By: Alessandro Magnosi (@klezVirus)
DriverJack
Hijacking valid driver services to load arbitrary (signed) drivers abusing native symbolic links and NT paths
Key Attack Phases:
1) ISO Mounting and Driver Selection
1.1) The attack begins with mounting the ISO as a filesystem.
1.2) The attacker selects a service driver that can be manipulated, focusing on those that can be started or restarted without immediate detection.
2) Hijacking the Driver Path
2.1) The core of the attack involves hijacking the driver path. The methods used include:
2.2) Direct Reparse Point Abuse
2.3) DosDevice Global Symlink Abuse
2.4) Drive Mountpoint Swap