← Back to driver explorer
Driver intelligenceVulnerableVerified
lsigetwin_SliffDriver.sys
lsigetwin_SliffDriver.sys is a Microsoft-signed vulnerable kernel driver that exposes a \\.\SliffDriver device. Public research documents IOCTL 0x80002004 for mapping caller-supplied physical memory into user mode, enabling local privilege escalation when chained with kernel address discovery and virtual-to-physical translation primitives.
Known samples 1
1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
lsigetwin_SliffDriver.sysSample 1 · HVCI TRUE
- MD5
49886067cd4221b0b8640cff66157c94- SHA1
1bc8fdbd88b3539892c92561eb06c3bce37d1e59- SHA256
b811da59fbd212eb2c3bc0ed92e8ea2e46ef4df40c2d0991d911e72008bfc1fa- Imphash
4623044146fa71957232982a01652ffc- Authentihash MD5
f26d457187c337185b8bf0b0a36a2b23- Authentihash SHA1
0424c8aa2fd4fbce92c35c63c15819c4ac1ed4c6- Authentihash SHA256
f8fbc3f89b8d3d96b3e441ff7f36b06d9e89c5421db8533e70eda1080760eebb- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
Recorded command
sc.exe create lsigetwin_SliffDriver binPath=C:\windows\temp\lsigetwin_SliffDriver.sys type=kernel && sc.exe start lsigetwin_SliffDriverElevate privileges · Privileges: kernel · OS: Windows 10
Research & references
- https://github.com/magicsword-io/LOLDrivers/issues/325
- https://github.com/magicsword-io/LOLDrivers/issues/370
- https://github.com/KeServiceDescriptorTable/vulnerable-drivers
- https://github.com/Haider303/sliff-driv-exploit
- https://medium.com/@haider303mustafa/applockerflter-sliffdriver-sys-full-kernel-exploit-chain-from-driver-recon-to-system-shell-b57d87738308
Acknowledgement: @rainbowdynamix, @DbgPrint, @Haider303