windows verified critical v1.0.0

malicious.sys

This demo is a presentation at the CYBERSEC 2023 in Taiwan. The presentation showcases the abuse of RTCore64.sys (CVE-2019-16098) from MSI and the nullification of the DSE flag to load a malicious unsigned driver. The presentation also demonstrates an attack on 360 Total Security by nulling out its ObRegisterCallbacks and notify callbacks, enabling the execution of any malicious behavior on the processes of 360 Total Security.

📋 Live Preview 
sc.exe create malicious.sys binPath=C:\windows\temp\malicious.sys type=kernel && sc.exe start malicious.sys
sc.exe create malicious.sys binPath=C:\windows\temp\malicious.sys type=kernel && sc.exe start malicious.sys

Sandbox: execFile · Timeout: 30s

Capabilities

security.privilegeescalation.kernel-exploit

Documentation

examples:

  • description: "Load the kernel driver" command: "sc.exe create malicious.sys binPath=C:\\windows\\temp\\malicious.sys type=kernel && sc.exe start malicious.sys"
  • description: "Exploit the driver for privilege escalation" command: "Exploit.exe --driver malicious.sys"

malicious.sys

This demo is a presentation at the CYBERSEC 2023 in Taiwan. The presentation showcases the abuse of RTCore64.sys (CVE-2019-16098) from MSI and the nullification of the DSE flag to load a malicious unsigned driver. The presentation also demonstrates an attack on 360 Total Security by nulling out its ObRegisterCallbacks and notify callbacks, enabling the execution of any malicious behavior on the processes of 360 Total Security.

Use Case: Elevate privileges

Required Privileges: kernel

MITRE ATT&CK: T1068

References