Introduction While talking with a friend he recently mentioned having found a suspicious process running on his server. It was strange because he had gotten high network activity warnings a few days prior and then there was a process named softirq eating up almost 100% of the server’s CPU. Thankfully he had a copy of the server’s state and I was able to get a copy. Turns out there were actually…
Introduction There have been a lot of open source atteptms to creating something like strace for Windows. Many have drawbacks or specific/customized setup requirements. This is simply my attempt to make a quick system call tracer that’s easy to use and doesn’t require any complex setup. The code AWStrace is here . Previous Work Here are some of the previous attempts at making an strace for…
Everything in this post was done on a Windows 10 22H2 machine. Kernel version was: 10.0.19041.2486 Introduction Microsoft Warbird is an undocumented encryption technology generally used for things relating to software licensing (DRM) and security mechanisms. There has been some, but not much, previous open source research. Some links which provide further insight:…
The API Just a quick post about something I found quite interesting. In Windows 10 version 2004+ (according to this ) there is a new system call which caught my attention: NtPssCaptureVaSpaceBulk . Specifically the caputing “bulk” referenced in the name made me think it could be useful. Looking at the API in the kernel, I quickly noticed several calls using the PsProcessType type as the first…
The Crash This all began when I was playing around with the PE file format and ended up tinkering with the loading process of drivers. Upon loading a particularly simple driver the OS crashed with the following error: The stack clearly shows the bugcheck occuring within the driver loading process. I instantly suspected that the issue was with the imports as the driver I loaded only imported…
Observations In the world of privlige escalation, 3rd party elevated service programs are espically interesting to look at. One such program is Sophos’ HitmanPro.Alert (HMPA) . This program is designed to work with an additional AV product to provide “advanced” detection and prevention capabilities against malware and exploits. However, this HMPA became interesting when I observed this message in…
Research Drivers commanly use IOCTLs for communication from user and kernel mode, but what really goes on behind the scene. DeviceIoControl is the API responsible for sending an IRP_MJ_DEVICE_CONTROL request (along with an IOCTL and buffers of data) to a driver. The driver specifies the address of the funciton that then handles these requests. This is done through the array…
Discovery Qualcomm has a serivce program named AdminService.exe which runs on Windows machines with the Qualcomm Atheros QCA61x4 Bluethooth device. Other devices possibly have this service. You can download the entire service and driver package here . In a real world situation, the package would be installed by Windows. So, what is wrong with this AdminService? Well, services can receive control…
SoftEther VPN is a VPN program by the university of Tsukba in Japan. Users can use the client program to connect to servers, or use theserver program to host servers. The Server Manager for Windows used a driver named See.sys for low level operations. This driver ( See.sys ) was actually part of SoftEther’s github repository which can be found here . The driver is based off the old WinPcap driver…
Lately I’ve been digging into driver exploitation in Windows. One of the hardest parts is actually finding the drivers to decompile, debug, and experiment with. This led me to look for easy to find drivers. I found Driver Easy . Driver Easy seems to have a large database of drivers, and I thought I could access them for experimentation purposes. I discovered that the files are retrieved by HTTP…