Arbitrary Process Handle Access in Razer Synapse rzpnk.sys

This repository contains a single Metasploit module (modules/exploits/windows/local/razer_zwopenprocess.rb) that exploits a local privilege escalation vulnerability (CVE-2017-9769) in the Razer Synapse rzpnk.sys driver on Windows systems. The exploit works by leveraging a vulnerable IOCTL handler that allows an attacker to open a handle to an arbitrary process (such as winlogon.exe) with SYSTEM privileges. The module checks for the presence and version of the vulnerable driver, ensures the RazerIngameEngine.exe process is not running (killing it if necessary), and then injects attacker-supplied shellcode into winlogon.exe. The shellcode is executed by installing a hook and triggering it via LockWorkStation(), resulting in code execution as SYSTEM. The exploit is operational and requires a native Windows meterpreter session on a 64-bit Windows system with the vulnerable driver installed. The repository is structured as a standard Metasploit module and is intended for use within the Metasploit Framework.

This repository is a C++ proof-of-concept exploit for CVE-2017-9769, targeting the Razer Synapse driver (rzpnk.sys) on Windows. The exploit demonstrates how a specially crafted IOCTL can be sent to the vulnerable driver to obtain a handle to an arbitrary process, potentially leading to privilege escalation. The code is organized as a Visual Studio project, with the main logic in src/main.cpp, which loads the driver, creates and starts a service for it, and then issues the malicious IOCTL. Supporting files handle driver deployment, service management, and access queries. The exploit is not weaponized but provides a clear demonstration of the vulnerability and its impact.