windows verified high v1.0.0

MsIo32.sys

The MsIo64.sys and MsIo32.sys drivers in Patriot Viper RGB before 1.1 allow local users (including low integrity processes) to read and write to arbitrary memory locations, and consequently gain NT AUTHORITY\SYSTEM privileges, by mapping \Device\PhysicalMemory into the calling process via ZwOpenSection and ZwMapViewOfSection.

📋 Live Preview 
sc.exe create MsIo32.sys binPath=C:\windows\temp\MsIo32.sys type=kernel && sc.exe start MsIo32.sys
sc.exe create MsIo32.sys binPath=C:\windows\temp\MsIo32.sys type=kernel && sc.exe start MsIo32.sys

Sandbox: execFile · Timeout: 30s

Capabilities

security.privilegeescalation.kernel-exploit

Documentation

examples:

  • description: "Load the kernel driver" command: "sc.exe create MsIo32.sys binPath=C:\\windows\\temp\\MsIo32.sys type=kernel && sc.exe start MsIo32.sys"
  • description: "Exploit the driver for privilege escalation" command: "Exploit.exe --driver MsIo32.sys"

MsIo32.sys

The MsIo64.sys and MsIo32.sys drivers in Patriot Viper RGB before 1.1 allow local users (including low integrity processes) to read and write to arbitrary memory locations, and consequently gain NT AUTHORITY\SYSTEM privileges, by mapping \Device\PhysicalMemory into the calling process via ZwOpenSection and ZwMapViewOfSection.

Use Case: Elevate privileges

Required Privileges: kernel

MITRE ATT&CK: T1068

References