#HITB2021AMS D1T1 - Utilizing Lol-Drivers In Post Exploitation Tradecraft

### Overview In this talk, Oguzhan Cakir (introduced in the transcript as Walshakaya), a Red Team Engineer at Picus Security, discusses the tradecraft of leveraging legitimate signed drivers—specifically older versions of the Process Hacker driver—to execute kernel-assisted post-exploitation actions without developing custom rootkits. By utilizing what he describes as "LOL-drivers" (Living-off-the-Land drivers), red teams can bypass user-mode controls, avoid API hooking by Endpoint Detection and Response (EDR) agents, and interact directly with Protected Processes Light (PPL).

### Key Topics - **Kernel-Mode Motivations and Constraints**: Attackers turn to the kernel to evade user-mode monitoring, bypass access control lists (ACLs), and manipulate OS or AV components. However, challenges such as Driver Signature Enforcement (DSE), Windows PatchGuard, administrator requirement, and potential system instability (blue screens) make building custom rootkits difficult. - **Process Hacker Driver Architecture**: Process Hacker deploys a kernel driver communicating via IOCTLs (Input/Output Control codes) through `NtDeviceIoControlFile`. While newer versions enforce a client verification key to prevent unauthorized applications from sending dangerous IOCTLs, versions prior to 2016 lacked this check and exposed sensitive capabilities like arbitrary process memory writing. - **Hooking and Tool Adaptation via Microsoft Detours**: Red teamers do not necessarily need to recompile offensive tools to take advantage of LOL-drivers; they can inject a hooking DLL (such as one using Microsoft Detours) into existing tools like Mimikatz to dynamically redirect standard Windows API calls to driver IOCTLs. - **Protected Process Light (PPL) Hijacking**: Windows uses PPL to isolate security-critical processes like `lsass.exe`. The speaker explores the PPL hierarchy (where WinTCB outranks Anti-Malware) to host offensive payloads inside protected processes.

### Technical Details - **IOCTL Redirection**: Demonstrations show replacing `NtOpenProcess` (IOCTL 50) and `NtReadVirtualMemory` with `NtDeviceIoControlFile` calls dispatched to the Process Hacker device handle (`kphConnect`), effectively hiding standard API patterns from monitoring tools like API Monitor. - **Process Injection & Thread Hijacking**: Using driver routines (`kphSuspendProcess`, `kphResumeProcess`, and memory writing) combined with thread context modification (`SetThreadContext`), a shellcode runner is implemented that avoids typical API hooks for `WriteProcessMemory` and process suspension. - **PPL-Level Meterpreter Loader**: The speaker creates an early-bird injection loader that spawns a suspended `services.exe` process (signed with Windows TCB PPL level). Using the Process Hacker driver, the loader opens a full-access handle to this PPL process, writes an AES-encrypted Meterpreter payload, cues execution via an APC, and resumes the process. From this WinTCB-level `services.exe`, the operator migrates into Microsoft Defender's own process and successfully dumps credentials from a PPL-protected `lsass.exe` using Kiwi without error.

### Takeaways - Utilizing signed, legitimate drivers that neglect strict handle or client verification allows attackers to execute privileged kernel-level actions while dodging DSE and PatchGuard. - Converting standard Windows APIs into driver-specific IOCTLs normalizes or conceals malicious tradecraft from behavioral sensors tuned for typical user-mode API sequences. - The speaker consolidates these implementations into an open-source tool called "Offensive Process Hacker" on GitHub and highlights future research into quieter driver installation methods.