WinDivert is a user-mode packet capture and network packet manipulation utility designed for Windows. It provides a powerful and flexible framework for intercepting, modifying, injecting, and dropping network packets at the network stack level. It operates as a lightweight, high-performance driver that interfaces directly with the network stack, allowing for detailed packet inspection and manipulation in real time.
sc.exe create windivert.sys binPath=C:\windows\temp\windivert.sys type=kernel && sc.exe start windivert.syssc.exe create windivert.sys binPath=C:\windows\temp\windivert.sys type=kernel && sc.exe start windivert.sysSandbox: execFile · Timeout: 30s
security.privilegeescalation.kernel-exploit examples:
WinDivert is a user-mode packet capture and network packet manipulation utility designed for Windows. It provides a powerful and flexible framework for intercepting, modifying, injecting, and dropping network packets at the network stack level. It operates as a lightweight, high-performance driver that interfaces directly with the network stack, allowing for detailed packet inspection and manipulation in real time.
Use Case: Elevate privileges
Required Privileges: kernel
MITRE ATT&CK: T1068