windows verified high v1.0.0

ppa_x64.sys

ppa_x64.sys is a kernel driver by Remko Weijnen that provides physical memory access via the PhysicalMemory section object. The device name PhyMem indicates this is part of the PhyMem driver family, of which several variants are already tracked in LOLDrivers (phymem64.sys, Phymemx64.sys, phymem_ext64.sys). The driver is available in the KeServiceDescriptorTable/vulnerable-drivers repository.

📋 Live Preview 
sc.exe create ppa_x64 binPath=C:\windows\temp\ppa_x64.sys type=kernel && sc.exe start ppa_x64
sc.exe create ppa_x64 binPath=C:\windows\temp\ppa_x64.sys type=kernel && sc.exe start ppa_x64

Sandbox: execFile · Timeout: 30s

Capabilities

security.privilegeescalation.kernel-exploit

Documentation

examples:

  • description: "Load the kernel driver" command: "sc.exe create ppa_x64 binPath=C:\\windows\\temp\\ppa_x64.sys type=kernel && sc.exe start ppa_x64"
  • description: "Exploit the driver for privilege escalation" command: "Exploit.exe --driver ppa_x64.sys"

ppa_x64.sys

ppa_x64.sys is a kernel driver by Remko Weijnen that provides physical memory access via the PhysicalMemory section object. The device name PhyMem indicates this is part of the PhyMem driver family, of which several variants are already tracked in LOLDrivers (phymem64.sys, Phymemx64.sys, phymem_ext64.sys). The driver is available in the KeServiceDescriptorTable/vulnerable-drivers repository.

Use Case: Elevate privileges

Required Privileges: kernel

MITRE ATT&CK: T1068

References