examples:

• description: "Load the kernel driver" command: "sc.exe create AdvCare binPath=C:\\windows\\temp\\AdvCare.sys type=kernel && sc.exe start AdvCare"
• description: "Exploit the driver for privilege escalation" command: "Exploit.exe --driver AdvCare.sys"

AdvCare.sys

AdvCare.sys is a legacy hardware health monitor driver from Advantech Co., Ltd. for industrial PCs and embedded boards. The driver exposes arbitrary MSR read/write (wrmsr/rdmsr with no validation), arbitrary physical memory read/write via MmMapIoSpace, unrestricted port I/O across all 65536 ports, and PCI configuration space read/write via HalGetBusDataByOffset/HalSetBusDataByOffset. The device is created with IoCreateDevice (no DACL) and IRP_MJ_CREATE returns STATUS_SUCCESS unconditionally with zero caller validation -- no admin check, no token check, no integrity check. Any unprivileged local user can open the device and invoke every primitive. The driver is also available in the KeServiceDescriptorTable/vulnerable-drivers repository on GitHub.

Use Case: Elevate privileges

Required Privileges: kernel

MITRE ATT&CK: T1068