8fcec30c-f5ca-4aae-b2d8-77af60b78d42

zntport.sys :inline

Description

The legacy NTPort driver creates the "\.\zntport" device and exposes IOCTL 0xF10024CC with FILE_ANY_ACCESS. The handler accepts a caller-controlled 32-bit physical address, maps 0x32 bytes below 4 GiB with MmMapIoSpace, and copies data through an unchecked strcpy operation. After an administrator installs the driver, an unprivileged process may be able to abuse the device for physical-memory disclosure or memory corruption, depending on the device ACL.

  • UUID: 8fcec30c-f5ca-4aae-b2d8-77af60b78d42
  • Created: 2026-08-11
  • Author: Element2023H
  • Acknowledgement: | Element2023H

Download

This download link contains the vulnerable driver!

Block zntport.sys across your endpoints

Add this driver to your block policy in minutes with MagicSword, threat-driven application control. Free for up to 100 endpoints.

Start Blocking for Free

Commands

sc.exe create zntport binPath= C:\windows\temp\zntport.sys type= kernel && sc.exe start zntport
Use CasePrivilegesOperating System
Read physical memory below 4 GiB or trigger memory corruption through the unchecked copy operation.Administrator required to install; device access may be available to unprivileged users after installationWindows NT, Windows 2000, Windows XP, Windows Server 2003, Windows Vista

Detections

YARA 🏹

Expand

Exact Match

with header and size limitation

Threat Hunting

without header and size limitation

Renamed

for renamed driver files

Sigma 🛡️

Expand

Names

detects loading using name only

Hashes

detects loading using hashes only

Sysmon 🔎

Expand

Block

on hashes

Alert

on hashes

Resources


  • https://github.com/The-Sword-of-Constantine/UsingBYOVD/blob/master/RawDriverFiles/zntport.sys
  • https://www.zealsoftstudio.com/ntport/portfaq.html

    • Known Vulnerable Samples

    PropertyValue
    Filenamezntport.sys
    Creation Timestamp2007-12-22 01:35:56
    MD51e712a45f50b2c7cc235e81fb7e06e8f
    SHA186025bc313156397b0b5e3864106208898e27218
    SHA256c653fe66aeb6170899ad8b405b7550e247490a2366bda828bfa3b2a2dc18fa91
    Authentihash MD5a8dfc8192b5a589bbcf4c6618135cedd
    Authentihash SHA14301542b6e2d0bb05daefc31d0a9559c2b325ef0
    Authentihash SHA256d9a6d18a51bfd4cb1f375590b051ea95f9e2d9090dcda4be51fca6fddaafb598
    RichPEHeaderHash MD5bab7ca9d03f0546edd81ae1a9b85cd52
    RichPEHeaderHash SHA13ae35f55cd52006c8d5cf02622947e49d888386c
    RichPEHeaderHash SHA25625b450c68d20191e07f756e2b35dddc1d486a5c8ebef34ea41f1345830d2ae9f
    CompanyZeal SoftStudio
    DescriptionNTPort Library kernel driver
    ProductNTPort Library
    OriginalFilenamezntport.sys

    Download

    Certificates

    Expand
    Certificate 0d91d62ed03dda74e5efe8d70ae793c9
    FieldValue
    ToBeSigned (TBS) MD5c5edda178503ccfbc896cd596dba71ab
    ToBeSigned (TBS) SHA17df69e18fcb66c69f1b17258919f2976988265bb
    ToBeSigned (TBS) SHA25659091d162fa68b89e157ddf3eb49d6be09a7ae6e16158980a00c7aaf1677ad2c
    SubjectJURISDICTION_OF_INCORPORATION_C=TW, BUSINESS_CATEGORY=Private Organization, serialNumber=09424319, C=TW, ST=T'ai,pei, L=New Taipei, O=CLEVO CO., CN=CLEVO CO.
    ValidFrom2018-08-21 00:00:00
    ValidTo2021-11-17 12:00:00
    Signature0d6ff3c3775d78638245067a52811b8d4de62370b8cefcb1323b8304f2445f4c3861bbe76b933ce316478d04af1bc45b578bbdc4fdc7f07148cb716cd7292c4f94133165a9fa7137f9679d45566381783bdd2f38db7a395d9653958a4ce211bd459724571339504e554f31066142a050d71d1134a4e8e07f15f77d44001821a8fbcc195395235845bc0dd0dc6c66f0449292736a44395be9ca15b063863cfbc8d9eb0f9da047fc9156ce272a8924529cd47a8697c681f2742855d726a3871e33fc5c1c698a37c9f389ba91049902a953b1f1fca4179011d49bcd04c26fccefb02b5dfae916ea909dc78430f9a26fb93bd09bb0098dac413e9af4f4f9f478c913
    SignatureAlgorithmOID1.2.840.113549.1.1.11
    IsCertificateAuthorityFalse
    SerialNumber0d91d62ed03dda74e5efe8d70ae793c9
    Version3
    Certificate 03f1b4e15f3a82f1149678b3d7d8475c
    FieldValue
    ToBeSigned (TBS) MD583f5de89f641d0fbf60248e10a7b9534
    ToBeSigned (TBS) SHA1382a73a059a08698d6eb98c87e1b36fc750933a4
    ToBeSigned (TBS) SHA256eec58131dc11cd7f512501b15fdbc6074c603b68ca91f7162d5a042054edb0cf
    SubjectC=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert EV Code Signing CA (SHA2)
    ValidFrom2012-04-18 12:00:00
    ValidTo2027-04-18 12:00:00
    Signature19334a0c813337dbad36c9e4c93abbb51b2e7aa2e2f44342179ebf4ea14de1b1dbe981dd9f01f2e488d5e9fe09fd21c1ec5d80d2f0d6c143c2fe772bdbf9d79133ce6cd5b2193be62ed6c9934f88408ecde1f57ef10fc6595672e8eb6a41bd1cd546d57c49ca663815c1bfe091707787dcc98d31c90c29a233ed8de287cd898d3f1bffd5e01a978b7cda6dfba8c6b23a666b7b01b3cdd8a634ec1201ab9558a5c45357a860e6e70212a0b92364a24dbb7c81256421becfee42184397bba53706af4dff26a54d614bec4641b865ceb8799e08960b818c8a3b8fc7998ca32a6e986d5e61c696b78ab9612d93b8eb0e0443d7f5fea6f062d4996aa5c1c1f0649480
    SignatureAlgorithmOID1.2.840.113549.1.1.11
    IsCertificateAuthorityTrue
    SerialNumber03f1b4e15f3a82f1149678b3d7d8475c
    Version3

    Imports

    Expand
    • ntoskrnl.exe

    Imported Functions

    Expand
    • IofCompleteRequest
    • MmUnmapIoSpace
    • strcpy
    • MmMapIoSpace
    • IoRaiseInformationalHardError
    • RtlInitUnicodeString
    • IoDeleteDevice
    • IoDeleteSymbolicLink
    • MmFreeNonCachedMemory
    • IoCreateSymbolicLink
    • IoCreateDevice
    • MmAllocateNonCachedMemory
    • IoQueryDeviceDescription
    • KeBugCheckEx

    Exported Functions

    Expand

    Sections

    Expand
    • .text
    • .data
    • .pdata
    • INIT
    • .rsrc

    Signature

    Expand
    {
  "Certificates": [
    {
      "CertificateType": "Leaf (Code Signing)",
      "IsCA": false,
      "IsCertificateAuthority": false,
      "IsCodeSigning": true,
      "SerialNumber": "0d91d62ed03dda74e5efe8d70ae793c9",
      "Signature": "0d6ff3c3775d78638245067a52811b8d4de62370b8cefcb1323b8304f2445f4c3861bbe76b933ce316478d04af1bc45b578bbdc4fdc7f07148cb716cd7292c4f94133165a9fa7137f9679d45566381783bdd2f38db7a395d9653958a4ce211bd459724571339504e554f31066142a050d71d1134a4e8e07f15f77d44001821a8fbcc195395235845bc0dd0dc6c66f0449292736a44395be9ca15b063863cfbc8d9eb0f9da047fc9156ce272a8924529cd47a8697c681f2742855d726a3871e33fc5c1c698a37c9f389ba91049902a953b1f1fca4179011d49bcd04c26fccefb02b5dfae916ea909dc78430f9a26fb93bd09bb0098dac413e9af4f4f9f478c913",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "JURISDICTION_OF_INCORPORATION_C=TW, BUSINESS_CATEGORY=Private Organization, serialNumber=09424319, C=TW, ST=T\u0027ai,pei, L=New Taipei, O=CLEVO CO., CN=CLEVO CO.",
      "TBS": {
        "MD5": "c5edda178503ccfbc896cd596dba71ab",
        "SHA1": "7df69e18fcb66c69f1b17258919f2976988265bb",
        "SHA256": "59091d162fa68b89e157ddf3eb49d6be09a7ae6e16158980a00c7aaf1677ad2c",
        "SHA384": "e76a77ddcf5addcad9f86979645e26d6c4f191daa6fb58a2c7016082b9ad648081b6b4f73af456843a78f9ed60b74bcb"
      },
      "ValidFrom": "2018-08-21 00:00:00",
      "ValidTo": "2021-11-17 12:00:00",
      "Version": 3
    },
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": true,
      "SerialNumber": "03f1b4e15f3a82f1149678b3d7d8475c",
      "Signature": "19334a0c813337dbad36c9e4c93abbb51b2e7aa2e2f44342179ebf4ea14de1b1dbe981dd9f01f2e488d5e9fe09fd21c1ec5d80d2f0d6c143c2fe772bdbf9d79133ce6cd5b2193be62ed6c9934f88408ecde1f57ef10fc6595672e8eb6a41bd1cd546d57c49ca663815c1bfe091707787dcc98d31c90c29a233ed8de287cd898d3f1bffd5e01a978b7cda6dfba8c6b23a666b7b01b3cdd8a634ec1201ab9558a5c45357a860e6e70212a0b92364a24dbb7c81256421becfee42184397bba53706af4dff26a54d614bec4641b865ceb8799e08960b818c8a3b8fc7998ca32a6e986d5e61c696b78ab9612d93b8eb0e0443d7f5fea6f062d4996aa5c1c1f0649480",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
      "Subject": "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert EV Code Signing CA (SHA2)",
      "TBS": {
        "MD5": "83f5de89f641d0fbf60248e10a7b9534",
        "SHA1": "382a73a059a08698d6eb98c87e1b36fc750933a4",
        "SHA256": "eec58131dc11cd7f512501b15fdbc6074c603b68ca91f7162d5a042054edb0cf",
        "SHA384": "4a25018683cabfb8ec2cad136334f37f33c89aa8540326322991d997c8adfb7faf06ab602ebd46630fe75fe3d2edc6b1"
      },
      "ValidFrom": "2012-04-18 12:00:00",
      "ValidTo": "2027-04-18 12:00:00",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert EV Code Signing CA (SHA2)",
      "SerialNumber": "0d91d62ed03dda74e5efe8d70ae793c9",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

    source

    last_updated: 2026-08-31