CVE-2025-61155

CVE-2025-61155 — Arbitrary Process Termination in GameDriverX64.sys A signed kernel-mode anti-cheat driver — GameDriverX64.sys, shipped with Tower of Fantasy Hotta Studio / Perfect World — lets any unprivileged local user terminate arbitrary processes , including PPL-protected antivirus/EDR...

MSRKit

MSRKit A tool for calling kernel functions and mapping drivers via a ROP chain through a wrmsr primitive in a vulnerable driver AmdTools64.sys. How it works 1. Loads AmdTools64.sys via NtLoadDriver falls back to PnP devnode + GUID-based device interface if the symlink is unavailable 2. Reads...

bdapiutil-bydov

BdApiUtil64.sys BYOVD C++ demonstration tool for Windows that interacts with the BdApiUtil device via DeviceIoControl and a specific IOCTL to request the termination of a process. Requirements 64-bit Windows 10/11 Visual Studio / MSVC BdApiUtil64.sys driver loaded and accessible Administrative...

WiseDelete

WiseDelfile Driver Wrapper A lightweight Windows utility that loads the WiseDelfile64.sys kernel driver, performs the required device handshake, and issues IOCTL requests to delete files that cannot be removed through standard Windows APIs. This project demonstrates how CVE-2025-66680 , can be us...

CVE-2019-18845

CVE-2019-18845 The MsIo64.sys and MsIo32.sys drivers in Patriot Viper RGB before 1.1 allow local users including low integrity processes to read and write to arbitrary memory locations, and consequently gain NT AUTHORITY\SYSTEM privileges, by mapping \Device\PhysicalMemory into the calling proces...

CVE-2020-0796

CVE-2020-0796 Overview: The compression feature added to SMBv3 starting from Windows 10/Server version 1903 contains an integer overflow vulnerability confirmed by Microsoft on 12/03/2020. It allows an attacker to perform Local Privilege Escalation LPE and Remote Code Execution RCE. Here we will...

CVE-2020-1206

In the SMBGhost vulnerability CVE-2020-0796 I talked about a write-what-where primitive technique through the use of an integer overflow bug to change the pointer Alloc.Userbuffer to point to an address we desire and write arbitrary data into it. Similar to SMB Ghost, this vulnerability also exis...

qubes-mirage-firewall

qubes-mirage-firewall A unikernel that can run as a QubesOS ProxyVM, replacing sys-firewall. It uses the mirage-qubes library to implement the Qubes protocols. See A Unikernel Firewall for QubesOS for more details. Binary releases Pre-built binaries are available from the releases page. See the...

CVE-2021-27965

CVE-2021-27965 The MsIo64.sys driver before 1.1.19.1016 in MSI Dragon Center before 2.0.98.0 has a buffer overflow that allows privilege escalation via a crafted 0x80102040, 0x80102044, 0x80102050, or 0x80102054 IOCTL request. This exploit will be finished, this is a guarantee...

CVE-2009-3103---srv2.sys-SMB-Code-Execution-Python-MS09-050-

Microsoft-Windows---srv2.sys-SMB-Code-Execution-Python-MS09-050- Microsoft Windows - 'srv2.sys' SMB Code Execution Python MS09-050 Exploit for CVE-2009-3103 Overview This Python script is an updated version of a public exploit for CVE-2009-3103. The original code relied on the SMB.connection...

CVE-2022-22077

✅ CVE-2022-22077 exploitation framework RTCore64.sys: This document provides a comprehensive overview of the CVE-2022-22077 exploitation framework, a sophisticated BYOVD Bring Your Own Vulnerable Driver attack toolkit that targets the RTCore64.sys driver vulnerability. This framework demonstrates...

NT-AUTHORITY-SYSTEM-CONTEXT-RTCORE

NT-AUTHORITY-SYSTEM-CONTEXT-RTCORE This exploit rebuilds and exploit the CVE-2019-16098 which is in driver Micro-Star MSI Afterburner 4.6.2.15658 aka RTCore64.sys and RTCore32.sys allows any authenticated user to read and write to arbitrary memory, I/O ports, and MSRs. Instead of hardcoded base...

POC-CVE-2024-12227

CVE-2024-12227 - NTIOLibX64.sys DoS PoC Proof of Concept for CVE-2024-12227 - Null Pointer Dereference vulnerability in MSI Dragon Center's NTIOLibX64.sys driver. Description NTIOLibX64.sys version 3.0.0.10 contains a null pointer dereference vulnerability in the ReadPhysicalMemory function IOCTL...

CVE-2026-29923

CVE-2026-29923 - Local Privilege Escalation Attack via pstrip64.sys Disclaimer: This code is provided for educational and defensive research purposes only. It was written to further the understanding of kernel exploitation and help defenders protect against similar vulnerabilities. Any...

CredsHunter

CredsHunter CVE-2026-3609 · Writeup LSASS credential dump proof-of-concept for a PPL-bypassing process-handle leak in Wellbia's XIGNCODE3 anti-cheat driver, xhunter1.sys. The driver exposes an IRPMJWRITE command interface that calls ObOpenObjectByPointer with AccessMode = KernelMode and without...

CVE-2021-21551

PoC for CVE-2021-21551 Windows LPE using the Dell dbutil23.sys driver. Exploit approach Implement read/write, allocate shellcode, flip page to bypass smep, overwrite haldispatch ptr, execute shellcode...

CVE-2026-29923

CVE-2026-29923 - Local Privilege Escalation via Arbitrary Physical Memory Mapping The pstrip64.sys kernel driver exposes an IOCTL that allows low-privileged users to map arbitrary ranges of physical memory into their own virtual address space. This primitive allows full read/write access to the...

CVE-2024-30804

ASUS Driver LPE PoC Physical Memory Abuse This is a PoC for Local Privilege Escalation LPE that exploits the AsInsHelp64.sys driver. It abuses a legitimate, signed ASUS driver to map physical memory and overwrite kernel tokens, eventually gaining NT AUTHORITY\SYSTEM privileges. 🎯 Vulnerability In...

CVE-2021-44852

CVE-2021-44852 An issue was discovered in BSRCIO64.sys in Biostar RACING GT Evo 2.1.1905.1700. A low-integrity process can open the driver's device object and issue IOCTLs to read or write to arbitrary physical memory locations or call an arbitrary address, leading to execution of arbitrary code...

CVE-2026-49868

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, parsereply in sys/net/applicationlayer/dhcpv6/client.c omits minimum-length validation before passing IAPD and IANA option bodies to sub-option parsers. A...