gmh5225/dsark64BYOVD proof-of-concept abusing the WHQL-signed DsArk64.sys driver for ring-0 process termination and kernel read/write via encrypted IOCTLs and process hollowing.
DsArk64.sys ships with 360 Total Security. WHQL-signed by Microsoft. LOLDrivers: magicsword-io/LOLDrivers#308. CVE: Requested (MITRE).
Process kill (ring 0)
0x80863008, input: 4-byte raw PIDZwOpenProcess(ALL_ACCESS) + ZwTerminateProcess from kernelKernel read
0x80863028, AES-128-CBC encrypted inputmemcpy(out, kernel_addr, n), max 512 bytesMmIsAddressValid()Kernel write
0x80863028, same encryptionmemcpy, max 32 bytesEncryption
.data section62b456ec407f0a9a05911cb6f238a7fee59329b6d408e7fa557637e62c9eaa43[MD5(payload) 16B][payload]The driver checks the caller process has a Qihoo Authenticode signature before granting device access. Bypassed via process hollowing:
360.cn (no account, no CAPTCHA)CREATE_SUSPENDED)CreateRemoteThread; shellcode calls CreateFileW("\\.\DsArk")IoGetCurrentProcess() image name, sees Qihoo cert, allows openDuplicateHandle the result back to the attacker processTerminateProcess the donorThe installer's WinMain never runs.
pycryptodome or cryptography pip package (for encrypted IOCTL tests)8/8 passed:
HKLM\...\360FsFlt\daboot=1 createdsc create/start (WHQL-signed, no test-signing)0x80863000 responded0x80863008 terminated notepad.exe0x80863020 reached handler0x80863028 crypto verified (AES key/IV correct, MD5 accepted)0xDEAD0000 rejected| File | SHA256 |
|---|---|
| dsark64.sys | cd3d1a2e119cbbb41ec0e7d7fb17bac106735d62b33ed3cde10087af1da89403 |
| DsArk64_win10.sys | 86127dbc92e2896319d1c9117b85e6db01ff001f3a85614d5ef9088d181b044a |
X: @weezerOSINT / Telegram: @weezer