425 matches found
Terminator_Killer
Terminator - レッドチーム向けプロセスキラー 脆弱なドライバ（CVE-2026-0828）を利用して、ユーザーモードから保護されたプロセスを強制終了するカーネルモードのプロセス終了ツール。 コンパイル Windows で MinGW-w64（GCC）が必要です。以下のコマンドでコンパイルします： g++ --% .\terminator.cpp -o terminator.exe -Oz -ffunction-sections -fdata-sections -static -static-libgcc -static-libstdc++ -Wl,--gc-sections ...
CVE-2014-0816
CVE-2014-0816 이것은 CVE-2014-0816 JVNDB-2014-000026: Norman Security Suite에서 권한 상승 취약점에 대한 익스플로잇입니다. 이 익스플로잇은 ngs.sys / ngs64.sys의 IOCTL 핸들러 취약점을 이용하여 비관리자 권한에서 SYSTEM 권한으로 CMD.exe를 실행합니다. 사용법 C:\Users\user\Desktop exploitngs.exe Exploit Norman General Security Driver ngs.sys / ngs64.sys Target fil...
cve-2025-7771
CVE-2025-7771 — ThrottleStop.sys LPE CVE-2025-7771 の概念実証。ThrottleStop.sys は、アクセス制御なしで任意の物理メモリ読み取り/書き込みを可能にする2つのIOCTLハンドラを公開しています。つまり、任意の管理者プロセスが物理RAM内の任意の場所を読み書きできます。 Windows 10 22H2 および Windows 11 23H2 x64 でテスト済み。 やったこと まずドライババイナリを IDA Pro にロードし、内部の動作を理解しました。IRPMJDEVICECONTROL...
Lenovo-CVE-2025-8061
CVE-2025-8061 は、Lenovo の LnvMSRIO.sys ドライバーにおける権限昇格の脆弱性です。このドライバーは、任意のユーザーモードプロセス（権限のないユーザーを含む）が以下を実行できる IOCTL ハンドラーを公開します。 任意のモデル固有レジスタ（MSR）の読み取り/書き込み 任意の物理メモリの読み取り/書き込み これにより、標準ユーザーが完全なカーネル読み取り/書き込み機能を得ることができ、以下につながります。 KASLR バイパス（IA32LSTAR 経由） 直接的なカーネルコード実行（IA32LSTAR 乗っ取り経由） など:3...
CVE-2026-29923
CVE-2026-29923 - 通过任意物理内存映射实现本地权限提升 pstrip64.sys 内核驱动程序暴露了一个 IOCTL，允许低权限用户将任意范围的物理内存映射到自己的虚拟地址空间中。该原语允许对系统物理 RAM 进行完全读写访问，使攻击者能够修改关键的内核结构并将权限提升至 NT AUTHORITY\SYSTEM。 该驱动程序创建了设备对象 \Device\PSTRIP64 和符号链接 \DosDevices\PSTRIP64，可供用户访问。 该漏洞存在于 DispatchDeviceControl 例程中，具体是 IOCTL 0x80002008 的处理程序。函数...
CVE-2026-36980-Kernel-BSOD-DoS-PoC
CVE-2026-36980-Kernel-BSOD-DoS-PoC 프로젝트 날짜: 2026년 2월 / pwdrvio.sys 커널 드라이버의 IOCTL 핸들러에서 버퍼 오버플로우 취약점을 발견했습니다. 이 취약점을 통해 권한이 없는 로컬 공격자가 커널 풀 메모리를 손상시켜 즉각적인 시스템 충돌BSOD 및 서비스 거부Denial of Service를 유발할 수 있습니다. 2026-02-09 공급업체에 통보 2026-03-05 공급업체가 인정 2026-03-05 MITRE에 CVE 요청 2026-05-10 90일 조정 공개 기간 이후 ...
CVE-2025-61155
CVE-2025-61155: GameDriverX64.sys의 임의 프로세스 종료 https://github.com/user-attachments/assets/baf76601-94de-49a6-b4fd-e72f63112fab 개요 이 저장소에는 CVE-2025-61155에 대한 보안 권고와 PoC가 포함되어 있습니다. GameDriverX64.sys 안티치트 드라이버는 취약한 IOCTL 핸들러를 통해 모든 로컬 사용자가 임의의 프로세스를 종료할 수 있게 합니다. 개념 증명 PoC 소스 코드는 지정된 프로세스를 종료하기 위해...
CVE-2026-94425
A vulnerability was found in Moore Threads MTT S80 Driver Package 340.150. The affected element is the function sub140006F0C in the library mtdispkm64.sys of the component IOCTL Handler. The manipulation results in improper privilege management. Attacking locally is a requirement. The vendor was...
CVE-2026-94425 Moore Threads MTT S80 Driver Package IOCTL mtdispkm64.sys sub_140006F0C privileges management
A vulnerability was found in Moore Threads MTT S80 Driver Package 340.150. The affected element is the function sub140006F0C in the library mtdispkm64.sys of the component IOCTL Handler. The manipulation results in improper privilege management. Attacking locally is a requirement. The vendor was...
CVE-2026-94425 Moore Threads MTT S80 Driver Package IOCTL mtdispkm64.sys sub_140006F0C privileges management
A vulnerability was found in Moore Threads MTT S80 Driver Package 340.150. The affected element is the function sub140006F0C in the library mtdispkm64.sys of the component IOCTL Handler. The manipulation results in improper privilege management. Attacking locally is a requirement. The vendor was...
CVE-2026-94424
A vulnerability has been found in Moore Threads MTT S80 Driver Package up to 340.150. Impacted is the function sub140001000 in the library mtdispkm64.sys of the component IOCTL Handler. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The vendor was...
CVE-2026-94424
CVE-2026-94424 affects the Moore Threads MTT S80 Driver Package up to version 340.150 . The vulnerable component is the function sub_140001000 in the kernel-mode library mtdispkm64.sys , specifically within the IOCTL Handler , where a heap-based buffer overflow can be triggered through manipulati...
CVE-2026-94424 Moore Threads MTT S80 Driver Package IOCTL mtdispkm64.sys sub_140001000 heap-based overflow
A vulnerability has been found in Moore Threads MTT S80 Driver Package up to 340.150. Impacted is the function sub140001000 in the library mtdispkm64.sys of the component IOCTL Handler. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. The vendor was...
CVE-2026-94403
A weakness has been identified in ColorFul iGameCenter 1.0.3.4. This impacts the function sub140001AF0 in the library ene.sys of the component IOCTL Handler. This manipulation causes untrusted pointer dereference. The attack can only be executed locally. The exploit has been made available to the...
CVE-2026-94403
ColorFul iGameCenter 1.0.3.4 contains an untrusted pointer dereference in the function sub_140001AF0 within the ene.sys driver's IOCTL Handler component. The vulnerability is exploitable locally with low complexity and low privileges, no user interaction required, and scope is changed, resulting ...
CVE-2026-94403 ColorFul iGameCenter IOCTL ene.sys sub_140001AF0 untrusted pointer dereference
A weakness has been identified in ColorFul iGameCenter 1.0.3.4. This impacts the function sub140001AF0 in the library ene.sys of the component IOCTL Handler. This manipulation causes untrusted pointer dereference. The attack can only be executed locally. The exploit has been made available to the...
CVE-2026-94403 ColorFul iGameCenter IOCTL ene.sys sub_140001AF0 untrusted pointer dereference
A weakness has been identified in ColorFul iGameCenter 1.0.3.4. This impacts the function sub140001AF0 in the library ene.sys of the component IOCTL Handler. This manipulation causes untrusted pointer dereference. The attack can only be executed locally. The exploit has been made available to the...
CVE-2026-94146
A vulnerability was found in BioStar BIOS Update Utility 1.9.7.3. This issue affects the function sub110BC of the file BSMEM64W10.sys of the component IOCTL Handler. The manipulation of the argument PhysicalAddress/Size results in write-what-where condition. Attacking locally is a requirement. Th...
EUVD-2026-83847
A vulnerability was found in BioStar BIOS Update Utility 1.9.7.3. This issue affects the function sub110BC of the file BSMEM64W10.sys of the component IOCTL Handler. The manipulation of the argument PhysicalAddress/Size results in write-what-where condition. Attacking locally is a requirement. Th...
CVE-2026-94146 BioStar BIOS Update Utility IOCTL BSMEM64_W10.sys sub_110BC write-what-where
A vulnerability was found in BioStar BIOS Update Utility 1.9.7.3. This issue affects the function sub110BC of the file BSMEM64W10.sys of the component IOCTL Handler. The manipulation of the argument PhysicalAddress/Size results in write-what-where condition. Attacking locally is a requirement. Th...