Heurs
Source-scoped identity with 6 associated PoCs and 2 linked vulnerabilities.
Exploit catalog results
Showing 6 PoCs on this page
ExploitDBGMER 1.0.15.15641 - MFT Overwrite
ExploitDB exploitPublished 2011-09-26Not analyzedUnlinked1 file
ExploitDBPanda Global Protection 2010 - Local Denial of Service (unfiltered wcscpy())
ExploitDB exploitPublished 2011-01-21Not analyzedUnlinked1 file
ExploitDBLook n stop - Local Denial of Service
ExploitDB exploitPublished 2011-01-21Not analyzedCVE-2011-06521 file
ExploitDBPanda Global Protection 2010 - Local Denial of Service
ExploitDB exploitPublished 2011-01-21Not analyzedUnlinked1 file
ExploitDBKaspersky AV 2010 9.0.0.463 - Local Denial of Service
ExploitDB exploitPublished 2009-09-29ExploitCVE-2009-41141 file
Analysis
Technical assessment
The artifact is a C program that triggers a denial-of-service vulnerability in Kaspersky Anti-Virus 2010 by sending a crafted IOCTL request to the kimul25 device driver, causing a system crash (BSOD).
Backdoor review
No backdoor observed in reviewed code
The provided C source code is a straightforward local denial-of-service proof-of-concept for CVE-2009-4114. It opens the Kaspersky device driver 'kimul25' and sends a crafted IOCTL to trigger a system crash. No backdoor, unauthorized access, data exfiltration, or other hidden malicious functionality is present.
Classification basis and observed behavior
Classification basis
The code actively sends a malicious IOCTL request to a vulnerable driver to cause a system crash, which is the definition of an exploit. It does not merely scan or detect the vulnerability.
exploits/windows/dos/10164.c:26-28exploits/windows/dos/10164.c:57-59Requirements
- Kaspersky Anti-Virus 2010 9.0.0.463 must be installed with the vulnerable kl1.sys driver loaded.
exploits/windows/dos/10164.c:8 - The attacker must have local access to the system to execute the program.
exploits/windows/dos/10164.c:1-65
Observed behavior
- Opens a handle to the device \\.\kimul25 with read/write access.
exploits/windows/dos/10164.c:57 - Sends a crafted IOCTL request (0x0022c008) with a specific DWORD array to the device, triggering a system crash (BSOD).
exploits/windows/dos/10164.c:59
Behaviors behind the backdoor verdict
Observables
- File Operation
- Payload withheldOpens a handle to the vulnerable Kaspersky device driver to send the exploit payload.
exploits/windows/dos/10164.c:57 - Ioctl Call
- Payload withheldSends the crafted DWORD array to the vulnerable IOCTL code 0x0022c008 to trigger the denial-of-service condition.
exploits/windows/dos/10164.c:59 - Payload Data
- Payload withheldThe array of DWORDs passed to the vulnerable IOCTL. These are crafted to cause a crash (BSOD) in the driver, not to perform any backdoor or unauthorized action.
exploits/windows/dos/10164.c:48-53
What the analysis did not establish
- The analysis is based solely on the provided source code; no external dependencies or runtime behavior were examined.
- The code is a local denial-of-service exploit and does not achieve code execution or privilege escalation.
- Only the supplied source code was reviewed; no binary analysis was performed.
- The payload array is opaque but is consistent with the described crash trigger and shows no evidence of backdoor functionality.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.