Ivanti-Pulse_VPN-Client_Exploit-CVE-2023-35080_Privilege-escalation

Ivanti/Pulse VPN Client Exploit of CVE-2023-35080 leading to a privilege escalation Code related to the exploitation of the CVE-2023-35080 which leverages a write primitive in the Ivanti/Pulse VPN client kernel driver in Windows. The write primitive conducts to a privilege escalation. The exploit...

CredsHunter

CredsHunter CVE-2026-3609 · Writeup LSASS credential dump proof-of-concept for a PPL-bypassing process-handle leak in Wellbia's XIGNCODE3 anti-cheat driver, xhunter1.sys. The driver exposes an IRPMJWRITE command interface that calls ObOpenObjectByPointer with AccessMode = KernelMode and without...

Terminator_Killer

Terminator - Red Team Process Killer A collection of kernel-mode process termination tools leveraging vulnerable drivers BYOVD to kill protected processes from user mode. Project Structure File| Description ---|--- terminator.hpp| Shared class interface for process enumeration and termination...

CVE-2025-8045

CVE-2025-8045 — Arm Mali GPU KCPU Queue UAF A local privilege escalation exploit for CVE-2025-8045 , a use-after-free in the Arm Mali GPU kernel driver kbase. A non-privileged local process races the CSF KCPU queue dump path to free and reclaim a cpuqueue.buffer, turns the dangling allocation int...

CVE-2025-7771

CVE-2025-7771 — ThrottleStop.sys Arbitrary Physical Memory R/W Full proof-of-concept for the TechPowerUp ThrottleStop.sys driver CVE-2025-7771. A signed, still-loadable kernel driver exposes unvalidated physical memory read and write through two IOCTLs. This repo turns that primitive into a worki...

CVE-2026-38053---Remove-PPL

CVE-2026-38053---Remove-PPL BYOVD Remove PPL for 24H2 and 25H2 An arbitrary memory write in the handler for IOCTL 0x12C807 METHODNEITHER of Wise System Monitor v1.5.3.127 allows attackers to cause a remove PPL or Denial of Service DoS via a crafted input. Additional Information Tested on: Windows...

CVE-2026-75882

An improper access control vulnerability in ESET Endpoint Encryption and ESET Full Disk Encryption allow attacker with standard user permissions access a device interface belonging to a privileged kernel driver and send specially crafted requests...

Tokenizer

NOTE This project was one of my earliest projects for learning more about Windows drivers. Please see Chaos-Rootkit for the complete version...

CVE-2026-75882

An improper access control vulnerability exists in ESET Endpoint Encryption and ESET Full Disk Encryption for Windows. This flaw allows an attacker with standard user permissions to access a device interface belonging to a privileged kernel driver and submit specially crafted requests. The docume...

EUVD-2026-113905

An improper access control vulnerability in ESET Endpoint Encryption and ESET Full Disk Encryption allow attacker with standard user permissions access a device interface belonging to a privileged kernel driver and send specially crafted requests...

CVE-2026-75882 Improper access control vulnerability in ESET Encryption products for Windows

An improper access control vulnerability in ESET Endpoint Encryption and ESET Full Disk Encryption allow attacker with standard user permissions access a device interface belonging to a privileged kernel driver and send specially crafted requests...

AgentSmith-HIDS

AgentSmith-HIDS --The name of this project was inspired by the movie - The Matrix English | 简体中文 THIS REPO IS OLD RELEASE VERSION: https://github.com/bytedance/Elkeid About AgentSmith-HIDS Technically, AgentSmith-HIDS is not a Host-based Intrusion Detection System HIDS due to lack of rule engine...

kemon

Kemon An Open Source Pre and Post Callback-based Framework for macOS Kernel Monitoring. Breaking News - 08/28/2019 macOS Catalina 10.15 Beta 7 Release Notes https://developer.apple.com/documentation/macosreleasenotes/macoscatalina1015beta7releasenotes Endpoint Security The kauth API has been...

PT-2026-133528

An improper access control vulnerability in ESET Endpoint Encryption and ESET Full Disk Encryption allow attacker with standard user permissions access a device interface belonging to a privileged kernel driver and send specially crafted requests...

Microsoft Windows TCPIP.SYS IppQualifyAddresses Out-of-Bounds Read Vulnerability

Summary An out-of-bounds read vulnerability exists in the IppQualifyAddresses function of the Microsoft Windows tcpip.sys driver. A specially crafted I/O request packet IRP can cause an arbitrary out-of-bounds read, potentially leading to information disclosure or a denial-of-service condition...

byovd-exploit-framework

Getting started Install required binaries git clone http...

kernelmode-driver

kernelmode-driver Kernel Driver for x64 Window System which allows you to read/write Virtual/Physical Memory hooking Win32k Info: I tried to keep the project as clean as possible so I adapted Microsoft Syntax for Kernel Mode functions KE Mostly used "conventional" data types like void instead of...

KProcTerminator

KProcTerminator Overview This repository, 'KProcTerminator', contains a Windows kernel driver designed for terminating specific processes on a system. It is meant to be loaded using kdmapper, a known tool for loading unsigned drivers into the Windows kernel space without a signed driver...

CentOS Linux 8.4 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2023:1690287378)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2023:1690287378 advisory. - A vulnerability was found in the fs/inode.c:inodeinitowner function logic of the LInux kernel that allows local users to create...

CentOS Linux 8.5 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2023:1690294029)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2023:1690294029 advisory. - A vulnerability was found in the fs/inode.c:inodeinitowner function logic of the LInux kernel that allows local users to create...