passwa11/hitcon-2023-demo-cve-2023-20562
This demonstration took place at HITCON 2023 in Taiwan. The demo highlights the exploitation of AMDCpuProfiler.sys within AMD μProf. By triggering an arbitrary write on the EPROCESS token, privilege escalation to SYSTEM level is achieved. Disabling the DSE flag allows loading of a malicious unsigned driver. The presentation further showcases an attack on 360 Total Security through nullifying its ObRegisterCallbacks, enabling execution of malicious actions on the processes of 360 Total Security.
exploit.exe LPE with a normal user, and a cmd.exe with SYSTEM privilege is expected to pop up.exploit.exe BYOVD in the cmd.exe with SYSTEM privilege, and the processes of 360 Total Security are expected to be killed.Note that since the DSE flag is not reset to the original value, and the callbacks is forcelly nullified, the system may not be stable.