windows verified critical v1.0.0

wfshbr64.sys

wfshbr64.sys and wfshbr32.sys specially crafted payload allows arbitrary user to perform bitwise operation with arbitrary EPROCESS offset and flags value to purposely elevate the game process to CodeGen Full protection by manipulating EPROCESS.Protection and EPROCESS.SignatureLevel flags (security hole as a feature). The driver is signed by Microsoft hardware compatibility publisher that is submitted via Microsoft Hardware Program.

📋 Live Preview 
sc.exe create wfshbr64.sys binPath=C:\windows\temp\wfshbr64.sys type=kernel && sc.exe start wfshbr64.sys
sc.exe create wfshbr64.sys binPath=C:\windows\temp\wfshbr64.sys type=kernel && sc.exe start wfshbr64.sys

Sandbox: execFile · Timeout: 30s

Capabilities

security.privilegeescalation.kernel-exploit

Documentation

examples:

  • description: "Load the kernel driver" command: "sc.exe create wfshbr64.sys binPath=C:\\windows\\temp\\wfshbr64.sys type=kernel && sc.exe start wfshbr64.sys"
  • description: "Exploit the driver for privilege escalation" command: "Exploit.exe --driver wfshbr64.sys"

wfshbr64.sys

wfshbr64.sys and wfshbr32.sys specially crafted payload allows arbitrary user to perform bitwise operation with arbitrary EPROCESS offset and flags value to purposely elevate the game process to CodeGen Full protection by manipulating EPROCESS.Protection and EPROCESS.SignatureLevel flags (security hole as a feature).

The driver is signed by Microsoft hardware compatibility publisher that is submitted via Microsoft Hardware Program.

Use Case: Elevate privileges

Required Privileges: kernel

MITRE ATT&CK: T1068

References