Home

Awesome

HITCON 2023 Demo CVE-2023-20562

Description

This demonstration took place at HITCON 2023 in Taiwan. The demo highlights the exploitation of AMDCpuProfiler.sys within AMD μProf. By triggering an arbitrary write on the EPROCESS token, privilege escalation to SYSTEM level is achieved. Disabling the DSE flag allows loading of a malicious unsigned driver. The presentation further showcases an attack on 360 Total Security through nullifying its ObRegisterCallbacks, enabling execution of malicious actions on the processes of 360 Total Security.

Info

Environment

Usage

  1. Install AMD μProf 3.6.839 and 360 Total Security 6.6.0.1060
  2. Put exploit.exe and Malicious.sys to the same directory.
  3. Execute exploit.exe LPE with a normal user, and a cmd.exe with SYSTEM privilege is expected to pop up.
  4. Execute exploit.exe BYOVD in the cmd.exe with SYSTEM privilege, and the processes of 360 Total Security are expected to be killed.

Note that since the DSE flag is not reset to the original value, and the callbacks is forcelly nullified, the system may not be stable.

Reference