Tencent QMUDisk Driver Privilege Escalation Vulnerability Analysis and POC

Vulnerability Overview Tencent QMUDisk Driver Privilege Escalation Vulnerability Vulnerability Type: Privilege Escalation / Arbitrary Process Termination / Driver Operation / Security Callback Bypass Attack Vector: Local Required Privileges: Low (Any user can execute Tencent-signed binaries) Impact: Full system compromise, EDR/AV bypass, protected process termination, removal of kernel security infrastructure Scope of Impact Affected Component: kernel driver Affected Versions: - Tencent PC Manager versions containing with IOCTL - All versions of Tencent PC Manager and its kernel driver components - Other Tencent products using the same driver framework Remediation Immediate Actions (Vendor) 1. Remove Dangerous IOCTLs: - Disable or remove IOCTLs: (kill), (unload driver) - Audit all IOCTLs on devices: , , - Remove kernel callback operation capabilities 2. Implement Proper Access Control: - Verify if the caller is SYSTEM or a signed Tencent service - Validate that the caller is a legitimate Tencent service - For process termination: Verify that the target is not a protected process - For driver unloading: Allow only Tencent drivers 3. Strengthen RSA Verification: - Verify caller process integrity at runtime (not limited to disk signature) - Implement process context verification (check parent process, command line) - Add runtime integrity checks (detect DLL hijacking, process hollowing) - Verify that loaded modules match expected signatures 4. Reduce Attack Surface: - Remove unnecessary device symbolic links ( , ) - Consolidate functionality into a single audited device - Implement the principle of least privilege for each IOCTL 5. Code Signing: - Immediately revoke the signature of the vulnerable driver - Resign the patched driver using an updated certificate - Implement driver version checking to block vulnerable versions Workarounds (User) 1. Uninstall Tencent PC Manager (if not in use) 2. Disable Driver Auto-start: 3. Monitor for Exploitation: - Monitor the loading of - Monitor calls - Monitor changes to kernel callbacks Proof of Concept (POC) Code Malicious DLL ( ) Compilation Command Full Exploitation Script Vulnerability Details Root Cause The driver creates multiple device symbolic links accessible from user mode: - Primary device (requires RSA signature verification) - Unload device - Callback removal device - Additional control device The driver implements RSA signature verification to restrict access, but this protection can be bypassed via DLL hijacking of legitimate Tencent executables. Vulnerable IOCTLs The driver exposes multiple dangerous IOCTLs across different device interfaces: Device 1: IOCTL 0x2224C8 - Kill Process - Function: Terminate arbitrary process by PID - Input Buffer: - Impact: Can kill any process, including PPL protected processes, EDR agents, and system services IOCTL 0x222818 - Unload Driver - Function: Unload arbitrary kernel driver - Impact: Can disable security drivers, EDR kernel components, and antivirus filters Device 2: IOCTL 0x2225C0 - Memory/Process Operations IOCTL 0x2225C8 - System Operations IOCTL 0x2225CC - Advanced Operations IOCTL 0x2225D0 - Extended Functions Device 3: Function: Callback removal and security function bypass - Removes kernel callbacks (PsSetLoadImageNotifyRoutine, ObRegisterCallbacks) - Disables security monitoring hooks Device 4: (Primary Device) Function: General driver control and configuration - Requires RSA signature verification - Main interface for legitimate Tencent operations Kernel Implementation Key Deficiencies: No validation of: Caller permissions Target process protection level (PPL/ProtectedProcess) System process restrictions (PID 4, csrss.exe, etc.) Exploitation Attack Vector: DLL Hijacking Tencent distributes multiple executables with embedded RSA signatures, which pass driver verification: (32-bit, loads ) (64-bit, various DLL dependencies) Other Tencent components Exploitation Steps 1. Driver Loading (requires administrator privileges) 2. DLL Hijack Setup: - Place malicious alongside - DLL exports all required functions as stubs - DLL contains the exploitation payload 3. Trigger Exploitation: 4. Exploitation Flow: - starts - Loads (hijacked) - executes - Driver verifies RSA signature ✓ - succeeds - - Kernel calls - Target process terminates (even if protected)

Goal Reached Thanks to every supporter — we hit 100%!

Tencent QMUDisk Driver Privilege Escalation Vulnerability Analysis and POC

More from this source