blueisbeautiful/cve-2018-19323An exploitation framework for CVE-2018-19323 - GIGABYTE GDrv privilege escalation vulnerability with multi-architecture support and framework integration
This repository contains a complete and advanced exploitation framework for CVE-2018-19323, a critical vulnerability in the GIGABYTE gdrv.sys driver. This vulnerability allows unprivileged users to read and write arbitrary Model-Specific Registers (MSRs), leading to a full Ring-0 (kernel) compromise and privilege escalation to NT AUTHORITY\SYSTEM.
The framework is designed to be modular, robust, and feature-rich, providing a comprehensive tool for security research, red teaming, and vulnerability analysis.
IA32_LSTAR MSR and executing a token-stealing shellcode.core, payloads, evasion, monitor, multiarch, framework) for easy extension and maintenance..
├── exploit.py # Main exploitation framework and CLI
├── core.py # Core driver interaction and exploit primitives
├── payloads.py # Shellcode generation, custom payloads, and encoding
├── evasion.py # Anti-VM, anti-debugging, and persistence techniques
├── monitor.py # Logging, performance monitoring, and reporting
├── multiarch.py # Multi-architecture support (x86/x64/ARM64)
├── framework.py # Integration with Metasploit, Cobalt Strike, etc.
├── tests.py # Comprehensive unit, integration, and performance tests
└── README.md # This documentation file
gdrv.sys driver must be present on the target system.psutil, cryptography, requests# Install required Python packages
pip install psutil cryptography requests
The main exploit framework is executed via exploit.py. It provides several command-line options for different operational modes.
# Display help and all available options
python exploit.py --help
# Default stealth mode (recommended)
# Runs all pre-flight evasion checks before exploitation.
python exploit.py
# Aggressive mode
# Skips evasion checks for faster execution in controlled environments.
python exploit.py --aggressive
# Debug mode
# Provides verbose logging for development and analysis.
python exploit.py --debug
# Run the full test suite
# Validates all framework components without executing the exploit.
python exploit.py --test-only
[!WARNING] This software is intended for educational and authorized security research purposes only. Unauthorized use on any system is illegal and strictly prohibited. The author, kali, is not responsible for any damage or misuse of this framework.
The gdrv.sys driver exposes an IOCTL 0xC3502580 that can be called by any user-mode application. This IOCTL takes a structure containing an operation type (read/write), an MSR register index, and a value. The driver does not perform any access control checks, allowing any process to read or write to any MSR.
This is a critical flaw because MSRs control fundamental CPU operations. Specifically, the IA32_LSTAR MSR (at address 0xC0000082) stores the address of the system call handler in the kernel. By reading this MSR, we can defeat Kernel Address Space Layout Randomization (KASLR) and calculate the kernel's base address. By writing to it, we can redirect system calls to our own shellcode, achieving arbitrary code execution in Ring-0.
\\.\GIO device.IA32_LSTAR MSR to get a pointer within the kernel, bypassing KASLR.EPROCESS structure of the current process, locate the EPROCESS of the SYSTEM process (PID 4), and copy its security token to our process.IA32_LSTAR MSR is overwritten with the address of our shellcode.NT AUTHORITY\SYSTEM privileges.IA32_LSTAR value is restored to prevent system instability.evasion.py module includes checks for CPU core count, disk size, recent file activity, installed programs, and advanced timing/hooking detection to create a more robust environmental fingerprint.payloads.py module allows for the dynamic generation of various payloads (reverse shells, Meterpreter, Cobalt Strike beacons) for different architectures, with multiple layers of encoding.multiarch.py module provides a comprehensive abstraction layer for handling differences between x86, x64, and ARM64, including pointer sizes, calling conventions, kernel structures, and instruction sets.framework.py module can generate ready-to-use modules for Metasploit (.rb), Cobalt Strike (.cna), Empire (.py), and Sliver (.go), automating the integration process for red team operations.The framework includes a comprehensive test suite in tests.py. You can run all tests to ensure the integrity and functionality of all components.
# Run all unit, integration, and performance tests
python tests.py --all
# Run only unit tests
python tests.py --unit
This project is a demonstration of advanced exploitation techniques and should be used responsibly.