The driver in question, identified as \\.\IREC, provides an interface for external programs to directly interact with system processes. Its key functionality is encapsulated in the OPENPROCESS function which, upon receiving a Process ID (PID), returns a handle to that specific process operating within the kernels domain. The vulnerability emerges from the indiscriminate nature of this functionality. An ill-intentioned actor can exploit this to obtain handles to critical processes like LSASS. ...
sc.exe create irec binPath=C:\windows\temp\irec.sys type=kernel && sc.exe start irec.syssc.exe create irec binPath=C:\windows\temp\irec.sys type=kernel && sc.exe start irec.sysSandbox: execFile · Timeout: 30s
security.privilegeescalation.kernel-exploit examples:
The driver in question, identified as \.\IREC, provides an interface for external programs to directly interact with system processes. Its key functionality is encapsulated in the OPENPROCESS function which, upon receiving a Process ID (PID), returns a handle to that specific process operating within the kernels domain. The vulnerability emerges from the indiscriminate nature of this functionality. An ill-intentioned actor can exploit this to obtain handles to critical processes like LSASS. With a hardcoded access mask of 0x410, this driver essentially grants PROCESS_QUERY_INFORMATION and PROCESS_VM_READ permissions, enabling unauthorized memory dumps from privileged processes, all from an unprivileged context.
Use Case: Elevate privileges
Required Privileges: kernel
MITRE ATT&CK: T1068