## https://sploitus.com/exploit?id=D3ECB8E7-9DC6-5041-9BFB-B7C2A629292D
# phymem-exploit
Proof-of-concept exploit for Supermicro's phymem.sys driver (signed by "Super Micro Computer, Inc."), demonstrating arbitrary physical memory read/write through exposed IOCTL handlers.
This driver was identified using [driver-scout](https://github.com/mynamedali/driver-scout) as a previously unreported vulnerable driver not present in [LOLDrivers.io](https://loldrivers.io) or the Microsoft recommended driver block list.
## Vulnerability
phymem.sys creates a device `\\.\PhyMem` accessible to any local user and exposes two IOCTLs:
| IOCTL | Code | Purpose |
|---|---|---|
| `IOCTL_PHYMEM_MAP` | `0x80002000` | Maps an arbitrary physical address range into the caller's virtual address space |
| `IOCTL_PHYMEM_UNMAP` | `0x80002004` | Unmaps a previously mapped physical region |
No access control checks are performed on the device object, meaning any unprivileged process that can open a handle to `\\.\PhyMem` gets full read/write access to all physical memory.
## Impact
With arbitrary physical memory access, an attacker can:
- Read the Directory Table Base (CR3) of any process by walking EPROCESS structures
- Translate virtual addresses to physical using 4-level page table traversal
- Read or write any process's virtual memory without calling any monitored API
- Bypass all usermode protections (PPL, anti-cheat, AV self-defense)
## Structure
```
phymem-exploit/
victim/victim.c - target process that stores a secret value
exploit/exploit.c - reads victim's CR3, base address, and memory
driver/phymem.sys - the vulnerable Supermicro driver
build.bat - MSVC build script
run.bat - launcher
```
## Building
Requires Visual Studio 2022+ with the C/C++ desktop workload.
```
build.bat
```
## Usage
Run `run.bat` as Administrator, or manually:
```
:: terminal 1
victim.exe
:: terminal 2 (admin)
exploit.exe driver\phymem.sys
```
The exploit will:
1. Load phymem.sys via `sc create` / `sc start`
2. Find the system CR3 from the processor low stub
3. Walk the EPROCESS linked list to locate the victim by PID
4. Read the victim's CR3, image base, and PEB
5. Prompt for a virtual address to read from the victim's address space
6. Clean up (stop + delete the driver service)
## Tested On
- Windows 11 25H2 (Build 26200)
- phymem.sys SHA256: `600363c21db3dee93f3dddfaccb536739f8bf4484877a934a5c564bd024a7b8a`
## Driver Signature
The driver carries a valid Authenticode signature from Symantec/DigiCert, timestamped before certificate expiry. Windows loads it without test signing mode.
```
Signer: Super Micro Computer, Inc.
Issuer: Symantec Class 3 SHA256 Code Signing CA
Valid: 2018-12-16 to 2022-01-05
Timestamp: Symantec Time Stamping Services (countersigned)
Status: Valid
```
## EPROCESS Offsets (Windows 11 25H2 Build 26200)
| Field | Offset |
|---|---|
| DirectoryTableBase | 0x028 |
| UniqueProcessId | 0x1D0 |
| ActiveProcessLinks | 0x1D8 |
| SectionBaseAddress | 0x2B0 |
| Peb | 0x2E0 |
| ImageFileName | 0x338 |