{"uuid": "10c98711-c357-4899-980c-035a042bcd53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-16098", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/50153", "content": "KitPloit - PenTest Tools!\nEDRSandblast - Tool That Weaponize A Vulnerable Signed Driver To Bypass EDR Detections And LSASS Protections\n\nhttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgAMzRHxJsuayYfmlgYJ40ZPtgY0mQX_fJ-1XWkdNeiicxSAw8cPQ3Kig390B1yD2NgyUGLg6nsd-oF0MRo3JVR5j7pBbRbMB_bL7NEOi7hdPfYidDlrP7XFKEh3bkv4dbtgCSY3SSq_EN2IMa_YNmVs785PfHxb69R4MfBvxTSIJHc-WlEy6RC6lxi/w640-h314/EDRSandblast.png EDRSandBlastis a tool written in Cthat weaponize a vulnerable signed  driver to bypass EDR detections (Kernel callbacks and ETW TIprovider) and LSASSprotections. Multiple userland unhooking techniques are also  implemented to evade userland monitoring.\n\nAs of release, combination of userland (--usermode) and Kernel-land  (--kernelmode) techniques were used to dump LSASSmemory under EDR  scrutiny, without being blocked nor generating \"OS Credential Dumping\"-related  events in the product (cloud) console. The tests were performed on 3 distinct  EDR products and were successful in each case. DescriptionEDR bypass through Kernel callbacks removalEDR products use Kernel callbacks on Windows to be notified by the kernel of  system activity, such as process and thread creation and loading of images  (exe / DLL).\n\nThe Kernel callbacks are defined from user-land using a number of documented  APIs (nt!PsSetCreateProcessNotifyRoutine, nt!PsSetCreateThreadNotifyRoutine,  etc.). The user-land APIs add driver-supplied callback routines to undocumented  arrays of routines in Kernel-space:\n\n* PspCreateProcessNotifyRoutinefor process creation\n* PspCreateThreadNotifyRoutinefor thread creation\n* PspLoadImageNotifyRoutinefor image loading EDRSandBlastenumerates the routines defined in those arrays and remove any  callback routine linked to a predefined list of EDR drivers (more than 1000  thousands drivers of security products from the allocated filter altitudes).  The enumeration and removal are made possible through the exploitation of an  arbitrary Kernel memory read / write vulnerability of the Micro-Star MSI Afterburnerdriver (CVE-2019-16098). The enumeration and  removal code is largely inspired from br-sn's CheekyBlinder project.\n\nThe offsets of the aforementioned arrays are hardcoded in the NtoskrnlOffsets.csvfile for more than 350 versions of the Windows Kernel ntoskrnl.exe. The choice of going with hardcoded offsets instead of pattern  searches is justified by the fact that the undocumented APIs responsible for  Kernel callbacks addition / removal are subject to change and that any attempt  to write Kernel memory at the wrong address may (and often will) result in a Bug Check(Blue Screen of Death). For more information on how the offsets  were gathered, refer to Offsets section. EDR bypass through deactivation of the ETW Microsoft-Windows-Threat-Intelligence providerThe ETW Microsoft-Windows-Threat-Intelligenceprovider log data about the  usages of some Windows API commonly used maliciously. This include the nt!MiReadWriteVirtualMemoryAPI, called by nt!NtReadVirtualMemory(which is  used to dump LSASSmemory) and monitored by the nt!EtwTiLogReadWriteVmfunction.\n\nEDR products can consume the logs produced by the ETW TIprovider through  services or processes running as, respectively, SERVICE_LAUNCH_PROTECTED_ANTIMALWARE_LIGHTor PS_PROTECTED_ANTIMALWARE_LIGHT, and associated with an Early Launch Anti Malware (ELAM)driver.\n\nAs published by slaeryanin a CNO Development Labsblog post,  the ETW TIprovider can be disabled altogether by patching, i[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T00:00:13.193080Z"}