examples:

• description: "Load the kernel driver" command: "sc.exe create TVicPort64 binPath=C:\\windows\\temp\\TVicPort64.sys type=kernel && sc.exe start TVicPort64"
• description: "Exploit the driver for privilege escalation" command: "Exploit.exe --driver TVicPort64.sys"

TVicPort64.sys

Load TVicPort64.sys kernel driver. Once loaded, device \.\TVicPortDevice0 is accessible from any integrity level (no DACL). Send IOCTL 0x80002008 to map arbitrary physical memory into user-mode VA space via ZwMapViewOfSection and perform token stealing for LPE to SYSTEM.

Use Case: Arbitrary physical memory read/write from user mode. Exploitable from Low Integrity Level, Guest, or any AppContainer. Used for local privilege escalation to NT AUTHORITY\SYSTEM via token stealing, KASLR bypass, and kernel code execution.

Required Privileges: User (Low Integrity sufficient — no DACL on device object)

MITRE ATT&CK: T1068