windows verified high v1.0.0

cpqsysio64.sys

cpqsysio64.sys is a Hewlett-Packard physical memory driver that ships as part of the HP ProLiant Support Pack and HP firmware ROM update utilities. The driver exposes physical memory read via MmMapIoSpace (IOCTL 0x152EF0) and physical memory allocation and mapping to usermode via ZwOpenSection on Device\PhysicalMemory combined with ZwMapViewOfSection (IOCTL 0x153E80). The Compaq heritage driver name (cpq prefix) dates to the HP-Compaq acquisition. The driver is only 15KB and is also available...

📋 Live Preview 
sc.exe create cpqsysio binPath=C:\windows\temp\cpqsysio64.sys type=kernel && sc.exe start cpqsysio
sc.exe create cpqsysio binPath=C:\windows\temp\cpqsysio64.sys type=kernel && sc.exe start cpqsysio

Sandbox: execFile · Timeout: 30s

Capabilities

security.privilegeescalation.kernel-exploit

Documentation

examples:

  • description: "Load the kernel driver" command: "sc.exe create cpqsysio binPath=C:\\windows\\temp\\cpqsysio64.sys type=kernel && sc.exe start cpqsysio"
  • description: "Exploit the driver for privilege escalation" command: "Exploit.exe --driver cpqsysio64.sys"

cpqsysio64.sys

cpqsysio64.sys is a Hewlett-Packard physical memory driver that ships as part of the HP ProLiant Support Pack and HP firmware ROM update utilities. The driver exposes physical memory read via MmMapIoSpace (IOCTL 0x152EF0) and physical memory allocation and mapping to usermode via ZwOpenSection on Device\PhysicalMemory combined with ZwMapViewOfSection (IOCTL 0x153E80). The Compaq heritage driver name (cpq prefix) dates to the HP-Compaq acquisition. The driver is only 15KB and is also available in the KeServiceDescriptorTable/vulnerable-drivers repository.

Use Case: Elevate privileges

Required Privileges: kernel

MITRE ATT&CK: T1068

References