anylnk/ksldbyovdarkExploits a KSLD anti-rootkit driver vulnerability (IOCTL 0x222044) to bypass PPL protection and access sensitive process memory, enabling local privilege escalation on Windows systems.
Reference: KslKatz and KslDump.
KslD.sys, a.k.a. MpKslDrv.sys, used to be one of the anti-rootkit tool drivers of Microsoft Antimaware (which includes Microsoft Defender Antivirus, Windows Defender Antivirus in the old Windows versions, Microsoft Security Essentials, System Center Endpoint Protection, etc.)
As an ark driver, it allows itself to run with any file names, any service names and any device names (Such configurations stores in Registry HKLM\SYSTEM\CurrentControlSet\Services(DriverServiceName)), and also allows multiple instances (even different versions) to coexist to avoid blockages from malware.
The driver with version 1.1.25081.3013 checks if the user has at least admin priviledge and if is the allowed process (also stores in the service config) before open its device, but there're no further verifications to check if the config has been modified or the IOCTL code is from an actual MS-Antimalware process. This exposes IOCTL 0x222044 to local system administrators and grant them access to sensitive data in Protected Processes (For example, lsass.exe under PPL protection)
We can craft a specific service config and load the driver, because of the reasons mentioned previously, we don't need to modify the exist KSLD configs but create a totally new service. The driver would trust our project exe and bypass file/service/device name-based vulndrv protections.
Since Microsoft don't believe this issue meets their critera of security vulnerability, the defects mentioned in this disclosure may not be patched instantly.
