CVE-2025-7771

CVE-2025-7771 通过滥用 ThrottleStop 驱动程序，从用户模式调用任意内核模式函数的漏洞利用程序。 演示 参考 https://github.com/jonomango/superfetch https://securelist.com/av-killer-exploiting-throttlestop-sys/117026/...

ThrottleStopPPL

ThrottleStopPPL 一个概念验证工具，通过利用ThrottleStop驱动程序（CVE-2025-7771）中的漏洞，管理Windows Server 2022上的受保护进程轻量级（PPL）保护级别。 概述 该工具演示了通过ThrottleStop驱动程序暴露的任意物理内存读写功能实现权限提升。它允许通过直接操作内核内存结构来修改进程保护级别。 功能 任意物理内存读写 通过Superfetch进行虚拟到物理地址转换 EPROCESS结构操作 任意进程的PPL保护级别修改 使用方法 PPLmanager.exe -p -v 选项 -p - 要修改的进程ID -v -...

EUVD-2025-23820

Malicious code in bioql PyPI...

Exploit for CVE-2025-7771

CVE-2025-7771 Minimal exploit to...

Exploit for CVE-2025-7771

CVE-2025-7771 – ThrottleStop.sys Privilege Escalation Vuln...

CVE-2025-7771

ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary read and write access to physical memory via the MmMapIoSpace function. This insecure implementation can be exploited by a malicious user-mode application to patch the running Windows kernel and invoke...

Driver of destruction: How a legitimate driver is being used to take down AV processes

Introduction In a recent incident response case in Brazil, we spotted intriguing new antivirus AV killer software that has been circulating in the wild since at least October 2024. This malicious artifact abuses the ThrottleStop.sys driver, delivered together with the malware, to terminate numero...

CVE-2025-7771 Code Execution / Escalation of Privileges in ThrottleStop

ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary read and write access to physical memory via the MmMapIoSpace function. This insecure implementation can be exploited by a malicious user-mode application to patch the running Windows kernel and invoke...

PT-2025-32145

Name of the Vulnerable Software and Affected Versions ThrottleStop.sys version 3.0.0.0 Description The ThrottleStop.sys driver contains an insecure implementation of the MmMapIoSpace function, which exposes two IOCTL interfaces that allow arbitrary read and write access to physical memory. This...