Description
LgCoreTemp.sys is a vulnerable driver and more information will be added as found.
- UUID: 2c3884d3-9e4f-4519-b18b-0969612621bc
- Created: 2023-04-15
- Author: Nasreddine Bencherchali
- Acknowledgement: Paolo Stagno | Void_Sec
DownloadBlock
This download link contains the vulnerable driver!
Commands
sc.exe create LgCoreTemp.sys binPath=C:\windows\temp\LgCoreTemp.sys type=kernel && sc.exe start LgCoreTemp.sys
Use Case | Privileges | Operating System |
---|
Denial of Service | kernel | Windows 10 |
Detections
Sigma 🛡️
Expand
Names
detects loading using name only
Hashes
detects loading using hashes only
Resources
https://github.com/VoidSec/Exploit-Development/tree/b82b6d3ac1cce66221101d3e0f4634aa64cb4ca7/windows/x64/kernel/logitech_v.9.02.65_DoSKnown Vulnerable Samples
Download
Certificates
Expand
Imports
Expand
Imported Functions
Expand
- IofCompleteRequest
- IoCreateDevice
- KeSetSystemAffinityThread
- IoDeleteDevice
- IoDeleteSymbolicLink
- __C_specific_handler
- KeRevertToUserAffinityThread
- IoCreateSymbolicLink
- RtlInitUnicodeString
- HalGetBusDataByOffset
Exported Functions
Expand
Sections
Expand
Signature
Expand
{
"Certificates": [
{
"Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
"SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
"Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
"ValidFrom": "2012-12-21 00:00:00",
"ValidTo": "2020-12-30 23:59:59"
},
{
"Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
"SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
"Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
"ValidFrom": "2012-10-18 00:00:00",
"ValidTo": "2020-12-29 23:59:59"
},
{
"Signature": "8b12188765bda73964384c2644835bbd9b46b11b98230aca9ae6d31a2288244f75d3c6d06fae2ef7625676d2a3a0b4c2e978302d461ba5e165ec71a0a7a25c2c99972c0e8bb0194efab03034f581974934fcf3e2536a264de077493370531dd394429d692ca13a84d69d0aaf561d561f73c87b9f6fded706a759d2a1095789596a295795b686c90674ea1a3b582e32e5f5d0a08c685639ee5e9d8381ec102352a6bb4774fd8af770d88bc14abba20c5bcfe543ac7d71937873dbc033e68f81a1220571b348ac80c9b3ce8036252a6d5b4ebcfb381e540d0c4f7eaa4e1978056e261997a70a7b063ff7b3902985db8063e45664f59e7b5a583448883873b7de53",
"SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
"Subject": "C=US, ST=California, L=Newark, O=Logitech, CN=Logitech",
"ValidFrom": "2015-04-16 00:00:00",
"ValidTo": "2017-06-14 23:59:59"
},
{
"Signature": "13851a1e69a937f7a0bda4af7e1d6153fe9d8c5e0ca6751e781723ddfdec1a035539fb7195c7655aa78e30d2445a61db706fda2105c22e73ba49f1d193fe5dc9cd5e03e0899e3f741ed7f7388ba9d6cfbb352f3358a89256d1c84d3b82e6798416fc28b0b147f31da23eee87d9a67fa456a53fad842e29de7cbca8aaa33d0401eaba93a20e502229174c87e43a115fd6a425899b056b2fb4c9014c277b0bac190522a060153fdac9fb4d4c8ffb726777fd2794c7ba350e8849fe8dfd28af4a12bd0db39705de440c15fa362b03dcc15001f1a1115d14e5e2bd274b54be2b845e0fa6c374050aef97c38922b11f77f3bdcd43d4f14ca93fb58b84af64f2d01421",
"SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
"Subject": "C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 SHA256 Code Signing CA",
"ValidFrom": "2013-12-10 00:00:00",
"ValidTo": "2023-12-09 23:59:59"
},
{
"Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
"SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
"Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
"ValidFrom": "2011-02-22 19:25:17",
"ValidTo": "2021-02-22 19:35:17"
}
],
"CertificatesInfo": "",
"Signer": [
{
"Issuer": "C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 SHA256 Code Signing CA",
"SerialNumber": "6f20ba7d552fb9c436caf4cc7cbea4b3"
}
],
"SignerInfo": ""
}
Download
Certificates
Expand
Certificate 7e93ebfb7cc64e59ea4b9a77d406fc3b
Field | Value |
---|
ToBeSigned (TBS) MD5 | d0785ad36e427c92b19f6826ab1e8020 |
ToBeSigned (TBS) SHA1 | 365b7a9c21bd9373e49052c3e7b3e4646ddd4d43 |
ToBeSigned (TBS) SHA256 | c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff |
Subject | C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2 |
ValidFrom | 2012-12-21 00:00:00 |
ValidTo | 2020-12-30 23:59:59 |
Signature | 03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6 |
SignatureAlgorithmOID | 1.2.840.113549.1.1.5 |
IsCertificateAuthority | True |
SerialNumber | 7e93ebfb7cc64e59ea4b9a77d406fc3b |
Version | 3 |
Certificate 0ecff438c8febf356e04d86a981b1a50
Field | Value |
---|
ToBeSigned (TBS) MD5 | e9d38360b914c8863f6cba3ee58764d3 |
ToBeSigned (TBS) SHA1 | 4cba8eae47b6bf76f20b3504b98b8f062694a89b |
ToBeSigned (TBS) SHA256 | 88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976 |
Subject | C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4 |
ValidFrom | 2012-10-18 00:00:00 |
ValidTo | 2020-12-29 23:59:59 |
Signature | 783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475 |
SignatureAlgorithmOID | 1.2.840.113549.1.1.5 |
IsCertificateAuthority | False |
SerialNumber | 0ecff438c8febf356e04d86a981b1a50 |
Version | 3 |
Certificate 6f20ba7d552fb9c436caf4cc7cbea4b3
Field | Value |
---|
ToBeSigned (TBS) MD5 | ec45634a826b6d64211848832ef8dab1 |
ToBeSigned (TBS) SHA1 | 95e4adc0349ce66b62decc081bdd04bae5bfab64 |
ToBeSigned (TBS) SHA256 | 52e2c146848749590f3db28d87fce836aedf704d5369ab5edfc860246ad00b3f |
Subject | C=US, ST=California, L=Newark, O=Logitech, CN=Logitech |
ValidFrom | 2015-04-16 00:00:00 |
ValidTo | 2017-06-14 23:59:59 |
Signature | 8b12188765bda73964384c2644835bbd9b46b11b98230aca9ae6d31a2288244f75d3c6d06fae2ef7625676d2a3a0b4c2e978302d461ba5e165ec71a0a7a25c2c99972c0e8bb0194efab03034f581974934fcf3e2536a264de077493370531dd394429d692ca13a84d69d0aaf561d561f73c87b9f6fded706a759d2a1095789596a295795b686c90674ea1a3b582e32e5f5d0a08c685639ee5e9d8381ec102352a6bb4774fd8af770d88bc14abba20c5bcfe543ac7d71937873dbc033e68f81a1220571b348ac80c9b3ce8036252a6d5b4ebcfb381e540d0c4f7eaa4e1978056e261997a70a7b063ff7b3902985db8063e45664f59e7b5a583448883873b7de53 |
SignatureAlgorithmOID | 1.2.840.113549.1.1.11 |
IsCertificateAuthority | False |
SerialNumber | 6f20ba7d552fb9c436caf4cc7cbea4b3 |
Version | 3 |
Certificate 3d78d7f9764960b2617df4f01eca862a
Field | Value |
---|
ToBeSigned (TBS) MD5 | 1f056ff7d5f874984dc605402b7cb042 |
ToBeSigned (TBS) SHA1 | bdb348353a2203deb4b767914fa1bd7248dd728b |
ToBeSigned (TBS) SHA256 | a08e79c386083d875014c409c13d144e0a24386132980df11ff59737c8489eb1 |
Subject | C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 SHA256 Code Signing CA |
ValidFrom | 2013-12-10 00:00:00 |
ValidTo | 2023-12-09 23:59:59 |
Signature | 13851a1e69a937f7a0bda4af7e1d6153fe9d8c5e0ca6751e781723ddfdec1a035539fb7195c7655aa78e30d2445a61db706fda2105c22e73ba49f1d193fe5dc9cd5e03e0899e3f741ed7f7388ba9d6cfbb352f3358a89256d1c84d3b82e6798416fc28b0b147f31da23eee87d9a67fa456a53fad842e29de7cbca8aaa33d0401eaba93a20e502229174c87e43a115fd6a425899b056b2fb4c9014c277b0bac190522a060153fdac9fb4d4c8ffb726777fd2794c7ba350e8849fe8dfd28af4a12bd0db39705de440c15fa362b03dcc15001f1a1115d14e5e2bd274b54be2b845e0fa6c374050aef97c38922b11f77f3bdcd43d4f14ca93fb58b84af64f2d01421 |
SignatureAlgorithmOID | 1.2.840.113549.1.1.11 |
IsCertificateAuthority | True |
SerialNumber | 3d78d7f9764960b2617df4f01eca862a |
Version | 3 |
Certificate 611993e400000000001c
Field | Value |
---|
ToBeSigned (TBS) MD5 | 78a717e082dcc1cda3458d917e677d14 |
ToBeSigned (TBS) SHA1 | 4a872e0e51f9b304469cd1dedb496ee9b8b983a4 |
ToBeSigned (TBS) SHA256 | 317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8 |
Subject | C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5 |
ValidFrom | 2011-02-22 19:25:17 |
ValidTo | 2021-02-22 19:35:17 |
Signature | 812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94 |
SignatureAlgorithmOID | 1.2.840.113549.1.1.5 |
IsCertificateAuthority | True |
SerialNumber | 611993e400000000001c |
Version | 3 |
Imports
Expand
Imported Functions
Expand
- IoCreateDevice
- IoCreateSymbolicLink
- IoDeleteDevice
- IofCompleteRequest
- _allshl
- RtlUnwind
- KeSetSystemAffinityThread
- KeRevertToUserAffinityThread
- IoDeleteSymbolicLink
- RtlInitUnicodeString
- KeBugCheckEx
- HalGetBusDataByOffset
Exported Functions
Expand
Sections
Expand
- .text
- .rdata
- .data
- INIT
- .rsrc
- .reloc
Signature
Expand
{
"Certificates": [
{
"Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
"SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
"Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
"ValidFrom": "2012-12-21 00:00:00",
"ValidTo": "2020-12-30 23:59:59"
},
{
"Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
"SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
"Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
"ValidFrom": "2012-10-18 00:00:00",
"ValidTo": "2020-12-29 23:59:59"
},
{
"Signature": "8b12188765bda73964384c2644835bbd9b46b11b98230aca9ae6d31a2288244f75d3c6d06fae2ef7625676d2a3a0b4c2e978302d461ba5e165ec71a0a7a25c2c99972c0e8bb0194efab03034f581974934fcf3e2536a264de077493370531dd394429d692ca13a84d69d0aaf561d561f73c87b9f6fded706a759d2a1095789596a295795b686c90674ea1a3b582e32e5f5d0a08c685639ee5e9d8381ec102352a6bb4774fd8af770d88bc14abba20c5bcfe543ac7d71937873dbc033e68f81a1220571b348ac80c9b3ce8036252a6d5b4ebcfb381e540d0c4f7eaa4e1978056e261997a70a7b063ff7b3902985db8063e45664f59e7b5a583448883873b7de53",
"SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
"Subject": "C=US, ST=California, L=Newark, O=Logitech, CN=Logitech",
"ValidFrom": "2015-04-16 00:00:00",
"ValidTo": "2017-06-14 23:59:59"
},
{
"Signature": "13851a1e69a937f7a0bda4af7e1d6153fe9d8c5e0ca6751e781723ddfdec1a035539fb7195c7655aa78e30d2445a61db706fda2105c22e73ba49f1d193fe5dc9cd5e03e0899e3f741ed7f7388ba9d6cfbb352f3358a89256d1c84d3b82e6798416fc28b0b147f31da23eee87d9a67fa456a53fad842e29de7cbca8aaa33d0401eaba93a20e502229174c87e43a115fd6a425899b056b2fb4c9014c277b0bac190522a060153fdac9fb4d4c8ffb726777fd2794c7ba350e8849fe8dfd28af4a12bd0db39705de440c15fa362b03dcc15001f1a1115d14e5e2bd274b54be2b845e0fa6c374050aef97c38922b11f77f3bdcd43d4f14ca93fb58b84af64f2d01421",
"SignatureAlgorithmOID": "1.2.840.113549.1.1.11",
"Subject": "C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 SHA256 Code Signing CA",
"ValidFrom": "2013-12-10 00:00:00",
"ValidTo": "2023-12-09 23:59:59"
},
{
"Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
"SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
"Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
"ValidFrom": "2011-02-22 19:25:17",
"ValidTo": "2021-02-22 19:35:17"
}
],
"CertificatesInfo": "",
"Signer": [
{
"Issuer": "C=US, O=Symantec Corporation, OU=Symantec Trust Network, CN=Symantec Class 3 SHA256 Code Signing CA",
"SerialNumber": "6f20ba7d552fb9c436caf4cc7cbea4b3"
}
],
"SignerInfo": ""
}
source
last_updated: 2024-09-26