mirror of
https://github.com/CyberSecurityUP/Offensive-AI-Agent-Prompts.git
synced 2026-08-20 09:07:14 +02:00
36 lines
1.3 KiB
Markdown
36 lines
1.3 KiB
Markdown
// Install https://github.com/mrexodia/ida-pro-mcp
|
|
|
|
Your task is to analyze a driver DriverName.sys in IDA Pro. You can use the MCP tools to retrieve information. In general use the following strategy:
|
|
|
|
Analyze the provided driver code focusing on:
|
|
1. Exposed IOCTLs (Input/Output Control) - identify opcodes
|
|
2. Missing or insufficient input validations
|
|
3. Possibilities of buffer overflow (stack or heap)
|
|
4. Arbitrary memory read/write operations
|
|
5. Token/privilege manipulation
|
|
6. Exposed function pointers that can be overwritten
|
|
7. Race conditions
|
|
8. Use of dangerous functions such as memcpy, strcpy without validation
|
|
|
|
Specifically look for:
|
|
- Accessible process/thread handles
|
|
- Operations with EPROCESS/ETHREAD structures
|
|
- Access to arbitrary PID/TID
|
|
- Ability to read/write kernel memory
|
|
- Registered callback functions that can be manipulated
|
|
- Control of function pointers through exposed structures
|
|
|
|
Create a PoC that exploits the vulnerabilities found for:
|
|
a) Privilege escalation (SYSTEM/NT) AUTHORITY)
|
|
b) Denial of Service (system/driver crash)
|
|
c) Arbitrary kernel memory read
|
|
d) Arbitrary kernel memory write
|
|
|
|
Analysis format:
|
|
|
|
1. Identify all IOCTLs and their functionalities
|
|
2. Map data structures and parameters
|
|
3. Identify missing validations
|
|
4. Develop exploit primitives
|
|
5. Build a complete exploit
|