zntport.sys
The legacy NTPort driver creates the "\\.\zntport" device and exposes IOCTL 0xF10024CC with FILE_ANY_ACCESS. The handler accepts a caller-controlled 32-bit physical address, maps 0x32 bytes below 4 GiB with MmMapIoSpace, and copies data through an unchecked strcpy operation. After an administrator installs the driver, an unprivileged process may be able to abuse the device for physical-memory disclosure or memory corruption, depending on the device ACL.
Known samples 1
0 recorded TRUE · 0 recorded FALSE · 1 unknown for loading despite HVCI. Results apply to individual samples.
zntport.sysSample 1 · HVCI unknown
- MD5
1e712a45f50b2c7cc235e81fb7e06e8f- SHA1
86025bc313156397b0b5e3864106208898e27218- SHA256
c653fe66aeb6170899ad8b405b7550e247490a2366bda828bfa3b2a2dc18fa91- Imphash
7a6c1efa03e4389d37e651cd32862f47- Authentihash MD5
a8dfc8192b5a589bbcf4c6618135cedd- Authentihash SHA1
4301542b6e2d0bb05daefc31d0a9559c2b325ef0- Authentihash SHA256
d9a6d18a51bfd4cb1f375590b051ea95f9e2d9090dcda4be51fca6fddaafb598- Machine
- AMD64
- Version
- 2, 8, 3, 1
- Publisher
- Zeal SoftStudio
Recorded command
sc.exe create zntport binPath= C:\windows\temp\zntport.sys type= kernel && sc.exe start zntportRead physical memory below 4 GiB or trigger memory corruption through the unchecked copy operation. · Privileges: Administrator required to install; device access may be available to unprivileged users after installation · OS: Windows NT, Windows 2000, Windows XP, Windows Server 2003, Windows Vista
Research & references
Acknowledgement: Element2023H