Fortinet fortimon3_74.sys - PPL Bypass via Unauthenticated Kill Command

Overview

A vulnerability in Fortinet's fortimon3_74.sys kernel driver (FortiClient's "anti-exploit" minifilter) allows any local administrator to terminate any process - including PPL (Protected Process Light) protected processes like Windows Defender (MsMpEng.exe) and lsass.exe - by sending an 8-byte message to an unauthenticated communication port.

No buffer overflow. No heap spray. No ROP chain. Just 8 bytes.

Vulnerability Details

The driver exposes a minifilter communication port with no caller authentication. It accepts a simple 8-byte message:

struct {
    DWORD magic;  // 0x6C6C696B ("kill" in little-endian ASCII)
    DWORD pid;    // Target process ID
};

Upon receiving this message, the driver calls ZwOpenProcess with PROCESS_ALL_ACCESS from kernel mode (bypassing PPL checks), then ZwTerminateProcess. No validation is performed on the caller or target.

Additional Issue: Handle Leak

The ZwOpenProcess handle is created in the caller's handle table (missing OBJ_KERNEL_HANDLE flag), creating a brief window where a usermode attacker could duplicate a PROCESS_ALL_ACCESS handle to a PPL-protected process like lsass.exe - enabling credential theft without killing the process.

Root Causes

1. No caller authentication - any admin process can connect to the port
2. No target validation - any PID is accepted, including system-critical processes
3. Excessive privilege - PROCESS_ALL_ACCESS used instead of PROCESS_TERMINATE
4. Handle table misuse - missing OBJ_KERNEL_HANDLE flag exposes kernel handle to usermode

Demo

lsass.exe Kill (PPL-protected)

Video Demo

Watch the full demo - demonstrates PPL bypass against protected processes.

Files

Build & Usage

cl.exe poc.c /Fe:poc_kill.exe
poc_kill.exe MsMpEng.exe

Requires: local administrator privileges, fortimon3_74.sys loaded.

Disclosure

• Reported to Fortinet PSIRT with full technical details, PoC, and video demo
• Status: Duplicate (another researcher reported the same issue)

me1n