← Back to driver explorer
Driver intelligenceVulnerableVerified
chinese_cheat_driver.sys
chinese_cheat_driver.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. The driver exposes dangerous kernel primitives to usermode. Public exploit research documents IOCTL 0x222000 for arbitrary kernel virtual memory reads, IOCTL 0x222018 for physical memory reads, and IOCTL 0x22201C for physical memory writes, which can be chained for local privilege escalation from an administrator context to NT AUTHORITY\SYSTEM.
Known samples 1
1 recorded TRUE · 0 recorded FALSE · 0 unknown for loading despite HVCI. Results apply to individual samples.
chinese_cheat_driver.sysSample 1 · HVCI TRUE
- MD5
3ee985c5fd1f5784e15a4d11b3ca70a1- SHA1
33148c93465908ddad71cf189e22091dc0058ac4- SHA256
4f412f9aa89994cda45422d23d6d961809225de9a4f5a8bfbfb9ac0e8725917e- Imphash
07386745331387b83012a6786eacb5ac- Authentihash MD5
f6877a3e31a1d73e1856e3f4c359f244- Authentihash SHA1
7cf1b8c874055b230ad0706fcef8e4cb61ece130- Authentihash SHA256
50f22cdd309f5c3d77f39a27586cd26ccd04294879ea04da4c175a9cb7519284- Machine
- AMD64
- Version
- Not recorded
- Publisher
- Not recorded
Recorded command
sc.exe create chinese_cheat_driver binPath=C:\windows\temp\chinese_cheat_driver.sys type=kernel && sc.exe start chinese_cheat_driverElevate privileges · Privileges: kernel · OS: Windows 10
Research & references
- https://github.com/magicsword-io/LOLDrivers/issues/325
- https://github.com/magicsword-io/LOLDrivers/issues/351
- https://github.com/KeServiceDescriptorTable/vulnerable-drivers
- https://github.com/Haider303/facebook-media-driver-exploit
- https://medium.com/@haider303mustafa/exploiting-a-signed-vulnerable-kernel-driver-for-ring-0-privilege-escalation-678fe2054d6a
Acknowledgement: @rainbowdynamix, @DbgPrint