Living Off The Land Drivers

https://www.loldrivers.io
Admin
Living Off The Land Drivers is a curated list of Windows drivers used by adversaries to bypass...
Tokens:1,366,421
Snippets:11,229
Trust Score:7.5
Update:3 months ago
Show doc for...
Tokens:
Raw
### Install and Start WDTKernel.sys Driver

Source: https://www.loldrivers.io/drivers/08adabb3-7336-43de-a980-e23a55081f19

This command installs and starts the WDTKernel.sys driver. Ensure the driver file is present in the specified path.

```bash
1
          sc.exe create WDTKernel binPath=C:\windows\temp\WDTKernel.sys type=kernel && sc.exe start WDTKernel
        
```

--------------------------------

### Install and Start echo_driver.sys

Source: https://www.loldrivers.io/drivers/afb8bb46-1d13-407d-9866-1daa7c82ca63

This command installs and starts the echo_driver.sys driver. Ensure the driver file is placed in C:\windows\temp\ before execution.

```bash
sc.exe create echo_driver.sys binPath=C:\windows\temp\echo_driver.sys type=kernel && sc.exe start echo_driver.sys
```

--------------------------------

### Certificate JSON Structure Example

Source: https://www.loldrivers.io/drivers/e32bc3da-4db1-4858-a62c-6fbe4db6afbd

An example of how certificate data might be structured in JSON format, indicating certificate type and authority status.

```json
{
          "Certificates": [
          {
            "CertificateType": "CA",
            "IsCA": true,
            "IsCertificateAuthority": true,
            "IsCodeSigning": false,
            "SerialNumber": "0400000000012f4ee152d7"
          }
        ]
        }
```

--------------------------------

### Certificate JSON Structure Example

Source: https://www.loldrivers.io/drivers/e32bc3da-4db1-4858-a62c-6fbe4db6afbd

Example JSON structure representing certificate data, including CA type, serial number, signature, and TBS hashes.

```json
{
  "Certificates": [
    {
      "CertificateType": "CA",
      "IsCA": true,
      "IsCertificateAuthority": true,
      "IsCodeSigning": false,
      "SerialNumber": "0400000000012f4ee152d7",
      "Signature": "4e5e56901e46b4d94931f3bb1739281bc216ddfd41dc0905049b6fb2a29ad6992e40990055b5ea3fa52076d38634d417cc553ac782eeefa8babcd8069f1550dfcd167b523a02d7191afdaff0785ce04bc518df3a241edaacb8a95804020730dbb0125efe31bef00448f4f070f83a5e5683cf3dfb0dbcf4c5ed979db9d4dba52784e3389b8ba735864420a43b6da46a0ba183fd28ebdaef28f6cc885dfb0a3b00abe021ebe22f356c0f8e344597eba2f79933357ecb9a8abb454de73f9fc2d98afa65b26ec77e65ffe892e12c31a2f7b02736488f266f3bee4d761f79c3e57f9635bc2d0ecc01b08e7fff518080a792d4b34446648c874f166307314b63b0dff3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=BE, O=GlobalSign nv,sa, CN=GlobalSign Timestamping CA , G2",
      "TBS": {
        "MD5": "e140543fe3256027cfa79fc3c19c1776",
        "SHA1": "c655f94eb1ecc93de319fc0c9a2dc6c5ec063728",
        "SHA256": "3ca71e85908ff67368e4dc00253f5691b9e6d50c966e7784143d75fb92aa3448",
        "SHA384": "d9d366f9328f2b55ee19a32cc5fd5148b81d764282fe5dc196c872ae249caa51d2c212ef39f33945dfe0cda81925e326"
      }
    }
  ]
}
```

--------------------------------

### Install and Start BdApiUtil.sys Driver

Source: https://www.loldrivers.io/drivers/708650ed-c497-48be-97bc-9edd48cf2a1a

This command installs and starts the BdApiUtil.sys driver. It requires administrator privileges to execute.

```bash
sc.exe create BdApiUtil.sys binPath=C:\windows\temp\BdApiUtil.sys type=kernel && sc.exe start BdApiUtil.sys
```

--------------------------------

### Install and Start EnPortv.sys Driver

Source: https://www.loldrivers.io/drivers/18935808-e00c-4b75-a7fc-03e409a7570e

This command installs and starts the EnPortv.sys kernel driver. It requires administrator privileges.

```bash
sc.exe create EnPortv binPath=C:\windows\temp\EnPortv.sys type=kernel && sc.exe start EnPortv
```

--------------------------------

### Install and Start whql.sys Driver

Source: https://www.loldrivers.io/drivers/c366ee89-97ae-4523-b635-e05769384bd3

This command installs the whql.sys driver as a kernel service and then starts it. This is a common method for loading vulnerable kernel drivers for exploitation.

```bash
sc.exe create whql binPath=C:\windows\temp\whql.sys type=kernel && sc.exe start whql
```

--------------------------------

### Install and Start gibepext.sys Driver

Source: https://www.loldrivers.io/drivers/1e69f91e-4ec5-4c6a-b4a4-2279808b6545

This command installs the gibepext.sys driver as a kernel service and then starts it. Ensure the driver file is present in the specified path.

```bash
sc.exe create gibepext binPath=C:\windows\temp\gibepext.sys type=kernel && sc.exe start gibepext
```

--------------------------------

### Install and Start BEDaisy.sys Driver

Source: https://www.loldrivers.io/drivers/db666d40-c9fa-4039-bfac-a5d7afd61b67

This command installs and starts the BEDaisy.sys driver. It is used for privilege escalation on Windows 10.

```bash
sc.exe create BEDaisy.sys binPath=C:\windows\temp\BEDaisy.sys type=kernel && sc.exe start BEDaisy.sys
```

--------------------------------

### Install and Start bin_intigua_driver64.sys Driver

Source: https://www.loldrivers.io/drivers/68810b7a-06c5-498a-bbdf-28fb4d5d9201

This command installs and starts the bin_intigua_driver64.sys kernel driver. Ensure the driver file is present in the specified path before execution.

```bash
sc.exe create bin_intigua_driver64 binPath=C:\windows\temp\bin_intigua_driver64.sys type=kernel && sc.exe start bin_intigua_driver64
```

--------------------------------

### Install and Start RootLaser.sys Driver

Source: https://www.loldrivers.io/drivers/4c9a91ff-9284-49a7-899d-dfe85a112465

This command installs the RootLaser.sys driver as a kernel service and then starts it. Ensure you have administrator privileges before execution.

```bash
sc.exe create RootLaser binPath=C:\windows\temp\RootLaser.sys type=kernel && sc.exe start RootLaser
```

--------------------------------

### Install and Start IoManager.sys Driver

Source: https://www.loldrivers.io/drivers/2ad22816-46de-45b5-999b-864944635e0a

This command installs the IoManager.sys driver as a kernel-type service and then starts it. Ensure the driver file is present in the specified path.

```bash
sc.exe create IoManager binPath=C:\windows\temp\IoManager.sys type=kernel && sc.exe start IoManager
```

--------------------------------

### Install and Start wsdkd.sys Driver

Source: https://www.loldrivers.io/drivers/a8f2da2a-369c-4b4d-9a00-d7a892b9f7c3

This command installs and starts the wsdkd.sys driver. It is used to demonstrate the loading of the vulnerable driver for privilege escalation on Windows 10.

```bash
sc.exe create wsdkd.sys binPath=C:\windows\temp\wsdkd.sys type=kernel && sc.exe start wsdkd.sys
```

--------------------------------

### Install and Start 6c8a.sys Driver

Source: https://www.loldrivers.io/drivers/54af50e5-c964-485a-9b15-d5411971a425

This command installs and starts the 6c8a.sys kernel driver. Ensure the driver file is present in the specified path before execution.

```bash
sc.exe create 6c8a binPath=C:\windows\temp\6c8a.sys type=kernel && sc.exe start 6c8a
```

--------------------------------

### Install and Start ZYArKit.sys Driver

Source: https://www.loldrivers.io/drivers/f2032ff3-9c67-4d48-981b-2479babb153d

This command installs and starts the ZYArKit.sys kernel driver. Ensure the driver file is placed in the specified path.

```bash
sc.exe create ZYArKit binPath=C:\windows\temp\ZYArKit.sys type=kernel && sc.exe start ZYArKit
```

--------------------------------

### Install and Start kdhacker64_ev.sys Driver

Source: https://www.loldrivers.io/drivers/a6dd3aef-d3a7-4c72-abcd-e633e0c0706c

This command installs and starts the kdhacker64_ev.sys driver as a kernel service. Ensure the driver file is placed in the specified path before execution.

```bash
sc.exe create KDHacker binPath=C:\windows\temp\kdhacker64_ev.sys type=kernel && sc.exe start KDHacker
```

--------------------------------

### Install and Start ardrv.sys Driver

Source: https://www.loldrivers.io/drivers/9eb0156e-4c43-487f-be8c-40a7b19a4279

This command installs and starts the ardrv.sys driver. Ensure the driver file is present in the specified path before execution.

```bash
sc.exe create ardrv binPath=C:\windows\temp\ardrv.sys type=kernel && sc.exe start ardrv
```

--------------------------------

### Install and Start chinese_cheat_driver.sys

Source: https://www.loldrivers.io/drivers/98b064c4-c9ff-4cac-a6b6-a24964b70923

This command installs and starts the chinese_cheat_driver.sys kernel driver. Ensure the driver file is present in the specified path before execution.

```bash
sc.exe create chinese_cheat_driver binPath=C:\windows\temp\chinese_cheat_driver.sys type=kernel && sc.exe start chinese_cheat_driver
```
Tokens:
Raw