{"Id":"ddf661c0-7dfc-4c26-89c5-00cd6a81a139","Tags":["wfshbr64.sys","wfshbr32.sys"],"Verified":"TRUE","Author":"Michael Haag","Created":"2023-06-05","MitreID":"T1068","CVE":["CVE-2022-42046"],"Category":"malicious","Commands":{"Command":"sc.exe create wfshbr64.sys binPath=C:\\windows\\temp\\wfshbr64.sys type=kernel && sc.exe start wfshbr64.sys","Description":"wfshbr64.sys and wfshbr32.sys specially crafted payload allows arbitrary user to perform bitwise operation with arbitrary EPROCESS offset and flags value to purposely elevate the game process to CodeGen Full protection by manipulating EPROCESS.Protection and EPROCESS.SignatureLevel flags (security hole as a feature).\n\nThe driver is signed by Microsoft hardware compatibility publisher that is submitted via Microsoft Hardware Program.","OperatingSystem":"Windows 10","Privileges":"kernel","Usecase":"Elevate privileges"},"Resources":["https://github.com/kkent030315/CVE-2022-42046"],"Detection":[],"Acknowledgement":{"Handle":"","Person":""},"KnownVulnerableSamples":[{"Authentihash":{"MD5":"f143857a68801478dbe4de842a9d4f6a","SHA1":"47063aa084976104d928e2b0f4f4b800adb22c89","SHA256":"b0399dd3c395f84cbd6ac2e3e8ca8ee344a0f699b17db0624f936ae4bb4b7953"},"Company":"","Copyright":"","CreationTimestamp":"2022-11-28 05:10:24","Date":"","Description":"","ExportedFunctions":"","FileVersion":"","Filename":"wfshbr64.sys","ImportedFunctions":["IoDeleteDevice","IoDeleteSymbolicLink","RtlInitUnicodeString","IofCompleteRequest","PsGetCurrentProcessId","IoGetCurrentProcess","IoCreateSymbolicLink","IoCreateDevice"],"Imports":["ntoskrnl.exe"],"InternalName":"","MD5":"b76aee508f68b5b6dccd6e1f66f4cf8b","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"","Product":"","ProductVersion":"","Publisher":"","RichPEHeaderHash":{"MD5":"1cae7fcf3f9627d90b3aa959faa5495d","SHA1":"a6fdd5b1bebd1c134a1ff6e613d9694d2ad2f81d","SHA256":"46e9b36f8db362f22fa5d1fcd13371e9cd34ee5302ea3a7be320d7cf07815bbd"},"SHA1":"0167259abd9231c29bec32e6106ca93a13999f90","SHA256":"b8807e365be2813b7eccd2e4c49afb0d1e131086715638b7a6307cd7d7e9556c","Sections":{".text":{"Entropy":6.360436024553698,"Virtual Size":"0x703"},".rdata":{"Entropy":3.196284553772549,"Virtual Size":"0x120"},".data":{"Entropy":0.20611221646538552,"Virtual Size":"0xe0"},".pdata":{"Entropy":3.280267161802354,"Virtual Size":"0x6c"},".info":{"Entropy":1.5662542468017437,"Virtual Size":"0xa0"},"INIT":{"Entropy":4.1005955318674525,"Virtual Size":"0x12e"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2022-06-07 18:08:06","ValidTo":"2023-06-01 18:08:06","Signature":"0a835e40cdb627d4f0a0d3dbbf64a46a05c132d0b5df9d11cd9c195d7037737057d57a342732ae68d67de47f460e7211c7c40dc29b0a079caff871c4834a9a2fc85e759de9b78659ad6fd79b7320e538e9ba5d52227ad67cc00b0a770ef662af3d743a558643ad89cfb015591709a69b6271a9b65db71898e7cb9964c6376dc474898301a6133198b486b518fdd9d7b9723dcffc441e026833f7c72e27986026c97b9184a0048b10d1fe6847ae467f02173f7a69120be780e5b6b9e6399402cc58735a31b537cc33578fbea443135a4a612359150bcf9ab316f6a9248bc71ef3f3480b9b3fa2341692bc3a121d80214688f7bd87d5ec56dcbd0ea61abf2c7ed2b739a07590adb596d401735d955f5f94c591d69ab4363a42f9fca549d439495711ff7990448c03724792ed4acf31f2b35b136c1b2f37aa82b1aabf7daf059dcb2e976e95311ec6e9cc53876dd09632cf512d39c801849a7c1088a565691953e07c7ff17b22518e982dd2dcc0feda8c834ca1f5e247aef1c3af5f13cd4b8cc1b6c0179bc876db88d677047c34366533e349796dbdea86389ad640710b7742ae8cc4ec88f10fa80ede4b1c93f81b55480fc8228216d54813df0327e74b3db9f3512a40c0568e4215827f9b7a2613deea72a7ec4df2def05e5559015049fe83edc83300526045cb128119e131b7d3573b268e24b0a25b9ad59f6301c8fc8f409322","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"3300000057ee4d659a923e7c10000000000057","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"fdc11a5676aed4e9cc0c09eeb7450dfb","SHA1":"4902077d9a05d4231b791d3b05bafa4a79132f03","SHA256":"5db56c23d83bf67c7152e28ad4a684a7372b4ae4f52afe7a81ce91eef94caec3","SHA384":"c952d7f0e0ea5216ce4400601fb7c0829f0f3fcd6eb2b5b9112fbe45d133e00c4abd660f8e1794f7ac4ef95123e2c0ab"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","ValidFrom":"2014-10-15 20:31:27","ValidTo":"2029-10-15 20:41:27","Signature":"96b5c33b31f27b6ba11f59dd742c3764b1bca093f9f33347e9f95df21d89f4579ee33f10a3595018053b142941b6a70e5b81a2ccbd8442c1c4bed184c2c4bd0c8c47bcbd8886fb5a0896ae2c2fdfbf9366a32b20ca848a6945273f732332936a23e9fffdd918edceffbd6b41738d579cf8b46d499805e6a335a9f07e6e86c06ba8086725afc0998cdba7064d4093188ba959e69914b912178144ac57c3ae8eae947bcb3b8edd7ab4715bba2bc3c7d085234b371277a54a2f7f1ab763b94459ed9230cce47c099212111f52f51e0291a4d7d7e58f8047ff189b7fd19c0671dcf376197790d52a0fbc6c12c4c50c2066f50e2f5093d8cafb7fe556ed09d8a753b1c72a6978dcf05fe74b20b6af63b5e1b15c804e9c7aa91d4df72846782106954d32dd6042e4b61ac4f24636de357302c1b5e55fb92b59457a9243d7c4e963dd368f76c728caa8441be8321a66cde5485c4a0a602b469206609698dcd933d721777f886dac4772daa2466eab64682bd24e98fb35cc7fec3f136d11e5db77edc1c37e1f6a4a14f8b4a721c671866770cdd819a35d1fa09b9a7cc55d4d728e74077fa74d00fcdd682412772a557527cda92c1d8e7c19ee692c9f7425338208db38cc7cc74f6c3a6bc237117872fe55596460333e2edfc42de72cd7fb0a82256fb8d70c84a5e1c4746e2a95329ea0fecdb4188fd33bad32b2b19ab86d0543fbff0d0f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"330000000d690d5d7893d076df00000000000d","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"83f69422963f11c3c340b81712eef319","SHA1":"0c5e5f24590b53bc291e28583acb78e5adc95601","SHA256":"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae","SHA384":"260ad59ba706420f68ba212931153bd89f760c464b21be55fba9d014fff322407859d4ebfb78ea9a3330f60dc9821a63"}}],"Signer":[{"SerialNumber":"3300000057ee4d659a923e7c10000000000057","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","Version":1}]}],"Imphash":"df43355c636583e56e92142dcc69cc58","LoadsDespiteHVCI":"FALSE"},{"Authentihash":{"MD5":"82a8528c1c8391d38cbd90ba8823f833","SHA1":"0122f7a57784f2ac460d175687450d8940cace6e","SHA256":"d16a59cd7c52d1d32bb43670cdca739aadb19ba15996bac62071845e1bfbdb95"},"Company":"","Copyright":"","CreationTimestamp":"2022-07-01 01:25:32","Date":"","Description":"","ExportedFunctions":"","FileVersion":"","Filename":"wfshbr64.sys","ImportedFunctions":["IoDeleteDevice","IoDeleteSymbolicLink","RtlInitUnicodeString","IofCompleteRequest","PsGetCurrentProcessId","IoGetCurrentProcess","IoCreateSymbolicLink","IoCreateDevice"],"Imports":["ntoskrnl.exe"],"InternalName":"","MD5":"c9d4214c850e0cedf033dc8f0cd3aace","MachineType":"AMD64","MagicHeader":"50 45 0 0","OriginalFilename":"","Product":"","ProductVersion":"","Publisher":"","RichPEHeaderHash":{"MD5":"1cae7fcf3f9627d90b3aa959faa5495d","SHA1":"a6fdd5b1bebd1c134a1ff6e613d9694d2ad2f81d","SHA256":"46e9b36f8db362f22fa5d1fcd13371e9cd34ee5302ea3a7be320d7cf07815bbd"},"SHA1":"b2f5d3318aab69e6e0ca8da4a4733849e3f1cee2","SHA256":"89698cad598a56f9e45efffd15d1841e494a2409cc12279150a03842cd6bb7f3","Sections":{".text":{"Entropy":6.375146124739003,"Virtual Size":"0x677"},".rdata":{"Entropy":3.204288518505729,"Virtual Size":"0x120"},".data":{"Entropy":0.17556101736135615,"Virtual Size":"0xd0"},".pdata":{"Entropy":3.2617486432838354,"Virtual Size":"0x6c"},".info":{"Entropy":1.5240361999132217,"Virtual Size":"0xa0"},"INIT":{"Entropy":4.1005955318674525,"Virtual Size":"0x12e"}},"Signature":"","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher","ValidFrom":"2021-09-09 19:15:59","ValidTo":"2022-09-01 19:15:59","Signature":"1757782e797188079911866d54bd474a2432707984658c549a407e7fb4e5efa2ba72367a02b382d2116d4c4538836ddcd4616fcd231229df1ae5d0da6b3abe499ee5d8b47a7919940f6bbcbe2575018dca65eef4913e3d38410f2cd6cca3082d9ba2c061173cd828635665f76e8f0f685e03da24290b9d2cae7039da974de7b7e85798ba64cbe9ba34e0308c3bd6b4d68e9723fde74274fd3806fe799d04d6a3835f82d4fefc52088ccda4b4c817116f2f5a99445a3e952d78bc27753e65e97c6271c71ac7c9e3439b847e8984ab06a5904d150223f9ca92bbda86c02663c3f4964da5e106619b6eaff2768143cce9e5a8b0b2cba90e82cd87866d9fd6499c6cfbc96529a18b5653d12b54a6c928693a4e3d197ffbfcce7ed71a909b18d09b4345b24bc25eb8dfa1821a9cd0971ffc7d38a26580e2f118c4ac55bf926d0666b72ad7ba6ec20f0b54d694bc3b8a0dbddda27bd64194da085319841d1ebc9dc067ef72ea064a475bea865828b13077bc8e14e2f7544b90f0045f3cd84bcc0d5a80645a6fb65528e4f768ec775bdb0225399f3c81c0b667714676d0949f9ffaddc8549dc45e5ce4345c4ea7dc0aff4ac510f5527ad94a2181edc4b73bcfde813a83d81ca897854c98712346001a12e5d3bf9a45c807f9b3c7d3e0bb99c035ea54ee39e2c9af4147dbea7aabec85b47192b945e083ddf6061afb901e83b11135d24e","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":false,"SerialNumber":"330000004de597a775e3157f7b00000000004d","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"9f0782e89bd41cdd96ec55357457478a","SHA1":"35c2180572baad19019acca1334e6c653699c389","SHA256":"50814710213afec410f26e573d25267a2e21d3d15f158be8a43a666c9cc6fa08","SHA384":"8d48f066b0284071d64bbc556e018824a8388ccd142a56c7b7b04ef6d27cade07da57ac82d8067e18ad64d35af11e2a7"}},{"Subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","ValidFrom":"2014-10-15 20:31:27","ValidTo":"2029-10-15 20:41:27","Signature":"96b5c33b31f27b6ba11f59dd742c3764b1bca093f9f33347e9f95df21d89f4579ee33f10a3595018053b142941b6a70e5b81a2ccbd8442c1c4bed184c2c4bd0c8c47bcbd8886fb5a0896ae2c2fdfbf9366a32b20ca848a6945273f732332936a23e9fffdd918edceffbd6b41738d579cf8b46d499805e6a335a9f07e6e86c06ba8086725afc0998cdba7064d4093188ba959e69914b912178144ac57c3ae8eae947bcb3b8edd7ab4715bba2bc3c7d085234b371277a54a2f7f1ab763b94459ed9230cce47c099212111f52f51e0291a4d7d7e58f8047ff189b7fd19c0671dcf376197790d52a0fbc6c12c4c50c2066f50e2f5093d8cafb7fe556ed09d8a753b1c72a6978dcf05fe74b20b6af63b5e1b15c804e9c7aa91d4df72846782106954d32dd6042e4b61ac4f24636de357302c1b5e55fb92b59457a9243d7c4e963dd368f76c728caa8441be8321a66cde5485c4a0a602b469206609698dcd933d721777f886dac4772daa2466eab64682bd24e98fb35cc7fec3f136d11e5db77edc1c37e1f6a4a14f8b4a721c671866770cdd819a35d1fa09b9a7cc55d4d728e74077fa74d00fcdd682412772a557527cda92c1d8e7c19ee692c9f7425338208db38cc7cc74f6c3a6bc237117872fe55596460333e2edfc42de72cd7fb0a82256fb8d70c84a5e1c4746e2a95329ea0fecdb4188fd33bad32b2b19ab86d0543fbff0d0f","SignatureAlgorithmOID":"1.2.840.113549.1.1.11","IsCertificateAuthority":true,"SerialNumber":"330000000d690d5d7893d076df00000000000d","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"83f69422963f11c3c340b81712eef319","SHA1":"0c5e5f24590b53bc291e28583acb78e5adc95601","SHA256":"d8be9e4d9074088ef818bc6f6fb64955e90378b2754155126feebbbd969cf0ae","SHA384":"260ad59ba706420f68ba212931153bd89f760c464b21be55fba9d014fff322407859d4ebfb78ea9a3330f60dc9821a63"}}],"Signer":[{"SerialNumber":"330000004de597a775e3157f7b00000000004d","Issuer":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2014","Version":1}]}],"Imphash":"df43355c636583e56e92142dcc69cc58","LoadsDespiteHVCI":"FALSE"}]}