{"id":34412,"date":"2024-08-13T05:09:20","date_gmt":"2024-08-13T05:09:20","guid":{"rendered":"https:\/\/kalilinuxtutorials.com\/?p=34412"},"modified":"2024-08-13T05:09:23","modified_gmt":"2024-08-13T05:09:23","slug":"driverjack","status":"publish","type":"post","link":"https:\/\/kalilinuxtutorials.com\/driverjack\/","title":{"rendered":"DriverJack – Exploiting NTFS Techniques For Covert Driver Loading"},"content":{"rendered":"\n

DriverJack<\/strong>\u00a0is a tool designed to load a vulnerable driver by abusing lesser-known NTFS techniques. <\/p>\n\n\n\n

These method bypass the registration of a Driver Service on the system by hijacking an existing service, and also spoof the image path presented in the Driver Load event. <\/p>\n\n\n\n

To further masquerade the presence of a vulnerable driver, the attack also abuses an Emulated Filesystem Read-Only bypass to swap the content of a driver file on a mounted ISO before loading it.<\/p>\n\n\n\n

Emulated Filesystem Read-Only Bypass<\/strong><\/a><\/h2>\n\n\n\n

DriverJack abuses the possibility of remapping files mounted on emulated filesystems to RW pages to overwrite their contents. This RO bypass is implemented in IoCdfsLib<\/strong>.<\/p>\n\n\n\n

Attack Overview<\/strong><\/a><\/h2>\n\n\n\n

Once the ISO is mounted, the attack proceeds by selecting a service driver that can be started or stopped, or one that can be triggered, requiring administrative privileges unless misconfigured.<\/p>\n\n\n\n

Key Attack Phases<\/strong><\/a><\/h3>\n\n\n\n
    \n
  1. ISO Mounting and Driver Selection<\/strong>\n