SeLoadDriverPrivilege

Ctrl+F: SeLoadDriverPrivilege · driver · BYOVD · kernel

Why: Load kernel-mode drivers — if you can load a vulnerable signed driver, exploit it for ring-0 code execution → SYSTEM.

OSCP: ⭐⭐⭐☆☆ — uncommon on exam boxes; more CTF / hardened enterprise. Know the priv name when WinPEAS flags it.

whoami /priv
REM SeLoadDriverPrivilege    Enabled

→ Windows Privileges - OSCP Priority Hub

---

📌 Attack pattern (BYOVD)

Bring Your Own Vulnerable Driver:

1. Find privilege enabled
2. Upload vulnerable signed driver + exploit loader
3. Load driver → kernel exploit → SYSTEM shell

Public examples (research only — match target OS):

• Capcom.sys-style abuses
• RTCore64.sys, gdrv.sys (varies by patch level)

REM Generic pattern — tool-specific
sc create vulndrv type= kernel binPath= C:\Temp\vuln.sys
sc start vulndrv
REM run companion exploit .exe

---

📌 Enum

whoami /priv
whoami /all | findstr LoadDriver

WinPEAS flags SeLoadDriverPrivilege under interesting privileges.

→ Privesc Tools

---

📌 If driver priv absent

Try higher-yield paths first:

• SeImpersonatePrivilege → Potato
• SeBackupPrivilege → hash dump
• Services / DLL Hijacking

---

📌 Alias check (Linux/bash)

alias
alias | grep -iE 'sudo|root|pass|su |chmod'

→ Linux > 📌 1) Basic Manual Enumeration

---

Related Notes

• Windows PrivEsc
• winExploitSuggester
• Privilege Escalation