Finding Vulnerable Drivers on Windows Systems - A Practical Guide

Introduction

Drivers are the thin line between user-mode applications and the Windows kernel. Because they execute in kernel mode, a flaw in a driver can grant an attacker full system compromise with minimal noise. This study guide walks you through the process of discovering vulnerable drivers on a target Windows host, from basic enumeration to automated cross-referencing against public vulnerability databases.

Real-world incidents-such as the CVE-2021-34527 (PrintNightmare) and the infamous ZDI-22-1102 (Windows Kernel Driver Elevation)-demonstrate how driver weaknesses become the launchpad for ransomware, espionage, and nation-state attacks.

Prerequisites

• A solid understanding of the Windows Kernel Architecture Overview.
• Familiarity with Windows kernel driver concepts and their attack surface.
• Administrator or SYSTEM level access on the target host (required for most enumeration tools).
• Basic PowerShell, Python, and command-line proficiency.

Core Concepts

Before diving into enumeration, it helps to internalize a few fundamentals:

1. Driver Types: Kernel-mode drivers (e.g., .sys files) versus user-mode drivers (UMDF). Vulnerability hunting typically focuses on kernel-mode drivers because they have unrestricted access to memory and hardware.
2. Signing Status: Since Windows 10 (v1607) Microsoft enforces driver signing. Unsigned drivers are rare but remain an attractive attack vector, especially on legacy or mis-configured systems.
3. Version & Vendor: Drivers are versioned and signed by a vendor's certificate. Older versions often contain known CVEs that attackers can leverage.
4. Driver Hashes: The SHA-1/SHA-256 hash of a driver binary uniquely identifies its exact build. Hashes are the primary key for cross-referencing with vulnerability feeds.

Think of the driver landscape as a map: enumeration gives you the street names, metadata tells you the building numbers, and hash lookup reveals whether a particular address has a known security flaw.

Enumerating loaded drivers with built-in tools (driverquery, Get-WindowsDriver, PowerShell Get-ItemProperty)

Windows ships with several native commands that can list drivers currently loaded in memory or installed on disk.

driverquery

driverquery /v /fo csv > drivers.csv

The /v flag adds version, date, and signed status columns; /fo csv makes parsing easier. Example excerpt:

"Image Name","Module Name","Display Name","Driver Type","Link Date","Version","Manufacturer","Signed"
"ntoskrnl.exe","ntoskrnl.exe","Windows NT Operating System","Kernel","2023-03-14","10.0.22621.755","Microsoft","Yes"
"C:\Windows\System32\drivers\acpi.sys","acpi.sys","Microsoft ACPI Driver","Kernel","2022-12-08","10.0.22621.755","Microsoft","Yes"

Get-WindowsDriver (DISM)

DISM can enumerate drivers that are installed (not necessarily loaded):

dism /online /get-drivers /format:table

To capture the output for later processing:

dism /online /get-drivers /format:table | Out-File C:\Temp\installed_drivers.txt

PowerShell Get-ItemProperty

Driver objects are exposed under the registry key HKLM:\SYSTEM\CurrentControlSet\Services. You can pull detailed properties with a one-liner:

Get-ChildItem HKLM:\SYSTEM\CurrentControlSet\Services | Where-Object { $_.GetValue('Type') -band 0x1 } | ForEach-Object { $path = $_.GetValue('ImagePath') $full = (Resolve-Path $path).Path $sig = (Get-AuthenticodeSignature $full).SignerCertificate.Subject [pscustomobject]@{ Name = $_.PSChildName Path = $full Version = (Get-Item $full).VersionInfo.FileVersion Signed = $sig } } | Format-Table -AutoSize

This approach gives you driver file location, version, and signing subject in a single table-perfect for feeding into a later hash-lookup step.

Using Sysinternals Autoruns and Process Explorer for driver discovery

Microsoft Sysinternals provides two GUI tools that make driver hunting visual and fast.

Autoruns

• Run Autoruns.exe with admin rights.
• Navigate to the Drivers tab. You will see every driver that loads at boot, along with the full path, description, and publisher.
• Right-click → Save to export a CSV for offline analysis.

Autoruns also highlights unsigned entries in red, offering an immediate view of potentially exploitable drivers.

Process Explorer

• Launch procexp.exe as SYSTEM (use psexec -i -s procexp.exe).
• Open View → Lower Pane View → DLLs while selecting the System process. The lower pane lists all loaded kernel modules (drivers).
• Columns can be added for Version, Company Name, and Signed. Right-click → Properties gives you the digital signature details.

Both tools complement built-in enumeration: Autoruns shows drivers that are configured to load, while Process Explorer reveals those actually resident in memory.

Extracting driver metadata (version, signing status, vendor) via sigcheck and dumpbin

For bulk metadata extraction, command-line utilities are more script-friendly than GUI tools.

Sigcheck (Sysinternals)

sigcheck -q -nobanner -a C:\Windows\System32\drivers\*.sys > sigcheck_output.txt

Key columns:

• File Name
• Version
• Signed (Yes/No)
• Signing Date
• Publisher

Dumpbin (Visual Studio)

Dumpbin can pull the export table, which sometimes reveals the driver’s internal name (e.g., DriverEntry), useful for fingerprinting.

dumpbin /headers C:\Windows\System32\drivers\acpi.sys | findstr /i "machine"

Combine both tools in a PowerShell loop to generate a master CSV:

$drivers = Get-ChildItem 'C:\Windows\System32\drivers\*.sys'
$results = foreach ($d in $drivers) { $sig = sigcheck -q -nobanner -a $d.FullName | Select-Object -First 1 $ver = (Get-Item $d.FullName).VersionInfo.FileVersion [pscustomobject]@{ Path = $d.FullName Version = $ver Signed = $sig.Split(' ')[-1] Publisher = ($sig -match 'Publisher:\s+(.*)') ? $Matches[1] : 'Unknown' SHA256 = (Get-FileHash $d.FullName -Algorithm SHA256).Hash }
}
$results | Export-Csv C:\Temp\driver_metadata.csv -NoTypeInformation

The resulting CSV contains everything you need for the next phase: hash correlation.

Cross-referencing driver hashes with public vulnerability databases (CVE, Exploit-DB, GitHub)

Hashes are the universal identifier for a binary. By comparing the SHA-256 of each driver against known vulnerable hashes, you can quickly flag risky components.

Using the NVD (National Vulnerability Database) API

Microsoft publishes CVE metadata, but not raw hashes. However, community projects like VulnDB and Metasploit maintain hash-to-CVE mappings.

import requests, csv, hashlib, json, pathlib

def get_nvd_cve(cve_id): url = f" r = requests.get(url) return r.json()

# Load pre-compiled hash-CVE CSV (example: driver_hashes.csv)
hash_map = {}
with open('driver_hashes.csv', newline='') as f: for row in csv.DictReader(f): hash_map[row['SHA256'].lower()] = row['CVE']

# Scan local drivers
for sys in pathlib.Path('C:/Windows/System32/drivers').glob('*.sys'): h = hashlib.sha256(sys.read_bytes()).hexdigest() if h in hash_map: print(f"[!] {sys.name} matches CVE {hash_map[h]}") # optional: fetch detailed description cve = get_nvd_cve(hash_map[h]) print(cve['result']['CVE_Items'][0]['cve']['description']['description_data'][0]['value']) else: print(f"[+] {sys.name} - no known vulnerability")

This script demonstrates a three-step workflow:

1. Compute the SHA-256 of each driver.
2. Lookup the hash in a community-maintained CSV that maps hashes to CVE IDs.
3. Pull CVE details from NVD for reporting.

Exploit-DB & GitHub Search

Exploit-DB offers a searchable index of PoC exploits. Use the searchsploit CLI to locate driver-related exploits:

searchsploit -w "Windows driver" | grep -i "CVE"

GitHub’s advanced code search can be leveraged to find public PoCs that reference a specific driver filename or hash. Example query:

gh api -H "Accept: application/vnd.github.v3+json" "/search/code?q=acpi.sys+extension:cpp+repo:exploitdb/exploits"

Automated scanning scripts (Python/PowerShell) to locate known vulnerable drivers on a host

Below is a production-ready PowerShell module you can drop into your internal red-team toolkit.

# Module: Find-VulnerableDriver.psm1
function Get-DriverHash { param([string]$Path) $bytes = [System.IO.File]::ReadAllBytes($Path) $sha256 = [System.Security.Cryptography.SHA256]::Create() $hash = $sha256.ComputeHash($bytes) return ($hash | ForEach-Object { $_.ToString('x2') }) -join ''
}

function Find-VulnerableDrivers { param( [string]$DriverFolder = 'C:\Windows\System32\drivers', [string]$HashCsv = 'C:\Temp\driver_hashes.csv' ) $hashMap = @{} Import-Csv $HashCsv | ForEach-Object { $hashMap[$_.SHA256.ToLower()] = $_.CVE } Get-ChildItem $DriverFolder -Filter *.sys | ForEach-Object { $hash = Get-DriverHash -Path $_.FullName if ($hashMap.ContainsKey($hash)) { [pscustomobject]@{ Driver = $_.Name Path = $_.FullName SHA256 = $hash CVE = $hashMap[$hash] Signed = (Get-AuthenticodeSignature $_.FullName).Status } } }
}

Export-ModuleMember -Function Find-VulnerableDrivers

Usage:

Import-Module .\Find-VulnerableDriver.psm1
Find-VulnerableDrivers -HashCsv .\known_driver_hashes.csv | Format-Table -AutoSize

The module can be scheduled with Task Scheduler or integrated into a larger post-exploitation framework.

Identifying unsigned or outdated drivers that are prime candidates for exploitation

Even without a known CVE, unsigned or stale drivers are high-value targets.

Unsigned Driver Detection

Get-ChildItem C:\Windows\System32\drivers\*.sys | Where-Object { (Get-AuthenticodeSignature $_.FullName).Status -ne 'Valid' } | Select-Object FullName, @{N='SignatureStatus';E={(Get-AuthenticodeSignature $_.FullName).Status}}

System administrators often overlook unsigned drivers because they are required for legacy hardware. Attackers can replace a benign unsigned driver with a malicious one and avoid signature checks.

Outdated Driver Identification

Cross-reference driver version numbers against the vendor's latest release. Many vendors expose a JSON feed; for example, Intel publishes driver metadata at A quick PowerShell snippet:

$intelFeed = Invoke-RestMethod '
$installed = Get-Item 'C:\Windows\System32\drivers\*intel*.sys' | Select-Object Name, Version
foreach ($drv in $installed) { $latest = $intelFeed | Where-Object { $_.FileName -like "*$($drv.Name)*" } | Sort-Object ReleaseDate -Descending | Select-Object -First 1 if ($latest.Version -ne $drv.Version) { Write-Host "[!] $($drv.Name) is outdated. Installed: $($drv.Version) Latest: $($latest.Version)" }
}