CVE-2025-61156

CVE-2025-61156 A vulnerability was discovered in the ThreatFire System Monitor =v4.7.0.53 kernel-mode TfSysMon.sys component that allows unprivileged users to perform arbitrary process termination with kernel-mode privileges. As a result, PPL and protected system processes can be forcefully...

chaosmonkey

Chaos Monkey randomly terminates virtual machine instances and containers that run inside of your production environment. Exposing engineers to failures more frequently incentivizes them to build resilient services. See the documentation for info on how to use Chaos Monkey. Chaos Monkey is an...

CVE-2025-61155

CVE-2025-61155 — Arbitrary Process Termination in GameDriverX64.sys A signed kernel-mode anti-cheat driver — GameDriverX64.sys, shipped with Tower of Fantasy Hotta Studio / Perfect World — lets any unprivileged local user terminate arbitrary processes , including PPL-protected antivirus/EDR...

bdapiutil-bydov

BdApiUtil64.sys BYOVD C++ demonstration tool for Windows that interacts with the BdApiUtil device via DeviceIoControl and a specific IOCTL to request the termination of a process. Requirements 64-bit Windows 10/11 Visual Studio / MSVC BdApiUtil64.sys driver loaded and accessible Administrative...

SharpBlackout

SharpBlackout Terminate AV/EDR leveraging BYOVD attack Note: This project is for educational purposes only. Sharpblackout is an adaptation of the @Blackout project originally developed in C++ by @ZeroMemoryEx, which consists of removing AV/EDRs using the gmer BYOVD driver. Just wanted to try maki...

0xM0nCrush

0xM0nCrush A cross-version Windows process terminator. It loads a signed HONOR kernel driver MonProcessEX.sys, resolves the PID of every target process, and terminates it from kernel context through a single IOCTL. No kernel offsets, no PDB downloads, no build-specific shellcode - the technique...

CVE-2025-23167

CVE-2025-23167 – Node.js HTTP Request Smuggling Exploit Working exploit for CVE-2025-23167, a request smuggling vulnerability affecting Node.js 20.x versions prior to v20.19.2. This bug allows improper HTTP header termination, enabling attackers to bypass proxy-based access controls. Files...

BYOVD-DriverKiller

BYOVD-DriverKiller This README EN may contain errors ! ⚠️ Disclaimer : This project is strictly educational and demonstrative. It is not intended for malicious use. The goal is to learn reverse engineering methodology and the exploitation steps of a Windows driver. Here I explain the approach I...

reproxy

Reproxy is a simple edge HTTPs server / reverse proxy supporting various providers docker, static, file, consul catalog. One or more providers supply information about the requested server, requested URL, destination URL, and health check URL. It is distributed as a single binary or as a docker...

CVE-2026-19193-PoC

CVE-2026-19193 - Proof of Concept Arbitrary Process Termination via Unauthenticated Minifilter Message Handler in Jiangmin Antivirus Kernel Driver kvcore.sys Affected Asset: Product: Jiangmin Antivirus V21 Component: kvcore.sys Core Kernel Driver Version: 1.23.6.27 SHA-256 Hash:...

chaoskube

chaoskube chaoskube periodically kills random pods in your Kubernetes cluster. Why Test how your system behaves under arbitrary pod failures. Example Running it will kill a pod in any namespace every 10 minutes by default. $ chaoskube INFO0000 starting up dryRun=true interval=10m0s version=v0.21....

CVE-2018-6606

CVE-2018-6606 This terminates any PID. Tested on Windows 10 64-bit, Flare VM. Administrator privileges are required. Some adjustments may be needed — see resource.rc. Toolchain Download:...

Reaper

「💀」 About Reaper Reaper is a proof-of-concept designed to exploit BYOVD Bring Your Own Vulnerable Driver driver vulnerability. This malicious technique involves inserting a legitimate, vulnerable driver into a target system, which allows attackers to exploit the driver to perform malicious action...

CVE-2026-36130

PoC Add the folder to lock Before reboot, the Defender process is still running After reboot, the Defender process MsMpEng.exe is gone...

Blackout

Blackout leveraging gmer driver to effectively disabling or killing EDRs and AVs. it bypass HVCI fluently the sample is sourced from loldrivers https://www.loldrivers.io/drivers/7ce8fb06-46eb-4f4f-90d5-5518a6561f15/ usage Place the driver Blackout.sys in the same path as the executable The...

AV-EDR-Killer

AV/EDR Killer https://github.com/user-attachments/assets/1eda3340-2af2-4136-b74e-be7a3f4b3924 This project demonstartes how a legit, and signed driver can be weponized to gain kernel level access. 🚨 The vulnerable driver: wsftprm.sys , signed by TPZ SOLUCOES DIGITAIS LTDA, and previously exposed ...

CVE-2025-1055-poc

CVE-2025-1055-poc PoC for CVE-2025-1055 and CVE-2025-52915 using K7RKScan.sys. This PoC use the 0x222018 IOCTL to terminate arbitrary processes. Usage Installing driver: sc.exe create K7RKScan1516.sys binPath=C:\Users\Administrator\Downloads\K7RKScan1516.sys type=kernel && sc.exe start...

WinDefenderKiller

WinDefenderKiller PermanentDisablefromRegistry C++ Code for Permanently Disabling Windows Defender via Registry Keys Just compile and execute it! And when i restart it: BYOVDWindowsDefenderKiller This module implements a BYOVD Bring Your Own Vulnerable Driver technique to disable Windows Defender...

STProcessMonitorBYOVD

STProcessMonitorBYOVD Reference: https://bbs.kafan.cn/thread-2288675-1-1.html Usage: 1. Place the vulnerable driver under the same directory of the exe. The version 11.11.4.0 the older one is with CVE-2025-70795 / CVE-2026-0828, compatible with the parameter /Kill; The version 11.26.18 Updated is...

moneta

/ \ / | / \ / \ / \ / / \ \ / Y | \ /| | / | //| | / | / / / / / Moneta v1.0 | Forrest Orr | 2020 REQUIRED -m |region|referenced|ioc -p |PID OPTIONAL -v detail|debug|surface -d --option from-base|statistics --filter unsigned-module|clr-prvx|clr-heap|metadata-modules --address --region-size -m...