← Back to driver explorer
Driver intelligenceVulnerableVerified
RootLaser.sys
Adlice RootLaser.sys version 3.4.1 is a signed kernel driver with administrator-reachable kernel read and write primitives through IOCTLs 0x22E050 and 0x22E014. Public proof-of-concept code combines these primitives with build-specific kernel offsets to replace a process token and elevate an administrator to SYSTEM. The exploit requires offsets that match the target Windows build.
Known samples 1
0 recorded TRUE · 0 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.
RootLaser.sysSample 1 · HVCI unknown
- MD5
58b75386e369e2d536271d36d50af17a- SHA1
2e70e73b9a700336eea20e92b916817e00f053d1- SHA256
85b69f4e518c66b8ba7154ecb1ac1e8791dfe2fdf1e20b7c3a707f59639ac10d- Imphash
7a0389f36453d160859b0922707cfacd- Authentihash MD5
ba341db34b2ef62e933efcc576e11504- Authentihash SHA1
6a90728afb865d1e791c00690e7c5b3b5ef92975- Authentihash SHA256
4ada025666ff8886e848052d530a40441fb11939529c92afd3bee1aa04cbc472- Machine
- AMD64
- Version
- 3.4.1
- Publisher
- Adlice Software
Recorded command
sc.exe create RootLaser binPath= C:\windows\temp\RootLaser.sys type= kernel && sc.exe start RootLaserRead and write kernel memory to replace a process token or terminate non-protected processes. · Privileges: Administrator · OS: Windows 10, Windows 11
Research & references
Acknowledgement: KOSEC LLC, megab0t @AmeerTheInteger