bfbe34836b6d7b1e60fbc29b0d88ac8c72546bdc3b88ba81525e689783b8ce7fa3cdf9ea2f2676facd0b06ac4344497bf64c9442b2abcfd542d51942696e618664c7b37d078bdbe5767b6e5f65a91690a2cee4ae6492","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"47c30ffefc22bb280f96fea75251","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"729cf4baceff4ef7aa199ad4f4ebed3d","SHA1":"f478f0e790d5c8ec6056a3ab2567404a991d2837","SHA256":"c3c88c2a500cb5a97abca837193a5bd382f6eb3aeb0008edbce65ea2a3dbfd5c","SHA384":"e62bbb1ba1ad3df59f2c7265df5576af6b5d4a7473b74985a9d956975fdfc517ffbdd2172b0e3ea36befcb6a9026c872"}},{"Subject":"C=KR, ST=Seoul, L=Songpa,gu, O=SGA Solutions Co.,Ltd., CN=SGA Solutions Co.,Ltd.","ValidFrom":"2019-09-03 09:01:34","ValidTo":"2020-03-12 10:54:49","Signature":"6674c0e6cad1da00533615c9b55cde28b2ec70e87c79ef4b0ac42ba8f9dfcfd5089decb50847483514f9932efc4c4a15910b146c7964c57a2908d44cf7d3fb47831624df02568fae2b6e44576fa92e3a58dda1cdd39ee818e8bb9a53dc0d8e7b3a4ad43d3dfec76594b06a8faffaa6fd921b28a2520c605cfd6f1bf1c33715bf4c6541c1a86bead7061c1ed490d6a40b2d4b1efadac55f5c23d299e41f4ca1c7c1aa43e747ca45e4005395b0dfbb42c7654d6fe4ed04fcca315b77b8be4899141a9ce7989128a304acec48f0e697ea6e366dd75433764bf655e21da76ea9e8051d9cdb67ced904768ab602ecd573463db313f81f7baa71fb34b3914f9ed1b430","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"6fcfa41675d1daa89f179f1f","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"aa5d3e22c156f6cfdb8ed59422525d13","SHA1":"1ad656e68dff090a37260b60f7af1588aa480e22","SHA256":"3ba492559bca582ab5e511fc88c572d92a7e3fa3c3ab98156b91b96332393693","SHA384":"af7948987ffcb5e06f76573f4ea261c381e2dfe5e0cf71ed3a6a6723e32e32cf4080f5a4261e448f896f3a9c044c205e"}},{"Subject":"C=BE, O=GlobalSign nv,sa, OU=Root CA, CN=GlobalSign Root CA","ValidFrom":"2011-04-15 19:55:08","ValidTo":"2021-04-15 20:05:08","Signature":"5ff8d065746a81c6a6ca5b03b6914ae84bbdef2ba142f0efb4a5adcd3389ec0b9585ac62501108aa58d25aa08310e5a6337af25af2c5fe787cf09c83df190ad97396002dd62ccde914d41d9de83f3c1a76f7904efb01350a6c9313a0c356eb67a0e4d17a96dec267f190f80a7bf5321b94ec5f751f8d1b34da6c58a7cb2d279e2226b7c9aa30cc0777b836e38201b5393ccc8dd9a75f7f23b3877fdb5798918bd7ce2520e39d644fdd87f72b68490318e0a5df7c5f68644d36838d4781f2e9e0a869abfa7b163c05a449ea8830190a6c73055178dfd41ddd3ad47f2de44e54be83431e7a7433b4a4ebd77073bc2a02988966eef6bc8f749378e329025a5a43e258ce7ccf9acad236893be25fda26054ec8d4e72c910e1797c5beee8b13112323294ffa83d050f6bafad53db3173df4ff034aa325dce67561d1fa35086bd62744d068b78d45e0eb852cc8a15d614474160e5958aed2b5eea5bcd6d7076ab62978fd976767dd8d4f17944fd2ed0caf972437c3a29c81da6be143b6577b4cecbf791319e79fe844e94781b75e701e91f83dd17b27f50b7056434805dda92fab86101d0b12e31ad04c6e75ded645b30b748887935c564a41029af7aeb799d8b67f88fa11f2457cf4d71b91c01cf1a0fbd4080a411a142acef4eb34486e66879ed54b7a397fbb0e3d3861cf735706e412066bd96b5308cd7018c22d4f974691bca9f0","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"6129152700000000002a","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"0bb058d116f02817737920f112d9fd3b","SHA1":"fd116235171a4feafedee586b7a59185fb5fd7e6","SHA256":"f970426cc46d2ae0fc5f899fa19dbe76e05f07e525654c60c3c9399492c291f4","SHA384":"c0df876be008c26ca407fe904e6f5e7ccded17f9c16830ce9f8022309c9e64c97f494810f152811ae43e223b82ad7cc6"}}],"Signer":[{"SerialNumber":"6fcfa41675d1daa89f179f1f","Issuer":"C=BE, O=GlobalSign nv,sa, CN=GlobalSign CodeSigning CA , G3","Version":1}]}]}]}