CVE-2021-21551

PoC for CVE-2021-21551 Windows LPE using the Dell dbutil23.sys driver. Exploit approach Implement read/write, allocate shellcode, flip page to bypass smep, overwrite haldispatch ptr, execute shellcode...

CVE-2025-67246

CVE-2025-67246 Vulnerability Title :LuDaShi Incorrect Access Control Affected versions :Less than 6.1026.4505.112 Discovery time :December 2, 2025 Discoverer :ZhouRui Analysis Report : LuDaShi is a well-known free system utility software that provides free hardware authentication, computer mobile...

RToolZ

RToolZ A Stealthy Lsass Dumper - can abuse ProcExp152.sys driver to dump PPL Lsass. What Is So Special About It? No calls to MiniDump or any dbghelp.lib methods, all of the dumping process is done MANUALLY by the dumper while reducing the dump size to minimal by removing unessacery DLLs. Methods ...

Terminator

Terminator Reproducing Spyboy technique, which involves terminating all EDR/XDR/AVs processes by abusing the zam64.sys driver Spyboy was selling the Terminator software at a price of $3,000 for more detail the sample is sourced from loldrivers usage the compiled version can be found HERE Place th...

CVE-2021-44852

CVE-2021-44852 在 Biostar RACING GT Evo 2.1.1905.1700 的 BSRCIO64.sys 中发现了一个问题。低完整性进程可以打开该驱动程序的设备对象并发出 IOCTL，以读取或写入任意物理内存位置（或调用任意地址），从而导致任意代码执行。这与 0x226040、0x226044 和 0x226000 相关。 我记得曾对这个特定漏洞进行过研究，认为它不可能被利用。好吧，如果我当时分析的是正确的 IO 控制码函数，那个分析确实成立。不用说，我错得不能再离谱了。 到明天下午，这将变成一个可正常工作的漏洞利用程序。...

CVE-2026-51585

realtek poc rt26cx21x64.sys exploit Realtek PCIe GbE/2.5GbE/5GbE family Overview OID 0xFF816871 maps the nic's mmio bar into the calling proc's virtual addr space, MmLockedPagesSpecifyCache, reachable from um via \.\RealTekCardGUID This IOCTL 0x0012C818 is gated by a registry value DrvMode=4 Once...

forti-research

Fortinet fortimon374.sys - PPL Bypass via Unauthenticated Kill Command Overview A vulnerability in Fortinet's fortimon374.sys kernel driver FortiClient's "anti-exploit" minifilter allows any local administrator to terminate any process - including PPL Protected Process Light protected processes...

CVE-2021-32537

CVE-2021-32537: Out-of-bounds access in RTKVHD64 leading to pool corruption. This is a bug that I reported to Realtek beginning of April 2021. The affected driver is named RTKVHD64.sys and seems to be available on a bunch of mainstream hardware tested the below hardware configurations but probabl...

CVE-2021-21551

CVE-2021-21551 Simple PoC for exploiting CVE-2021-21551 for LPE by spawning system cmd. https://vulners.com/cve/CVE-2021-21551 An issue was discovered in signed dell windows driver dbutil23.sys which may lead to compromisation of whole local system. Driver's ioctl dispatch routine lacks of...

CVE-2024-51324

CVE-2024-51324 — BYOVD: BdApiUtil64.sys · Master's Thesis Research -orange Bring Your Own Vulnerable Driver BYOVD — Baidu AntivirusBdApiUtil64.sys Three undocumented kernel primitives: process termination, arbitrary file deletion, and in-use file deletion with SectionObjectPointer bypass Affected...

evil-mhyprot-cli

evil-mhyprot-cli 针对 Mhyprot2.sys 易受攻击驱动程序的 PoC，允许非特权用户进程在内核/用户态中读写内存。 libmhyprot Wiki 概述 通过此 CLI，我们可以执行以下操作： 从用户态以内核权限读写任意内核内存 从用户态以内核权限读写任意用户内存 按指定进程 ID 枚举多个模块 获取系统运行时间 枚举指定进程中的线程，结果允许我们直接从 CLI 读取内核中的 PETHREAD 结构。 通过易受攻击驱动程序上下文（ring-0）中调用的 ZwTerminateProcess 按进程 ID 终止指定进程。 所有操作均以内核级权限（ring-0）通过易...

CVE-2025-24990_POC

Windows Agere Modem Driver ltmdm64.sys. This driver is very old and is not loaded by default on my test machine, so I will exploit it in a BYOVD scenario. Interestingly, according to my research this driver has existed on Windows 7 and has at least one bug. here At that time, MSRC didn't take any...

CentOS 9 : kernel-5.14.0-742.el9

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-742.el9 build changelog. - In the Linux kernel, the following vulnerability has been resolved: xen/privcmd: fix double free via VMA splitting privcmdvmops defines...

CVE-2026-80116

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privilege escalation vulnerability in DirectIo64.sys that allows local users to modify hardware configuration by exploiting exposed IOCTLs with no validation on...

CVE-2026-80118

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an unauthenticated physical memory disclosure in DirectIo64.sys, reachable by unprivileged local users through a single IOCTL with no caller-identity check. The handl...

CVE-2026-80114

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a hard-coded credentials vulnerability in DirectIo64.sys that allows local attackers to perform arbitrary physical memory writes by extracting an 8-byte key embedded ...

CVE-2026-80117

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privilege escalation vulnerability in DirectIo64.sys that allows local users to issue arbitrary IN and OUT instructions to any x86 I/O port due to missing allowlist...

CVE-2026-80119

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an information disclosure vulnerability in DirectIo64.sys that allows unauthenticated local attackers to dump complete physical memory contents by supplying a...

CVE-2026-80115

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privilege escalation and denial-of-service vulnerability in DirectIo64.sys that allows local attackers to read arbitrary Model-Specific Registers or write zero to a...

CVE-2026-80112

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an improper access control vulnerability in the DirectIo64.sys kernel driver that allows unprivileged local users to perform privileged hardware operations by opening...