MSREXEC - Elevate Arbitrary WRMSR to Kernel Execution

Download link: MSREXEC

Table Of Contents

• Introduction
  • MSREXEC Starter Code
  • WRMSR - Write Model Specific Register
  • MSR - Model Specific Registers
  • KVA Shadowing & KiSystemCall64
    • IA32_LSTAR With KVA Shadowing Disabled (KiSystemCall64)
    • IA32_LSTAR With KVA Shadowing Enabled (KiSystemCall64Shadow)
  • Thread Scheduler - Interrupts & LSTAR
• Existing Kernel Preventions
  • SMEP - Supervisor Mode Execution Prevention Of User Supervisor Pages
  • SMAP - Supervisor Mode Access Prevention Of User Supervisor Pages
• ROP - Return Oriented Programming
  • Syscall Wrapper To Setup ROP Gadgets
  • Syscall Handler - Restoring LSTAR & Calling Lambda
    • Syscall Handler - MASM
    • C++ Syscall Handler
• Example - VDM Integration
  • Skip Scanning Physical Memory
  • Read Physical Memory Using MSREXEC
  • Write Physical Memory Using MSREXEC
• Conclusion - Credits & Limitations
  • Limitations - HVCI & Hyper-V
  • Credit - Inspiration

Introduction

MSREXEC is a library to elevate arbitrary MSR (Model Specific Register) writes to kernel execution. The project is extremely modular and open ended on how writes to MSR’s are achieved. One only has to pass a lambda of type std::function<bool(std::uint32_t reg, std::uint64_t value)> to the constructor of vdm::msrexec_ctx to use this library. For demonstration, the project is set up to exploit vulnerable Windows drivers, however the project is not limited to using vulnerable drivers.