{"Id":"bb808089-5857-4df2-8998-753a7106cb44","Tags":["DBUtilDrv2.sys"],"Verified":"TRUE","Author":"Michael Haag","Created":"2023-01-09","MitreID":"T1068","Category":"vulnerable driver","Commands":{"Command":"sc.exe create DBUtilDrv2.sys binPath=C:\\windows\\temp\\DBUtilDrv2.sys type=kernel && sc.exe start DBUtilDrv2.sys","Description":"Dell DBUtilDrv2.sys versions 2.5, 2.6, and 2.7 all contain a write-what-where condition allowing kernel memory read/write. Dell released v2.7 as a remediation for CVE-2021-36276 but the fix was incomplete. Rapid7 confirmed v2.7 retains the kernel memory primitive and published the dellicious PoC and a Metasploit module (post/windows/manage/dell_memory_protect) that works against both v2.5 and v2.7. Dell categorized the v2.7 issue as a weakness rather than a vulnerability, stating it requires admin privileges.","OperatingSystem":"Windows 10","Privileges":"kernel","Usecase":"Elevate privileges"},"Resources":["https://github.com/jbaines-r7/dellicious","https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/","https://www.bleepingcomputer.com/news/security/dell-driver-fix-still-allows-windows-kernel-level-attacks/","https://www.rapid7.com/db/modules/post/windows/manage/dell_memory_protect/"],"Detection":[{"type":"yara_signature","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/71fe5af0f1564dc187eea8d59c0fbc897712afa07d18316d2080330ba17cf009.yara"},{"type":"sigma_hash","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"},{"type":"sigma_names","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"},{"type":"sysmon_hash_detect","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"},{"type":"sysmon_hash_block","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"},{"type":"yara_signature","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/yara/yara-rules_vuln_drivers_strict_renamed.yar"},{"type":"sigma_hash","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers.yml"},{"type":"sigma_names","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sigma/driver_load_win_vuln_drivers_names.yml"},{"type":"sysmon_hash_detect","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes.xml"},{"type":"sysmon_hash_block","value":"https://github.com/magicsword-io/LOLDrivers/blob/main/detections/sysmon/sysmon_config_vulnerable_hashes_block.xml"}],"Acknowledgement":{"Handle":"","Person":""},"KnownVulnerableSamples":[{"Authentihash":{"MD5":"3736439958e5533142648f0d278fe7df","SHA1":"6bc2ab0f03d7a58685a165b519e8fee6937526a6","SHA256":"d7c683ef033ac2dc4dfa0dc61f39931f91c0e8fd19e613f664cb03e14112ef6e"},"Company":"","Copyright":"","CreationTimestamp":"2019-11-19 13:14:20","Date":"","Description":"","ExportedFunctions":"","FileVersion":"","Filename":"DBUtilDrv2.sys","ImportedFunctions":["MmGetSystemRoutineAddress","MmFreeContiguousMemorySpecifyCache","MmAllocateContiguousMemorySpecifyCache","MmUnmapIoSpace","MmMapIoSpace","MmGetPhysicalAddress","RtlCopyUnicodeString","KeSetPriorityThread","KeInsertQueueDpc","IoWMIRegistrationControl","RtlInitUnicodeString","imp_WppRecorderReplay","WppAutoLogStop","WppAutoLogStart","WppAutoLogTrace","WdfVersionUnbindClass","WdfVersionBindClass","WdfVersionUnbind","WdfVersionBind"],"Imports":["ntoskrnl.exe","WppRecorder.sys","WDFLDR.SYS"],"InternalName":"","MD5":"dacb62578b3ea191ea37486d15f4f83c","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"","Product":"","ProductVersion":"","Publisher":"","RichPEHeaderHash":{"MD5":"7f1debacbafd3f259d7a213425c71b5f","SHA1":"9f5421410b697087e15bde4d688b7f33370f386f","SHA256":"cefbbb88c4a69bad4c4a1698a8713d367f533be903326056cfa6fdbf4303e736"},"SHA1":"90a76945fd2fa45fab2b7bcfdaf6563595f94891","SHA256":"2e6b339597a89e875f175023ed952aaac64e9d20d457bbc07acf1586e7fe2df8","Sections":{".text":{"Entropy":6.269072098215991,"Virtual Size":"0x1cb9"},".rdata":{"Entropy":4.66637534411376,"Virtual Size":"0x798"},".data":{"Entropy":0.8066631169807633,"Virtual Size":"0x390"},".pdata":{"Entropy":4.010875946168034,"Virtual Size":"0x1c8"},"PAGE":{"Entropy":6.06807405800903,"Virtual Size":"0x9fc"},"INIT":{"Entropy":5.661977650254811,"Virtual Size":"0x4d8"},".reloc":{"Entropy":3.1733593135475084,"Virtual Size":"0x2c"}},"Signature":["Microsoft Windows Hardware Compatibility Publisher","Microsoft Windows Third Party Component CA 2012","Microsoft Root Certificate Authority 2010"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2019-06-05 18:06:32","ValidTo":"2020-06-03 18:06:32","Signature":"11f64665e99ee9a3212a8317075cf2122256a6cd5452564366da4b3e890c7a94b167d27a0cb1e962de146f371429f531349fc359cccece5f32fa84cd25231f892e44c4676b5ff4008ce6b3f3d9a2690a956a2a6a9e982ba8ebd4256971437156136a25b2e5184e11550aecb83f5ec8ae5467e866d6bbf44b9e8642c8bd5e316a4a494f676aa15eefad41893dd0a7187c881fa235b45f1a0696a8ad2d5c1531eed442d7281290b84f976f9ca241027378c241157a326739b2e8305adbfcef5005f5ccec402c1ab03d6e28c36987ae0d07cd12e41a348098d846f57c3225dbfed0c1b809ad311770854d368d150ee7767676c39a3d148f05cf7c2dcea5f1f7c6f2","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"33000000857f83dc2a6ca979b8000000000085","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"85e8c40624a19ac2076dd91f49d8fb53","SHA1":"621756d2a4e10231e34677a3c0f2a8d1fb0fb7ca","SHA256":"442ba2fb3fc8ab1b1b3c71a45f6ea08ce00cea7eae124ef915d4c17622eb336a","SHA384":"19b80fb83482cdb42c94c2eabac29e4db7777988905aab348bd7ed62e325d2ea1f4c80df0d7275abcb2b67585cfc7c36"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012","ValidFrom":"2012-04-18 23:48:38","ValidTo":"2027-04-18 23:58:38","Signature":"5a8a67daccd5fd0d264177bf0a4678b4b3de12692b7723c2652f015fd203f461ba509d2e8c3972f36c3e6ab11e766decb7f382dcccbbc56970287366173f54ebee011648c446d91b80ae813a8d0f796d68b09eea2d3f39d3ca387ebd5e7c086e19dcc6c2f438336861e2524783e1000156d2bacb878205310a418b4ee77f5f5fed5fd3392d45eba213bffd1ec298417161165fc80a70257c59693124e471e70abb0417f79f721ec9d2bb1abe3d02fe090cb243b4591a99539396215fe0d6b72601429536ac27fdbef48577683d18bdf4be98882211865216f345ec0397107087a37043713cdbc98603170cf5735bc67de15c64edd7c548d7ed32e2d1aad3cfa7f6574e61f977eb67f288b3de00da038fd08a34373e1dd862b8d2b1f3e12f8b723b81967c6ffcec667672601b24f2a0896d5b6d002eef28dd868705c2b4b9e5be64c22af24a155c98e2c42785ff52e3627e0fb2020bd766c70ab2d33d200414503259830a7d9bed5a38120152ba2f5e20728e4af1fde771028c3be107bec973f4dd47d8b4efb4a4b330b9893e76cab90098567eabea8ab8a5d038ab6977130b142fe9aa411ff7babd3a2b348aee0aab63e663f788248e200d2b3b9de3c24952ac9f1f0e393b5dd46e506ae67d523aaa7c3315290d265e0158a74ea93d7a846f743f609fe4324f3600af6d71d33ea646655f8174f1fec171da4ca0415a82ddf11f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"610baac1000000000009","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"a569061297e8e824767dbc3184a69bea","SHA1":"adbb26a587a8f44b4fccaecb306f980d1c55a150","SHA256":"cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46","SHA384":"e947cac936803f5683196e4ff1b259096073395d0b908522ddce90d57597c9f7b57f7ddcdbe021ba863d843c340da8ba"}}],"Signer":[{"SerialNumber":"33000000857f83dc2a6ca979b8000000000085","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012","Version":1}]}],"Imphash":"f138fdbc6c7fbf73e135717c7d7eac27","LoadsDespiteHVCI":"TRUE"},{"Authentihash":{"MD5":"1e96108c0938d4c34d7072f04bc8b951","SHA1":"d46ae9bcc746ca408fbb55fb0d61b638720a8f25","SHA256":"7bacb353363cc29f7f3815a9d01e85cd86202d92378d1ab1b11df1ab2f42f40a"},"Company":"Dell","Copyright":"© 2021 Dell Inc. All Rights Reserved. ","CreationTimestamp":"2021-05-06 19:20:18","Date":"","Description":"DBUtil","ExportedFunctions":"","FileVersion":"","Filename":"DBUtilDrv2.sys","ImportedFunctions":["MmMapIoSpace","MmUnmapIoSpace","MmAllocateContiguousMemorySpecifyCache","KeSetPriorityThread","MmGetPhysicalAddress","KeBugCheckEx","KeInsertQueueDpc","RtlCopyUnicodeString","IoWMIRegistrationControl","MmGetSystemRoutineAddress","MmFreeContiguousMemorySpecifyCache","RtlInitUnicodeString","WdfVersionBind","WdfVersionUnbind","WdfVersionUnbindClass","WdfVersionBindClass"],"Imports":["ntoskrnl.exe","WDFLDR.SYS"],"InternalName":"","MD5":"d104621c93213942b7b43d65b5d8d33e","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"","Product":"DBUtil","ProductVersion":"2.7.0.0","Publisher":"","RichPEHeaderHash":{"MD5":"55da99917deafbd2428eba37ab352764","SHA1":"72420433a55e6c3b3dd02e90ad238c5f5f632344","SHA256":"7c8e32c30b6f8a981e4b54696e979a23cc9662b6440c2c8833494bc6d17cd9fe"},"SHA1":"b03b1996a40bfea72e4584b82f6b845c503a9748","SHA256":"71fe5af0f1564dc187eea8d59c0fbc897712afa07d18316d2080330ba17cf009","Sections":{".text":{"Entropy":6.230478937617782,"Virtual Size":"0x1039"},".rdata":{"Entropy":4.642223343654196,"Virtual Size":"0x754"},".data":{"Entropy":0.808730421176234,"Virtual Size":"0xfe0"},".pdata":{"Entropy":3.9589762468524823,"Virtual Size":"0x1bc"},"PAGE":{"Entropy":6.243717098384845,"Virtual Size":"0x118c"},"INIT":{"Entropy":5.874007861559603,"Virtual Size":"0x47a"},".rsrc":{"Entropy":3.174963077143067,"Virtual Size":"0x2c0"},".reloc":{"Entropy":3.2464393446710145,"Virtual Size":"0x28"}},"Signature":["Microsoft Windows Hardware Compatibility Publisher","Microsoft Windows Third Party Component CA 2012","Microsoft Root Certificate Authority 2010"],"Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2020-12-15 22:15:33","ValidTo":"2021-12-02 22:15:33","Signature":"0d2d53cd15a8feddcb17e2df1bf7dc1aef21e98c6cd220f58b593824849c134a0f1add59ce42ef80ddf47860273013604d9568ec5894a797bd4e571432a9aaf10ab04dd1c038b26ab7c5ca3a9c88d009267fab56254525546a0a055fb37b9cd8029c7d501809fc8b11482c7a4347b3ad29f35427c9570e87117db52cc94864259274b9e2e758f918a3af1fdb9f9d40ffa3ae2e2ae012fb97a436258642a2a4223dc6690db88103a6e5220646bd8afb3d12eb894ac28b527396a1965408487f6ab878b3c474b8c960842861ae8e799a3d2a8d6f918f50f8e26bb1ed6ced47be36e447574e8568582964ff31cd288b9c7f8d7e6a46d6c3d92f5c101fe1522a720c","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"33000000b5213fca1e4aa03de40000000000b5","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"a0dd89c33c4973bf6758331e200fb6de","SHA1":"65ff7fa429c0f08f8a8bf30509e8ca2919d9edb5","SHA256":"29a7b646af062aee3bf37d1ba190211365116db7d7aa4cb87ba268843262ae47","SHA384":"a7ac729302762483ea304ff2660a2ce2f5fa67cbbfc3f6df32a8feafa3852812c9bb8f7050140079aad1dec8119ee88e"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012","ValidFrom":"2012-04-18 23:48:38","ValidTo":"2027-04-18 23:58:38","Signature":"5a8a67daccd5fd0d264177bf0a4678b4b3de12692b7723c2652f015fd203f461ba509d2e8c3972f36c3e6ab11e766decb7f382dcccbbc56970287366173f54ebee011648c446d91b80ae813a8d0f796d68b09eea2d3f39d3ca387ebd5e7c086e19dcc6c2f438336861e2524783e1000156d2bacb878205310a418b4ee77f5f5fed5fd3392d45eba213bffd1ec298417161165fc80a70257c59693124e471e70abb0417f79f721ec9d2bb1abe3d02fe090cb243b4591a99539396215fe0d6b72601429536ac27fdbef48577683d18bdf4be98882211865216f345ec0397107087a37043713cdbc98603170cf5735bc67de15c64edd7c548d7ed32e2d1aad3cfa7f6574e61f977eb67f288b3de00da038fd08a34373e1dd862b8d2b1f3e12f8b723b81967c6ffcec667672601b24f2a0896d5b6d002eef28dd868705c2b4b9e5be64c22af24a155c98e2c42785ff52e3627e0fb2020bd766c70ab2d33d200414503259830a7d9bed5a38120152ba2f5e20728e4af1fde771028c3be107bec973f4dd47d8b4efb4a4b330b9893e76cab90098567eabea8ab8a5d038ab6977130b142fe9aa411ff7babd3a2b348aee0aab63e663f788248e200d2b3b9de3c24952ac9f1f0e393b5dd46e506ae67d523aaa7c3315290d265e0158a74ea93d7a846f743f609fe4324f3600af6d71d33ea646655f8174f1fec171da4ca0415a82ddf11f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"610baac1000000000009","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"a569061297e8e824767dbc3184a69bea","SHA1":"adbb26a587a8f44b4fccaecb306f980d1c55a150","SHA256":"cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46","SHA384":"e947cac936803f5683196e4ff1b259096073395d0b908522ddce90d57597c9f7b57f7ddcdbe021ba863d843c340da8ba"}}],"Signer":[{"SerialNumber":"33000000b5213fca1e4aa03de40000000000b5","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012","Version":1}]}],"Imphash":"506a31d768aec26b297c45b50026c820","LoadsDespiteHVCI":"TRUE"}]}