{"id":19499920,"url":"https://github.com/tijme/amd-ryzen-master-driver-v17-exploit","last_synced_at":"2025-10-08T05:54:11.713Z","repository":{"id":65495511,"uuid":"591675404","full_name":"tijme/amd-ryzen-master-driver-v17-exploit","owner":"tijme","description":"Cobalt Strike (CS) Beacon Object File (BOF) for kernel exploitation using AMD's Ryzen Master Driver (version 17).","archived":false,"fork":false,"pushed_at":"2023-01-21T14:15:25.000Z","size":1156,"stargazers_count":142,"open_issues_count":0,"forks_count":26,"subscribers_count":5,"default_branch":"master","last_synced_at":"2025-04-25T22:35:20.119Z","etag":null,"topics":["adversary-simulation","beacon","bof","cobalt-strike","cve-2020-12928","exploit","kernel","red-teaming"],"latest_commit_sha":null,"homepage":"","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/tijme.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2023-01-21T14:01:14.000Z","updated_at":"2025-04-22T08:46:15.000Z","dependencies_parsed_at":"2023-02-12T10:31:28.909Z","dependency_job_id":null,"html_url":"https://github.com/tijme/amd-ryzen-master-driver-v17-exploit","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/tijme/amd-ryzen-master-driver-v17-exploit","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tijme%2Famd-ryzen-master-driver-v17-exploit","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tijme%2Famd-ryzen-master-driver-v17-exploit/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tijme%2Famd-ryzen-master-driver-v17-exploit/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tijme%2Famd-ryzen-master-driver-v17-exploit/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/tijme","download_url":"https://codeload.github.com/tijme/amd-ryzen-master-driver-v17-exploit/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tijme%2Famd-ryzen-master-driver-v17-exploit/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":278897285,"owners_count":26064780,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-08T02:00:06.501Z","response_time":56,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["adversary-simulation","beacon","bof","cobalt-strike","cve-2020-12928","exploit","kernel","red-teaming"],"created_at":"2024-11-10T22:06:44.499Z","updated_at":"2025-10-08T05:54:11.664Z","avatar_url":"https://github.com/tijme.png","language":"C","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003cp align=\"center\"\u003e\r\n    \u003cimg src=\"https://raw.githubusercontent.com/tijme/amd-ryzen-master-driver-v17-exploit/master/.github/logo.png\" width=\"450\"/\u003e\r\n\u003c/p\u003e\r\n\u003cp align=\"center\"\u003e\r\n    \u003ca href=\"https://github.com/tijme/amd-ryzen-master-driver-v17-exploit/blob/master/LICENSE.md\"\u003e\u003cimg src=\"https://raw.finnwea.com/shield/?firstText=Source\u0026secondText=Licensed\" /\u003e\u003c/a\u003e\r\n    \u003cbr/\u003e\r\n    \u003cb\u003eCobalt Strike Beacon Object File for kernel exploitation using AMD's Ryzen Master Driver (version 17).\u003c/b\u003e\r\n    \u003cbr/\u003e\r\n    \u003csup\u003eBuilt by \u003ca href=\"https://www.linkedin.com/in/tijme/\"\u003eTijme\u003c/a\u003e. Credits to \u003ca href=\"https://github.com/lldre\"\u003eAlex\u003c/a\u003e for teaching me! Made possible by \u003ca href=\"https://northwave-security.com/\"\u003eNorthwave Security\u003c/a\u003e \u003cimg src=\"https://raw.githubusercontent.com/tijme/amd-ryzen-master-driver-v17-exploit/master/.github/northwave.png\"/\u003e\u003c/sup\u003e\r\n    \u003cbr/\u003e\r\n\u003c/p\u003e\r\n\r\n## Description\r\n\r\nThis is a Cobalt Strike (CS) Beacon Object File (BOF) and executable which exploits AMD's Ryzen Master Driver (version 17). It only overwrites the beacon process token with the system process token. But, just like \u003ca href=\"https://github.com/tijme/kernel-mii/blob/master/KernelMii.c\"\u003eKernelMii\u003c/a\u003e, this BOF is mostly just a good foundation for further kernel exploitation via CS. You can utilise it to disable EDR, disable ETW TI, dump LSASS PPL, or do other undetected malicious actions.\r\n\r\nI initially identified this vulnerability (if you can call it a vulnerability, concidering the administrator-to-kernel is \u003ca href=\"https://www.microsoft.com/en-us/msrc/windows-security-servicing-criteria\"\u003enot\u003c/a\u003e concidered a security boundary) during some kernel driver research. I identified four attack vectors in the driver. I later found out that \u003ca href=\"https://github.com/h0mbre\"\u003e@h0mbre\u003c/a\u003e identified \u003ca href=\"https://h0mbre.github.io/RyzenMaster_CVE/\"\u003etwo\u003c/a\u003e of these vectors back in 2020 (CVE-2020-12928). Back then, every user on the system could open handles to the symbolic link. AMD 'fixed' it by restricting access to local administrators. But from a threat actor and red teaming perspective, it is still very useful.\r\n\r\n**I developed and tested this exploit on Windows 10 Pro 22H2 19045.2486.** The executable is somewhat stable. Cobalt Strike beacons have a stack limitation of 4096 bytes, so it's less likely to work (during development it always *did* work though). The executable should always work.\r\n\r\n\u003cp align=\"center\"\u003e\r\n    \u003cimg width=\"1000\" src=\"https://raw.githubusercontent.com/tijme/amd-ryzen-master-driver-v17-exploit/master/.github/screenshot.png\" /\u003e\r\n\u003c/p\u003e\r\n\r\n## Usage\r\n\r\nClone this repository first. Then review the code, compile from source and use it in Cobalt Strike.\r\n\r\n**Compiling**\r\n\r\n    make\r\n\r\n**Usage**\r\n\r\nLoad the `AMDRyzenMasterDriverV17Exploit.cna` script using the Cobalt Strike Script Manager. Then use the command below to execute the exploit.\r\n\r\n    $ amd_ryzen_master_driver_v17_exploit\r\n\r\nAlternatively (and for testing purposes), you can directly run the compiled executable. This will spawn a command prompt as SYSTEM.\r\n\r\n    $ .\\AMDRyzenMasterDriverV17Exploit.x64.exe\r\n\r\n## Limitations\r\n\r\n* Due to the ACL on the symbolic link only local administrators can communicate with the driver.\r\n* The physical memory limits are currently hardcoded.\r\n\r\n## Todo\r\n\r\n* Load the vulnerable driver from memory instead of from disk.\r\n* Make the exploit stable \u0026 compatible with multiple Windows versions.\r\n* Adjust physical page iterations based on how many RAM is available.\r\n\r\n## Issues\r\n\r\nIssues or new features can be reported via the [issue tracker](https://github.com/tijme/amd-ryzen-master-driver-v17-exploit/issues). Please make sure your issue or feature has not yet been reported by anyone else before submitting a new one.\r\n\r\n## License\r\n\r\nCopyright (c) 2022 Tijme Gommers \u0026 Northwave Security. All rights reserved. View [LICENSE.md](https://github.com/tijme/amd-ryzen-master-driver-v17-exploit/blob/master/LICENSE.md) for the full license.\r\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftijme%2Famd-ryzen-master-driver-v17-exploit","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftijme%2Famd-ryzen-master-driver-v17-exploit","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftijme%2Famd-ryzen-master-driver-v17-exploit/lists"}