DOCSEARCHbyAlgolia
Submit Docs

LOLDrivers Documentation

repository·main·Indexed 23 days ago

https://github.com/magicsword-io/loldrivers

A centralized repository of vulnerable and malicious Windows drivers. It provides detection rules (Sigma, Yara, ClamAV, Sysmon, and WDAC), scanning tools, and data generators to help organizations secure infrastructure against driver-based attacks. Includes tools for YARA rule generation, Lacework LQL detection creation, and blocklist analysis against the Microsoft Vulnerable Driver Blocklist.

Tokens
146.6K
Snippets
98
Records
584
Agent score
80%

What's inside LOLDrivers

  1. Overview of LOLDrivers

    main
    LOLDrivers (Living Off The Land Drivers) is an open-source repository that aggregates vulnerable, malicious, and known malicious Windows drivers. It is designed to help organizations identify and mitigate driver-related security risks by providing categorized driver information and detection rules (Sigma, Yara, ClamAV, Sysmon, and WDAC).

  2. Overview of BdApiUtil.sys

    main

    BdApiUtil.sys is a vulnerable driver that can be used to load unsigned drivers. It includes an IOCTL code that accepts a PID and terminates that process (arbitrary process termination).

    Key Details:

    • UUID: 708650ed-c497-48be-97bc-9edd48cf2a1a
    • Privileges: Requires Admin privileges to install, but once installed, it can be called by any user (non-admin).
    • Use Case: Privilege escalation.
    • Operating System: Windows 10.

  3. Overview of KmWpsMs.sys vulnerable driver

    main

    KmWpsMs.sys is a vulnerable kernel driver from the KeServiceDescriptorTable/vulnerable-drivers repository. It exposes dangerous kernel primitives to usermode, which can be used to elevate privileges on Windows 10 systems.

    • UUID: a6340f12-b0ee-41c5-acf0-92be886d1296
    • Author: Michael Haag
    • Use Case: Elevate privileges
    • Privileges Required: kernel
    • Operating System: Windows 10

  5. Details for psmounterex.sys driver

    main

    The psmounterex.sys driver (UUID: 0f64bf7a-2ef2-45ea-af7d-4e7c87d98777) is a vulnerable driver contributed by Northwave Cyber Security. It has a CVSSv3 score of 8.8, indicating a high impact for privilege escalation.

    Usage Profile:

    • Use Case: Elevate privileges
    • Privileges Required: kernel
    • Operating System: Windows 10

    Vulnerable Sample Info:

    • Filename: psmounterex.sys
    • Product: PSMounterEx
    • Company: Windows (R) Win 7 DDK provider
    • MD5: 2a9cf32ba325f394ae1cfb1e70f38b6e
    • SHA256: 4e99d454a56845bb0e622cfd68b895b7868ef7e8a43424e5b7b803f5a2d25eca

  6. CcProtect.sys Driver Overview

    main

    CnCrypt CcProtect.sys is a signed kernel driver used in BlackSnufkin BYOVD (Bring Your Own Vulnerable Driver) research as a process-killer provider.

    Warning: Using this driver may cause system instability if HVCI (Hypervisor-Protected Code Integrity) is enabled. It is recommended to disable HVCI to avoid crashes.

    • UUID: 3e3067b0-3d74-46fe-9f57-1ae3a0293958
    • Use Case: Terminate processes from kernel mode through a vulnerable driver path.
    • Privileges Required: kernel
    • Supported OS: Windows 10, Windows 11

  10. Analyze the malicious.sys driver (UUID: 3e5c0fc4-bfe8-4af2-9613-4f56b0e3c2c8)

    main

    The malicious.sys driver is a demonstration tool used to showcase the abuse of RTCore64.sys (CVE-2019-16098) from MSI and the nullification of the DSE (Driver Signature Enforcement) flag to load unsigned drivers. It also demonstrates attacking 360 Total Security by nulling out its ObRegisterCallbacks and notify callbacks.

    Key Details:

    • Use Case: Elevate privileges
    • Privileges Required: kernel
    • Operating System: Windows 10
    • Author: Guus Verbeek
    • Created: 2023-06-05

  11. AsrCDDrv.sys driver overview

    main

    AsrCDDrv.sys is a kernel driver from ASRock Incorporation used for privilege escalation. It provides several high-privilege capabilities including:

    • Control register read/write (cr0, cr2, cr3, cr4, cr8)
    • Arbitrary MSR read/write
    • Arbitrary physical memory read/write via MmMapIoSpace
    • Contiguous memory allocation/free via MmAllocateContiguousMemorySpecifyCache
    • I/O port read/write (8/16/32-bit)

    Metadata:

    • UUID: bd06e043-0f69-4212-be93-d069bf0de848
    • Operating System: Windows 10
    • Privileges: kernel