WinDefenderKiller

WinDefenderKiller PermanentDisablefromRegistry C++ Code for Permanently Disabling Windows Defender via Registry Keys Just compile and execute it! And when i restart it: BYOVDWindowsDefenderKiller This module implements a BYOVD Bring Your Own Vulnerable Driver technique to disable Windows Defender...

BYOVD-DriverKiller

BYOVD-DriverKiller This README EN may contain errors ! ⚠️ Disclaimer : This project is strictly educational and demonstrative. It is not intended for malicious use. The goal is to learn reverse engineering methodology and the exploitation steps of a Windows driver. Here I explain the approach I...

TopazTerminator

TopazTerminator F, Another driver got burned.. I was gatekeeping wsftprm.sys driver for a while ; but since someone posted a public POC, I'm ungatekeeping it. We all know it'll get added to the driver blocklist soon, so here's my implementation for the same — in C This project exploits the...

GhostDriver

GhostDriver 👻 About GhostDriver is a Rust-built AV killer tool using BYOVD. Get Started 1. Install Rust from rust-lang.org 2. Clone: git clone https://github.com/BlackSnufkin/GhostDriver.git 3. Build: cargo build --release --target=x8664-pc-windows-msvc 4. Run: Execute the GhostDriver binary Usag...

Blackout

Blackout leveraging gmer driver to effectively disabling or killing EDRs and AVs. it bypass HVCI fluently the sample is sourced from loldrivers https://www.loldrivers.io/drivers/7ce8fb06-46eb-4f4f-90d5-5518a6561f15/ usage Place the driver Blackout.sys in the same path as the executable The...

Reaper

「💀」 Sobre Reaper Reaper es una prueba de concepto diseñada para explotar la vulnerabilidad del controlador BYOVD Bring Your Own Vulnerable Driver. Esta técnica maliciosa implica insertar un controlador legítimo y vulnerable en un sistema objetivo, lo que permite a los atacantes explotar el...

CVE-2025-1055-poc

CVE-2025-1055-poc PoC for CVE-2025-1055 and CVE-2025-52915 using K7RKScan.sys. This PoC use the 0x222018 IOCTL to terminate arbitrary processes. Usage Installing driver: sc.exe create K7RKScan1516.sys binPath=C:\Users\Administrator\Downloads\K7RKScan1516.sys type=kernel && sc.exe start...

CVE-2026-19193-PoC

CVE-2026-19193 - Proof of Concept Arbitrary Process Termination via Unauthenticated Minifilter Message Handler in Jiangmin Antivirus Kernel Driver kvcore.sys Affected Asset: Product: Jiangmin Antivirus V21 Component: kvcore.sys Core Kernel Driver Version: 1.23.6.27 SHA-256 Hash:...

CVE-2026-83663 Apache Thrift: TFramedTransport and THeaderTransport re-enter Read once per frame that carries no payload (Go)

Uncontrolled Recursion vulnerability in Apache Thrift go bindings. Both Go transports satisfy a read out of a buffered frame and, when that frame yields no payload bytes, read the next frame and call Read again instead of looping. A peer produces such a frame for 4 bytes in TFramedTransport...

CVE-2026-91784

cjbassi/gotop is vulnerable to local argument injection via process termination functionality. The process name is passed directly to pkill without sanitization. A local attacker can create a process with a crafted name beginning with -- e.g. containing a target user's UID. When the user running...

CVE-2026-91784

The cjbassi/gotop utility is vulnerable to local argument injection within its process termination functionality. The software fails to sanitize process names before passing them directly to the pkill command. A local attacker can exploit this by creating a process with a crafted name starting wi...

CVE-2026-91784 Argument Injection leading to arbitrary process termination in gotop

cjbassi/gotop is vulnerable to local argument injection via process termination functionality. The process name is passed directly to pkill without sanitization. A local attacker can create a process with a crafted name beginning with -- e.g. containing a target user's UID. When the user running...

EUVD-2026-91318

cjbassi/gotop is vulnerable to local argument injection via process termination functionality. The process name is passed directly to pkill without sanitization. A local attacker can create a process with a crafted name beginning with -- e.g. containing a target user's UID. When the user running...

CVE-2026-91784 Argument Injection leading to arbitrary process termination in gotop

cjbassi/gotop is vulnerable to local argument injection via process termination functionality. The process name is passed directly to pkill without sanitization. A local attacker can create a process with a crafted name beginning with -- e.g. containing a target user's UID. When the user running...

CVE-2018-6606

CVE-2018-6606 This terminates any PID. Tested on Windows 10 64-bit, Flare VM. Administrator privileges are required. Some adjustments may be needed — see resource.rc. Toolchain Download:...

BadRentdrv2

BadRentdrv2 A vulnerable driver exploited by me BYOVD that is capable of terminating several EDRs and antivirus software in the market, rendering them ineffective, working for both x32 and x64. How does it work? Compile targeting the legacy x32 architecture for a wider attack range. In an elevate...

forti-research

Fortinet fortimon374.sys - PPL Bypass via Unauthenticated Kill Command Overview A vulnerability in Fortinet's fortimon374.sys kernel driver FortiClient's "anti-exploit" minifilter allows any local administrator to terminate any process - including PPL Protected Process Light protected processes...

KillChain

KillChain ?? Disclaimer: This project is intended strictly for educational and security research purposes. The author is not responsible for any misuse, damage, or illegal activity caused by this tool. Use only in isolated lab environments with explicit permission. Overview KillChain is a user-mo...

CVE-2025-60349

CVE-2025-60349: Pxscan Arbitrary Process Termination An issue was discovered in Prevx v3.0.5.220 allowing attackers to cause a denial of service via sending IOCTL code 0x22E044 to the pxscan.sys driver. Any processes listed under registry key...

CVE-2026-3796

CVE-2026-3796 In QAX Virus Removal version dated 2025-10-22 and earlier, the affected driver QKSecureIOImp.sys rely on caller process's image to determine whether they are allowed to communicate to the mini filter driver. Attackers could impersonate a legitimate caller process image through tacti...