{"Id":"f4e00816-97a8-4c2d-b990-9812f16fe3d3","Tags":["athpexnt.sys"],"Verified":"TRUE","Author":"Michael Haag","Created":"2026-03-20","MitreID":"T1068","Category":"vulnerable driver","Commands":{"Command":"sc.exe create ATHpExNt binPath=C:\\windows\\temp\\ATHpExNt.sys type=kernel && sc.exe start ATHpExNt","Description":"AhnLab kernel driver exposing arbitrary physical memory read/write via IOCTL 0x81000000. Device accessible at \\\\.\\ATHpEx. Signed by AhnLab Inc. with VeriSign certificate (first seen 2014). Zero detections (0/73) on VirusTotal but exploitable for privilege escalation by mapping attacker-controlled physical memory into kernel address space.","Usecase":"Elevate privileges","Privileges":"kernel","OperatingSystem":"Windows 10"},"Resources":["https://github.com/magicsword-io/LOLDrivers/issues/255"],"Detection":[],"Acknowledgement":{"Person":"","Handle":""},"KnownVulnerableSamples":[{"Filename":"ATHpExNt.sys","MD5":"bf77a19e1396d6d36e32ff8d23eb5d3f","SHA1":"e630a14b4c74264cbe702999f78750ec49359ca4","SHA256":"fa0902daefbd9e716faaac8e854144ea0573e2a41192796f3b3138fe7a1d19f1","Signature":["AhnLab, Inc.","VeriSign Class 3 Code Signing 2010 CA","VeriSign Class 3 Public Primary Certification Authority - G5"],"Date":"2012-04-29 20:42:46","Publisher":"AhnLab, Inc.","Company":"AhnLab, Inc.","Description":"Sample Driver (AMD64)","Product":"AhnLab Security Product","ProductVersion":"7.0.0.0","FileVersion":"1,0,0,2","MachineType":"AMD64","OriginalFilename":"ATHpExNt.sys","Authentihash":{"MD5":"2beabc796f5ba54d9cb08c6db2aa2490","SHA1":"4cd5fa8a875644fc803013dc4bfb116b13d70dc1","SHA256":"fc22650cae4722a174da31addbaf088a04ad4f8b2460191da946b3de529f6a0a"},"RichPEHeaderHash":{"MD5":"f24fecff070d6de48f8452f084ca59a2","SHA1":"f5a1c90789bff98da7f5b31dfbe4eedcb430f7c6","SHA256":"71626f35f23efa838db49ff74d9788a1f7784ebdae11b7885c3994eb4365fe3b"},"InternalName":"ATHpExNt.sys","Copyright":"Copyright(C) 2005 AhnLab, Inc.","Imports":["ntoskrnl.exe"],"ImportedFunctions":["IoDeleteDevice","IoDeleteSymbolicLink","RtlInitUnicodeString","IofCompleteRequest","IoCreateSymbolicLink","IoCreateDevice","__C_specific_handler","MmUnmapIoSpace","MmMapIoSpace","MmGetPhysicalAddress","MmUnlockPages","MmMapLockedPagesSpecifyCache","IoFreeMdl","MmProbeAndLockPages","IoAllocateMdl"],"ExportedFunctions":"","Sections":{".text":{"Entropy":5.01,"Virtual Size":"0x74e"},".rdata":{"Entropy":4.09,"Virtual Size":"0x150"},".data":{"Entropy":0.7,"Virtual Size":"0x128"},".pdata":{"Entropy":3.21,"Virtual Size":"0x60"},"INIT":{"Entropy":4.88,"Virtual Size":"0x25c"},".rsrc":{"Entropy":3.32,"Virtual Size":"0x368"}},"MagicHeader":"50 45 0 0","CreationTimestamp":"2012-04-29 20:42:46","Imphash":"3bac3002e583d000a28f76a62f67bfed","Signatures":[{"CertificatesInfo":"","SignerInfo":"","Certificates":[{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer , G2","ValidFrom":"2007-06-15 00:00:00","ValidTo":"2012-06-14 23:59:59","Signature":"50c54bc82480dfe40d24c2de1ab1a102a1a6822d0c831581370a820e2cb05a1761b5d805fe88dbf19191b3561a40a6eb92be3839b07536743a984fe437ba9989ca95421db0b9c7a08d57e0fad5640442354e01d133a217c84daa27c7f2e1864c02384d8378c6fc53e0ebe00687dda4969e5e0c98e2a5bebf8285c360e1dfad28d8c7a54b64dac71b5bbdac3908d53822a1338b2f8a9aebbc07213f44410907b5651c24bc48d34480eba1cfc902b414cf54c716a3805cf9793e5d727d88179e2c43a2ca53ce7d3df62a3ab84f9400a56d0a835df95e53f418b3570f70c3fbf5ad95a00e17dec4168060c90f2b6e8604f1ebf47827d105c5ee345b5eb94932f233","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"3825d7faf861af9ef490e726b5d65ad5","Version":3,"CertificateType":"Intermediate","IsCodeSigning":false,"IsCA":false,"TBS":{"MD5":"d6c7684e9aaa508cf268335f83afe040","SHA1":"18066d20ad92409c567cdfde745279ff71c75226","SHA256":"a612fb22ce8be6dab75e47c98508f98496583e79c9c97b936a8caee9ea9f3fff","SHA384":"35c249d6ad0261a6229b2a727067ac6ba32a5d24b30b9249051f748c7735fbe2ec2ef26a702c50df1790fbe32a65aee7"}},{"Subject":"C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA","ValidFrom":"2003-12-04 00:00:00","ValidTo":"2013-12-03 23:59:59","Signature":"4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"47bf1995df8d524643f7db6d480d31a4","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"518d2ea8a21e879c942d504824ac211c","SHA1":"21ce87d827077e61abddf2beba69fde5432ea031","SHA256":"1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7","SHA384":"53e346bbde23779a5d116cc9d86fdd71c97b1f1b343439f8a11aa1d3c87af63864bb8488a5aeb2d0c26a6a1e0b15f03f"}},{"Subject":"C=KR, ST=Seoul, L=Yeongdeungpo,gu, O=AhnLab, Inc., OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=AhnLab, Inc.","ValidFrom":"2011-05-23 00:00:00","ValidTo":"2012-05-22 23:59:59","Signature":"42cadb90fbd3c01da180632af9ad044a8b07bd46aa56506d4cc2cb88d088b3ebfdf28ff7fa466f5b8babfef6756d6c7e963dde652f6ebfbd60ae934ea33345c73b69060ed933a4a60d3de8584282732ee977244b4ece00ab67463db80c0c9e06fbc57cb57527fa776668636d5478122facaba4216ad93261ab4d922a12812548a43d5c4a736d7fba599fa24f333814c44994ad02f045775356abad733dd5705c0b5b278274617d271f52dd6cbf91b19612447b8a0e620a34d983d6f4987abc6d36c39276b0d9638e855b17ffa591368c63660ef9265158cc042a22b593acf9091b9599218ae41434e7f00254baea83d97475f45f87be7463b18ae5664d37240f","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":false,"SerialNumber":"2badad20ccbc170164bdec8fbca06924","Version":3,"CertificateType":"Leaf (Code Signing)","IsCodeSigning":true,"IsCA":false,"TBS":{"MD5":"560c013af6edf1b1088644c0290c64ed","SHA1":"8626a75b2e1ab18ccb06bb8d0c544e516a8e177b","SHA256":"5592c238b5ecae534db714f6225e5b949406476f96259893b701c931e0a5c9b5","SHA384":"5cbde52a7702edb411ecc34feda6f93fa20f0662fe6539f081586fc626b9f806883d6d7ee979765ca6a34cd78875dd0c"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5","ValidFrom":"2011-02-22 19:25:17","ValidTo":"2021-02-22 19:35:17","Signature":"812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"611993e400000000001c","Version":3,"CertificateType":"CA","IsCodeSigning":false,"IsCA":true,"TBS":{"MD5":"78a717e082dcc1cda3458d917e677d14","SHA1":"4a872e0e51f9b304469cd1dedb496ee9b8b983a4","SHA256":"317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8","SHA384":"b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"}},{"Subject":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","ValidFrom":"2010-02-08 00:00:00","ValidTo":"2020-02-07 23:59:59","Signature":"5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3","SignatureAlgorithmOID":"1.2.840.113549.1.1.5","IsCertificateAuthority":true,"SerialNumber":"5200e5aa2556fc1a86ed96c9d44b33c7","Version":3,"CertificateType":"CA","IsCodeSigning":true,"IsCA":true,"TBS":{"MD5":"b30c31a572b0409383ed3fbe17e56e81","SHA1":"4843a82ed3b1f2bfbee9671960e1940c942f688d","SHA256":"03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9","SHA384":"bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"}}],"Signer":[{"SerialNumber":"2badad20ccbc170164bdec8fbca06924","Issuer":"C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA","Version":1}]}]}]}