Exploiting eneio64.sys Kernel Driver on Windows 11 by Turning Physical Memory R/W into Virtual Memory R/W

MITRE Techniques

• [T1612 ] Develop Capabilities – The author developed a proof-of-concept exploit leveraging eneio64.sys IOCTLs and custom virtual-to-physical translation code to read/write kernel memory. Quote: ‘The complete exploit source code can be found here.’
• [T1210 ] Exploitation of Vulnerability – The driver exposes IOCTL 0x80102040 to map physical memory and IOCTL 0x80102044 to unmap it, which is exploited to gain read/write primitives. Quote: ‘IOCTL_WINIO_MAPPHYSTOLIN’ and ‘IOCTL_WINIO_UNMAPPHYSADDR’
• [T1003 ] OS Credential Dumping – The exploit locates and copies the SYSTEM process token into the current process token to elevate privileges to SYSTEM. Quote: ‘Finally, we take System.exe’s token and copy it to the physical address referencing our process’s token.’
• [T1547 ] Boot or Logon Autostart Execution (contextual mitigation discussion) – The article references Microsoft mitigations (Vulnerable Driver Blocklist, HVCI) that aim to prevent vulnerable drivers from loading, informing the attacker’s choice of driver. Quote: ‘Microsoft has reinforced Windows preminution against the loading of vulnerable drivers with the Vulnerable Driver Blocklist… and reinforced with HVCI.’
• [T1082 ] System Information Discovery – The author uses System information APIs (EnumDeviceDrivers, NtQuerySystemInformation for Big Pool and Handles) to find ntoskrnl base, pool addresses, and kernel object addresses. Quote: ‘EnumDeviceDrivers’ and ‘NtQuerySystemInformation2(SystemBigPoolInformation)’