| タイトル | QILING Disk Master Kernel Driver diskbckp.sys 6, 0, 0, 0 Local Privilege Escapation |
|---|
| 説明 | QILING Disk Master Free ships a kernel driver, diskbckp.sys, that exposes the device \\.\diskbakdrv1 to a standard local user. A non-administrative user can open that device, attach a disk context, and issue an IOCTL that writes caller-controlled bytes to a selected raw disk offset.
The proof below uses only a temporary VHD and an administrator-only test file. The standard user cannot read or open the protected file for write through normal Windows file APIs, and cannot open the raw disk after the test volume is dismounted. The same user can still overwrite the file's raw NTFS clusters through the vendor driver.
An unprivileged user can exploit arbitrary read/write primitives over protected file resources to achieve local privilege escalation. |
|---|
| ソース | ⚠️ https://winslow1984.com/books/cve-collection/page/qiling-disk-master-kernel-driver-diskbckpsys-6-0-0-0-local-privilege-escalation |
|---|
| ユーザー | winslow1984 (UID 79140) |
|---|
| 送信 | 2026年05月22日 07:34 (4 月 ago) |
|---|
| モデレーション | 2026年07月11日 11:44 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 377781 [QILING Disk Master 6.0.0.0 Kernel Driver diskbckp.sys 特権昇格] |
|---|
| ポイント | 20 |
|---|