← Back to driver explorer
Driver intelligenceVulnerableVerified
signeddrv.sys
signeddrv.sys is a Microsoft-signed vulnerable kernel driver that exposes an unrestricted \\.\WinNotify device. Public research documents IOCTL 0x22200C for kernel base disclosure, IOCTL 0x222040 for arbitrary kernel read, and IOCTL 0x222044 for arbitrary kernel write, enabling local privilege escalation.
Known samples 1
1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
signeddrv.sysSample 1 · HVCI TRUE
- MD5
e052ac7d39d07f6657cf049aae0c5b60- SHA1
9582337fdd6165dca71c6ae1c8c0222c6a10de77- SHA256
4dc3a03a046c210a7c6cd37db8d6bd34bf3760a612232cc82acf941a9e508e0f- Imphash
86915b1ccd40702f0a8d238c992bf841- Authentihash MD5
26e19d4941322c86f3bdba7639bcf0d2- Authentihash SHA1
c007a5fb918f38ea0e5295077c264e0785bdd646- Authentihash SHA256
41856176aa3af446c206ec18261d6a12cdc98dea472df7f3244e34d383c2858a- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
Recorded command
sc.exe create signeddrv binPath=C:\windows\temp\signeddrv.sys type=kernel && sc.exe start signeddrvElevate privileges · Privileges: kernel · OS: Windows 10
Research & references
- https://github.com/magicsword-io/LOLDrivers/issues/325
- https://github.com/magicsword-io/LOLDrivers/issues/367
- https://github.com/magicsword-io/LOLDrivers/issues/370
- https://github.com/KeServiceDescriptorTable/vulnerable-drivers
- https://github.com/Haider303/winnotify-exp
- https://github.com/Haider303/sliff-driv-exploit
- https://medium.com/@haider303mustafa/winnotify-signeddrv-sys-full-local-privilege-escalation-via-arbitrary-kernel-read-write-09e0c1ababf3
- https://medium.com/@haider303mustafa/applockerflter-sliffdriver-sys-full-kernel-exploit-chain-from-driver-recon-to-system-shell-b57d87738308
Acknowledgement: @rainbowdynamix, @DbgPrint, @Haider303