Privilege escalation was successfully achieved using the CorMem.sys(Physical Memory Read/Write) vulnerable driver, as shown in the figure below.
Add BiosToolCommonDriver.sys
Privilege escalation
PPL
Kill Process
UsingBYOVD.exe --k <targit pid>
UsingBYOVD.exe --ka (kill av/edr process)
开启核晶的*60
- 新增了VirtualToPhysical的函数 代码来源于redteamfortress（https://github.com/redteamfortress）的项目PPLShade（https://github.com/redteamfortress/PPLShade）
The code is derived from the PPLShade project（https://github.com/redteamfortress/PPLShade）, which is authored by redteamfortress（https://github.com/redteamfortress）. Further information on this project can be found on the redteamfortress GitHub page.
Loader mapping driver
代码已经更新
add commandline
dmp lsass (不支持Windows 11新版本)
build
remove process protect
dmp file
Update DriverSelector
Just switch the BYOVD driver you want to use in the DriverSelector file.
只要在文件DriverSelector切换你想使用的漏洞驱动即可，注意相应的类型。
使用了SysWhispers4加入到了本项目
Special thanks to the author of SysWhispers4 for sharing this project.
Killer