KExecDD

KO | EN

gitlite — search

#javascript #python #golang #go #machine-learning #rust #deep-learning #linux #docker #windows #awesome #kubernetes #vue #ios

(★ 272)

Admin to Kernel code execution using the KSecDD driver

파일 탐색기

최종 버전 다운로드 (.zip)

demo.gif
dllmain.c
loader.c
README.md

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# KExecDD
The Kernel Security Support Provider Interface (KSecDD.sys) allows the Local Security Authority Server Service (LSASS) to execute arbitrary kernel-mode addresses using the `IOCTL_KSEC_IPC_SET_FUNCTION_RETURN` operation. This behavior can be observed in `ksecdd.sys!KsecIoctlHandleFunctionReturn`. As soon as LSASS starts, it invokes `lsass.exe!LsapOpenKsec` where it connects itself to the interface using the `IOCTL_KSEC_CONNECT_LSA` operation. From this point on, no further process can connect to the interface and therefore the logic can only be triggered by LSASS. Note, however, that exactly one connection can be created for each server silo, but I am not sure about the implications of this.

The proof of concept injects a DLL into the LSASS process from where it disables Driver Signature Enforcement by overwriting `ci.dll!g_CiOptions` (keep in mind that this will eventually trigger Patchguard after some time). This obviously only works if LSASS does not run as a protected process (LSA Protection has to be disabled).

# Demo
![](https://github.com/floesen/KExecDD/blob/main/demo.gif)

KExecDD

파일 탐색기

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

KExecDD

파일 탐색기

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

Download README