Hacktivity 2012 - András Kabai - Hunting and exploiting bugs in kernel drivers

### Overview In this talk presented at Hacktivity 2012, András Kabai explores hunting and exploiting vulnerabilities within Windows kernel drivers for local privilege escalation (LPE). While modern operating systems enforce strict separation between user mode (Ring 3) and kernel mode (Ring 0), third-party device drivers (such as those installed by antivirus or firewall software) frequently introduce vulnerabilities. Because Ring 0 code executes with unrestricted system and hardware access, successfully exploiting a kernel driver allows an attacker operating from a restricted user account to completely compromise the underlying operating system.

### Key Topics - **Windows Driver Architecture:** The speaker examines the Windows Driver Model (WDM), which superseded VxD. When loaded, a driver uses `IoCreateDevice` to register a device object and exposes symbolic links that user-mode applications open via `CreateFile`. Communication is handled using I/O Request Packets (IRPs) sent through `DeviceIoControl`. - **IOCTL Handling and Transfer Types:** Drivers process I/O control (IOCTL) codes targeting specific driver functions. The talk contrasts standard `METHOD_BUFFERED`—where the kernel I/O manager manages user/kernel buffer copying—with `METHOD_NEITHER`. In `METHOD_NEITHER`, raw user-space pointers are passed directly to the driver, frequently resulting in arbitrary memory overwrite vulnerabilities if parameters and pointers are not rigorously verified. - **Tooling and Discovery:** Common tools for finding and analyzing drivers include Windows Driver Kit (WDK), WinObj (Sysinternals), Driver View, and IRP Tracker. For vulnerability research, Kabai highlights IDA Pro for reverse engineering alongside fuzzers such as ioctlbf, IOCTL Fuzzer, and Kito. - **Exploitation Mechanics:** The presentation discusses "write-what-where" conditions, Kernel Patch Protection (KPP) limitations (which monitor dispatch tables but miss local function pointer overwrites), and staged shellcode execution.

### Technical Details Kabai demonstrates an end-to-end local privilege escalation on a 32-bit Windows system using a vulnerable demonstration driver: 1. **Lab Setup:** Kernel debugging requires two machines connected via virtual serial ports configured using `bcdedit` (replacing legacy `boot.ini`). In the presenter's setup, two Windows VMs run on a Linux host. 2. **Vulnerability Analysis:** Disassembling the target driver (`dump_drv` function) shows stack-allocated variables followed by an array of function pointers. Although the driver uses `ProbeForRead` to verify user buffer readability, it performs a `memcpy` without verifying the input buffer length, creating a buffer overflow that can overwrite the function pointer array without triggering stack cookie protections. 3. **Crafting the Exploit:** The exploit script, written in Python, crafts an input buffer that satisfies a 4-byte "magic key" check and specifies an offset (setting the second DWORD to 0) to invoke the first function pointer. Python natively allocates executable memory for variables in user space, allowing Kabai to point the overwritten kernel function pointer directly to user-mode memory holding kernel shellcode. 4. **Token Stealing Execution:** The kernel shellcode accesses the current thread's `_KTHREAD` structure via `FS:[0x124]`, locates its `_EPROCESS` structure, and traverses the `ActiveProcessLinks` doubly linked list. It searches for the System process by checking for a UniqueProcessId of `4`. Once found, it copies the System process token and overwrites the attacker process's token before restoring registers and cleanly returning to kernel mode. Launching `cmd.exe` from the elevated process demonstrates full `NT AUTHORITY\SYSTEM` privileges.

### Takeaways Kernel driver exploitation remains a practical and impactful avenue for privilege escalation, especially during penetration testing when restricted user access has already been obtained. While remote kernel attacks are considerably more difficult, local driver vulnerabilities are prevalent in third-party software. The presenter notes that once analysts understand kernel structures like `_EPROCESS` and `_KTHREAD`, kernel exploitation relies on standard binary exploitation concepts.