LOLDrivers – Living Off the Land Drivers

This is a webpage collecting a list of (signed?) drivers that may be loaded into the Windows kernel and thereby escalate privileges. Because the Windows kernel doesn't support loading drivers that are not signed by Microsoft, attackers have to resort to exploiting legitimate signed drivers to gain access to the kernel once they've obtained Administrator (root) or SYSTEM (root) privileges.

A central list of exploitable drivers serves as a starting point for both attackers and defenders. Attackers can use it for their research if they want to raise their privileges by loading code into the kernel (rootkits), or attack protected processes (PPL and up, think anti-virus and anti-malware processes, DRM). For defenders it serves as a curated list of drivers to look out for in their environment. For example, to raise alerts if a Lenovo driver is loaded on a Dell system.

A similar site is the LolBAS site, where signed Windows binaries are listed for their ability to serve as trusted "proxy" executables into which attackers can somehow inject or load their code.

It's so silly that Microsoft set up this elaborate, expensive signature scheme and then doesn't use the scheme to protect its customers.

I'd much prefer known vulnerable drivers to be blacklisted a while after vulnerabilities become known, or to prevent disruption to users, have Microsoft regularly remind users that "Hardware Product by Hardware Company is making your computer unsafe".

Hardware companies and their terrible drivers should either fix their vulnerable software or have their problems exposed to their users.

Either that or the mandatory driver signature verification feature should be disabled. Now they're restricting user freedom without any of the theoretical benefits.

Ah yes, the venerable MHYProt is included in the list. I do love gaming anticheats; they make loading cheats so easy.

what does the name mean (“Living Off the Land”)? i expected some homesteading tools or something — does the phrase have some history in the security world?

Nice! LolBAS and gtfobins are great projects. I’ve used both extensively. I can’t wait until Monday to start running this against my environment. Down the rabbit hole I go at 4pm on a Friday! Appreciate the hard work.

If the designer of the page is here, I'd like to recommend using different colors for your pie chart and bar graph. Using the same color implies they are related, especially when there is only one key.

Also, the orange box that says top publishers on top of the bar graph is confusing, and unnecessary. It is a toggle to turn things off, but it just turns off all the data on the chart. And, I have no idea what the color orange and Top Publishers have to do with each other.

This is on Firefox. Not sure if it's different on Chrome.

i'm not really a security guy but... is ibm poland ok? that's one hell of an outlier

This was very much not what I thought it was going to be.

Don’t get me wrong the page is interesting, but I was much more curious about how this subculture of truckers, etc were harvesting food and what not as they drove across the US :D