Privilege Escalation in Echo.ac echo_driver.sys

This eight-file standalone C++ proof-of-concept targets CVE-2023-38817 in Echo's anti-cheat driver. The active exploit is in PoC/PrivilegeEscalation/main.cpp, supported by DriverInterface.h and DriverTypes.h, with a CMake build definition. It opens the EchoDrv device and invokes IOCTLs 0x9e6a0594, 0xe6224248, and 0x60a26124 to initialize the driver interface, obtain a high-access handle for its own process, and perform the driver-mediated memory-copy primitive. It leaks the loaded ntoskrnl base through NtQuerySystemInformation, resolves PsInitialSystemProcess, reads the SYSTEM token and walks ActiveProcessLinks to locate its own EPROCESS. It then abuses the purported read-memory operation with reversed source/destination semantics to overwrite its own Token field with the SYSTEM token. The modified PoC is explicitly post-exploitation oriented: it runs hidden Windows commands to create an administrator RDP account, enable RDP, disable NLA, and open TCP/3389. No driver binary is included; the documentation references an external driver download and SHA-256, while the root README identifies affected Echo versions and blocklist restrictions.

Repository contains a small Windows local privilege escalation exploit (2 files: main.c and DriverTypes.h). The exploit targets a vulnerable kernel driver exposed as the device \\.\EchoDrv (echo.ac/EchoDrv-style). main.c: - Discovers the kernel base address by calling NtQuerySystemInformation(SystemModuleInformation=11) and locating ntoskrnl.exe. - Opens the driver device and issues two IOCTLs: 0x9E6A0594 (initial call) and 0xE6224248 to obtain a high-privilege handle to the current process. - Implements an arbitrary kernel memory copy primitive via IOCTL 0x60A26124 (mmCopy_params), used as both read and write. - Loads ntoskrnl.exe in user mode to compute the RVA of PsInitialSystemProcess, then reads the kernel pointer at kernelBase+RVA to obtain the SYSTEM EPROCESS. - Reads SYSTEM’s token from EPROCESS+0x4B8 (hardcoded for Win10 22H2) and overwrites the current process token, yielding SYSTEM privileges. - Spawns C:\Windows\System32\cmd.exe and then hides that cmd process by reading its EPROCESS pointer (via SystemExtendedHandleInformation=64 handle table walk) and unlinking its ActiveProcessLinks (offset 0x448) from the global process list (DKOM). DriverTypes.h provides supporting structs for IOCTL parameter blocks and NT system information/handle enumeration structures. No network activity is present; the primary fingerprintable target is the local device name \\.\EchoDrv and the specific IOCTL codes used.

This repository is a C++ project that implements a local privilege escalation exploit for Windows systems by leveraging a vulnerable signed driver (CVE-2023-38817). The exploit is structured as a Visual Studio solution with source and header files under the 'kur' directory. The main class, 'kur_t', encapsulates all exploit functionality, including installing the vulnerable driver, setting up the necessary registry keys, loading and unloading the driver, and interacting with it via IOCTLs. The exploit provides two main capabilities: (1) arbitrary kernel-mode read/write of user-mode memory using the driver's exposed MmCopyVirtualMemory functionality, and (2) obtaining process handles with arbitrary access directly from kernel mode, bypassing standard access checks. The code handles driver installation by writing the driver file to the system's temporary directory and creating the appropriate registry entries under 'SYSTEM\CurrentControlSet\Services'. It then loads the driver using native Windows APIs and communicates with it via DeviceIoControl calls. The exploit is not weaponized for remote or automated attacks but provides operational-level primitives for local privilege escalation and memory manipulation. No hardcoded IP addresses or network endpoints are present; all endpoints are local file paths and registry keys related to driver installation and operation.