Arbitrary kernel access in ASRock RGB Driver AsrDrv103.sys

This repository contains a local privilege escalation exploit for CVE-2020-15368, targeting the vulnerable ASRock AsrDrv107 driver on Windows. The exploit is implemented in C++ and consists of two main components: a user-mode launcher (AsrockPloit) and a custom kernel-mode payload (DummyDriver). The exploit works by opening a handle to the vulnerable driver (\\.\GlobalRoot\Device\AsrDrv107), crafting and encrypting IOCTL commands to read/write physical memory and control registers, and ultimately mapping and executing a custom driver (DummyDriver) in kernel space. The exploit also interacts with the Beep device (\\.\GlobalRoot\Device\Beep) to facilitate code injection. The repository includes code for parsing PDB symbols to resolve kernel function addresses, and uses a compile-time string encryption library for obfuscation. The exploit provides full kernel code execution, allowing for arbitrary actions at the highest privilege level. The structure is typical for a Windows kernel exploit: project files for Visual Studio, headers for driver communication and cryptography, and main logic in entry.cpp files for both user and kernel components.

This repository provides a full exploit and proof-of-concept for CVE-2020-15368, a vulnerability in the Asrock repackaged RWEverything driver (AsrDrv104) for Windows. The exploit consists of two main components: a custom kernel driver (MyDriver1) and a user-mode exploit (exploit.cpp). The exploit leverages the vulnerable driver's IOCTL interface, which is protected by weak encryption, to achieve arbitrary kernel memory read/write and ultimately execute arbitrary code in kernel mode. The exploit works by scanning physical memory for the driver's code, patching it to redirect execution to custom shellcode, and then restoring the original code to avoid system instability. The payload spawns a new kernel thread, allowing for privilege escalation and further kernel-level actions. The repository is structured as a Visual Studio solution with separate projects for the exploit and the custom driver. The main entry point is 'exploit/exploit.cpp', which orchestrates the attack. The exploit targets local Windows systems with the vulnerable driver installed and requires administrative privileges to interact with the device. No network endpoints are involved; all attack vectors are local. The exploit is operational and provides a working privilege escalation method for affected systems.