8damon/pwning-openedr

This repository documents a set of security vulnerabilities the author found while examining OpenEDR, a piece of endpoint detection and response software that monitors a Windows computer for suspicious activity. It is a security research write-up rather than a general purpose tool, aimed at people who work in vulnerability research, penetration testing, or product security. The README lists five confirmed findings, each with a codename, an official advisory identifier, a severity score, and a plain description of what a standard, non-administrator Windows user was able to do. The impacts described include stopping the security monitoring service and clearing its queued data, tricking the genuine service into loading an unsigned file with full system privileges, causing a bounded memory usage increase, getting a system level command to run and launching a real signed kernel driver, and resetting an internal signal that controls telemetry collection. Screenshots and a full evidence folder are provided for two of the findings, including logs, hashes, and captured output. To reproduce the findings yourself, the project expects an isolated Windows virtual machine with Visual Studio's C++ build tools installed. A build script compiles all the proof of concept code, and each finding has its own reproduce script meant to be run as a standard user. One finding involves a multi-step process that requires a reboot partway through. The denial of service test is deliberately capped in size and the README warns not to run any of this against a production machine. The exact version of OpenEDR tested is pinned as a Git submodule, along with its installer hash and matching source commit, so results can be reproduced precisely. The author also ran a large batch of malformed driver calls under a Windows kernel testing tool and reports that this pass did not turn up a crash or memory corruption, while noting that this negative result does not prove the driver has no other memory safety issues.