> For the complete documentation index, see [llms.txt](https://breakpoint-journal.gitbook.io/breakpoint/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breakpoint-journal.gitbook.io/breakpoint/windows/windows-privilege-escalation/drivers-ed-for-privilege-escalation.md).

# Driver's Ed for Privilege Escalation

Windows drivers are essential packages of code, responsible for a variety of high and low-level application control such as managing file systems, I/O buses and other physical drivers. These interact in the Windows Kernel and therefore run as very privileged code. 

[Print Operators](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-groups#print-operators) are responsible for managing, well, the printers. This gives them the ability to load drivers for updating the printer software. This privilege can be abused however.

## Verify Loaded Drivers

You can use a tool like Nirsoft's [DriverView.exe](driverview.exehttp://www.nirsoft.net/utils/driverview.html) to verify which drivers are loaded.

{% code title="Grepping for loaded drivers" %}

```bat
.\DriverView.exe /stext drivers.txt
cat drivers.txt | Select-String -pattern <driver-name>
```

{% endcode %}

## Enabling SeLoadDriverPrivilege

You can compile [EnableSeLoadDriverPrivilege.cpp](https://raw.githubusercontent.com/3gstudent/Homework-of-C-Language/master/EnableSeLoadDriverPrivilege.cpp) and execute it on the target machine to enable the SeLoadDriverPrivilege.

> Note: Since Windows 10 Version 1803, the "SeLoadDriverPrivilege" is not exploitable, as it is no longer possible to include references to registry keys under "HKEY\_CURRENT\_USER".

## BYOVD

BYOVD is "bring your own vulnerable driver". As a Print Operator, you may download known vulnerable drivers (e.g. [Capcom.sys](https://github.com/FuzzySecurity/Capcom-Rootkit/blob/master/Driver/Capcom.sys)) and load them into the Windows Kernel to gain kernel code execution.&#x20;

{% code title="Adding the driver to the registry" overflow="wrap" %}

```bat
reg add HKCU\System\CurrentControlSet\CAPCOM /v ImagePath /t REG_SZ /d "\??\C:\Tools\Capcom.sys"
reg add HKCU\System\CurrentControlSet\CAPCOM /v Type /t REG_DWORD /d 1
```

{% endcode %}

You may then execute [ExploitCapcom](https://github.com/tandasat/ExploitCapcom), a standalone exploit for the vulnerable feature in Capcom.sys. For context...

> The feature is exposed through IOCTL and to execute an arbitrary user supplied function pointer with disabling SMEP. This exploit simply abuses the feature to perform token stealing to get the SYSTEM privileges, and then launches the command prompt with the elevated privilege.

You can modify ExploitCapcom.cpp as necessary to generate a reverse shell instead of a cmd.exe prompt.

## Cleanup - Registry Key Removal

```
reg delete HKCU\System\CurrentControlSet\Capcom
```