CVE-2023-38817

HIGH

echo anti_cheat_tool Improper Privilege Management

Title source: VulnCheck
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2023-38817 has a selected CVSS score of 7.8 (high); EIP currently links 2 repository PoCs.

Description

An issue in Inspect Element Ltd Echo.ac v.5.2.1.0 allows a local attacker to gain privileges via a crafted command to the echo_driver.sys component. NOTE: the vendor's position is that the reported ability for user-mode applications to execute code as NT AUTHORITY\SYSTEM was "deactivated by Microsoft itself."

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Sep 10, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Repository PoCs
2

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 9, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

anti_cheat_tool

Browse echo / anti_cheat_tool
VulnCheckVersion data not supplied

Proofs of concept

2

Repository PoCs

GitHubSecSecBurger/CVE-2023-38817Repository PoCby SecSecBurger0Exploit2 files

11.3 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A local privilege escalation exploit for CVE-2023-38817 targeting the Echo.ac anti-cheat driver (echo_driver.sys). The code opens the device, uses IOCTLs to obtain an arbitrary kernel read/write primitive, reads the SYSTEM process token, overwrites the current process token with it, and then spawns a SYSTEM-privileged command prompt. It also unlinks the spawned process from the active process list to hide it.

Backdoor review

No backdoor observed in reviewed code

The supplied main.c implements a local privilege escalation (LPE) proof-of-concept for CVE-2023-38817. It interacts with the EchoDrv device via DeviceIoControl to obtain an arbitrary kernel read/write primitive, then overwrites its own process token with the SYSTEM token and spawns cmd.exe. The code also unlinks the spawned cmd.exe from the EPROCESS active process list to hide it. All operations are consistent with a standard Windows kernel exploitation technique (token stealing) and do not exhibit concealed backdoor behavior, credential exfiltration, persistence, or unrelated payload delivery.

ClassificationExploit
Model confidence95%
AuthenticationRequired
LanguagesC
Target softwareEcho.ac anti-cheat driver (echo_driver.sys)
Attack typeslocal privilege escalationtoken theftprocess hiding
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code actively exploits a driver vulnerability to escalate privileges and spawn a SYSTEM shell. It uses IOCTLs to achieve arbitrary kernel read/write, steals the SYSTEM token, and applies it to the current process. This is a full exploit, not a scanner or writeup.

main.c:72-81main.c:190-228main.c:230-243

Requirements

  • Local user-mode code execution on a Windows system with the vulnerable Echo.ac driver loaded.main.c:126-143
  • The vulnerable driver device 'payload withheld' must be accessible.main.c:135-143

Observed behavior

  • Opens a handle to the EchoDrv device.main.c:135-143
  • Sends IOCTL payload withheld to the driver, likely to initialize or enable the exploit primitive.main.c:153-159
  • Sends IOCTL payload withheld to obtain a handle to the current process with GENERIC_ALL access.main.c:163-184
  • Uses IOCTL payload withheld to perform arbitrary kernel memory read and write operations.main.c:72-81
  • Reads the SYSTEM process token from kernel memory.main.c:190-211
  • Overwrites the current process token with the SYSTEM token to achieve privilege escalation.main.c:220-228
  • Spawns a new cmd.exe process, which inherits the elevated SYSTEM token.main.c:230-243
  • Unlinks the spawned cmd.exe process from the kernel's active process list to hide it.main.c:245-286
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Device Handle
Payload withheldTarget device for the CVE-2023-38817 exploit; opened with GENERIC_READ | GENERIC_WRITE.main.c:135-143
Ioctl Code
Payload withheldIOCTL used for arbitrary kernel read/write via mmCopy_params structure.main.c:79
Ioctl Code
Payload withheldFirst IOCTL sent to the driver; purpose not explicitly documented but part of the exploit chain.main.c:154
Ioctl Code
Payload withheldSecond IOCTL used to obtain a process handle with GENERIC_ALL access for the current process.main.c:172
Process Creation
Payload withheldSpawns a SYSTEM-privileged command prompt after token theft; standard LPE demonstration.main.c:232-243
Process Hiding
Payload withheldHides the spawned cmd.exe from process enumeration tools by manipulating the kernel's doubly-linked list of active processes.main.c:245-286
Review boundaries

What the analysis did not establish

  • Only one source file (main.c) is provided; the header 'DriverTypes.h' is referenced but not included in the evidence.
  • The evidence does not include the compiled binary or any runtime output, so the exploit's effectiveness cannot be verified from the provided text alone.
  • Only one text file (main.c) was supplied; the repository contains one additional file (DriverTypes.h) that was not included in the text evidence. Its absence does not indicate concealment, but its content was not reviewed.
  • Binary files were flagged as metadata-only and not analyzed; no binary content was inspected.
  • The review is limited to static analysis of the provided source code; no dynamic execution or behavioral analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHubvxcall/kurRepository PoCby vxcall19Not analyzed16 files

175.5 KiB

GitHub
PoC details

References

2