TopazTerminator

TopazTerminator 又一个驱动被烧了... 我之前一直藏着 wsftprm.sys 驱动 😉 但既然有人发了公开的 PoC，我也就不再藏着掖着了。我们都知道它很快就会被加入驱动黑名单，所以我用 C 语言实现了同样的功能。 该项目利用存在漏洞的 wsftprm.sys（Topaz Antifraud 内核驱动）来终止 Windows 上的受保护进程（例如杀毒软件/EDR 服务）。 截至 2026 年 1 月 ，wsftprm.sys（SHA-256:...

CVE-2025-1055-poc

CVE-2025-1055-poc 使用 K7RKScan.sys 实现 CVE-2025-1055 和 CVE-2025-52915 的 PoC。此 PoC 利用 0x222018 IOCTL 终止任意进程。 使用方法 安装驱动： root@kitploit: sc.exe create K7RKScan1516.sys binPath=C:\Users\Administrator\Downloads\K7RKScan1516.sys type=kernel && sc.exe start K7RKScan1516.sys 运行 PoC： root@kitploit:...

HackSysExtremeVulnerableDriver

HackSys Extreme Vulnerable Driver root@kitploit: ooooo ooooo oooooooooooo oooooo oooo oooooooooo. 888' 888' 888' 8 888. .8' 888' Y8b 888 888 888 888. .8' 888 888 888ooooo888 888oooo8 888. .8' 888 888 888 888 888 " 888.8' 888 888 888 888 888 o 888' 888 d88' o888o o888o o888ooooood8 8' o888bood8P'...

CVE-2022-22077

✅ Marco de explotación de CVE-2022-22077 RTCore64.sys: Este documento proporciona una visión general completa del marco de explotación de CVE-2022-22077, un sofisticado kit de herramientas de ataque BYOVD Bring Your Own Vulnerable Driver que apunta a la vulnerabilidad del controlador RTCore64.sys...

nuc-winring0-fix

Intel NUC WinRing0 易受攻击驱动 - 永久移除指南 Windows Defender 将 OpenHardwareMonitorLib.sys（WinRing0 驱动）标记为 VulnerableDriver:WinNT/Winring0 ，原因是 CVE-2020-14979。该驱动与 Intel 的 NUC Software Studio 服务捆绑，并通过 Windows Update 重新安装。 本仓库提供永久解决方案。 问题所在 1. Intel 的 performancedriverextension.inf 安装 NucSoftwareStudioServi...

0xKern3lCrush

💀 0xKern3lCrush-M4te-CVE-2026-0828 Notas de investigación de BYOVD para Windows y reconocimiento de endpoints Repositorio estrictamente educativo / de investigación en seguridad. Objetivo: documentar y comprender las técnicas de Bring-Your-Own-Vulnerable-Driver BYOVD mediante divulgaciones públic...

BYOVD

BYOVD es una colección de PoCs que demuestran cómo se pueden explotar controladores vulnerables para deshabilitar soluciones AV/EDR. La colección incluye tanto controladores no documentados como aquellos con cobertura existente en LOLDDrivers o en las reglas de bloqueo de controladores recomendad...

CVE-2025-66680

CVE-2025-66680 En Wise Force Deleter 1.5.7.59 y versiones anteriores, un atacante con acceso de administrador local puede eliminar archivos arbitrarios del sistema de archivos al convertir la aplicación en un arma. Uso 1. Coloque WiseDelfile64.sys en C:\Windows 2. Compile el proyecto 3. Cree...

BadRentdrv2

BadRentdrv2 一个我利用的易受攻击驱动程序（BYOVD），能够终止市场上多种EDR和杀毒软件，使其失效，同时支持x32和x64架构。 它是如何工作的？ 编译时针对传统的x32架构，以获得更广的攻击范围。 在以管理员身份运行的命令提示符中，使用以下命令行： root@kitploit: BadRentdrv2.exe 这将毫不费力地终止受保护的进程。 注意：在这个概念验证中，我只编写了通过PID终止进程的功能。它还支持其他方法，例如按进程名称终止，以及按父进程名称终止进程及其子进程。只需稍作修改即可实现。请阅读概念验证代码以了解详情。 对市场上最知名的安全系统的测试： 360杀毒...

evil-mhyprot-cli

evil-mhyprot-cli Una PoC para el controlador vulnerable Mhyprot2.sys que permite leer/escribir memoria en kernel/usuario mediante un proceso de usuario sin privilegios. libmhyprot Wiki Descripción general Lo que podemos hacer con esta CLI es lo siguiente: Leer/Escribir cualquier memoria del kerne...

echoac-poc

CVE-2023-38817 关于 echo.ac 驱动中发现漏洞的 PoC 与详细分析。 CVE 信息 编号：CVE-2023-38817 厂商：Inspect Element Ltd 13017981，以 Echo 名义运营。 受影响产品：echo.ac 反作弊扫描工具。 受影响版本：echo.ac - 5.2.1.0，echodriver.sys - 所有已发布版本。 受影响操作系统：从 Windows 7 到 Windows 11 的 64 位 Windows 版本。 缓解措施：不要使用该软件，并将驱动签名加入黑名单。 证书已吊销 微软已将 Echo...

Silver Fox Targets Japanese Manufacturer with 3-Driver BYOVD Chain and ValleyRAT

The Chinese cybercrime group known as Silver Fox has been observed using new drivers as part of bring your own vulnerable driver BYOVD attacks targeting a Japanese organization in the industrial manufacturing sector to ultimately deliver ValleyRAT aka Winos 4.0 for persistent remote access. "In...

Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows Malware

The China-linked cybercrime group behind the use of income tax-related phishing lures targeting Indian taxpayers, tax professionals, and corporate finance teams has been observed using a sophisticated crypter service called Cruciferra. According to a new analysis by Proofpoint, Cruciferra has bee...

The Gentlemen RaaS Uses GentleKiller EDR Framework Targeting 400 Security Processes

The Gentlemen ransomware-as-a-service RaaS operation is actively developing and maintaining a suite of endpoint detection and response EDR killers that it hands out to affiliates for impairing system defenses before deploying the encryptor. This mature portfolio of EDR-terminating tools is center...

Vendor-signed UEFI applications found vulnerable to Secure Boot bypass

Overview Multiple vendor-signed UEFI applications are vulnerable to Secure Boot bypass via a "Bring Your Own Vulnerable Driver" BYOVD-style attack. If a target system trusts the affected vendor’s certificate, an attacker can exploit these applications to execute arbitrary code during the early...

PCTCore64.sys Windows kernel driver contains missing access control vulnerability

Overview The PCTCore64.sys Windows kernel driver from PC Tools Internet Security exposes its \.\PCTCoreDriver device interface with no access control, allowing any user-mode process to interact with the driver and invoke privileged IOCTL I/O Control commands. In a Bring Your Own Vulnerable Driver...

Making Vulnerable Drivers Exploitable Without Hardware - The BYOVD Perspective

1 Introduction This article provides a technical analysis of how many Windows kernel mode drivers can be interacted with from user mode without the hardware they were developed for. This work was motivated by driver-oriented vulnerability research and the need to evaluate the exploitability of...

CVE-2025-11159

Technical details such as affected product versions, root cause, and exploit information are not publicly available in the provided documents. Monitor for updates.

throttlestop-poc

throttlestop-poc This is a simple Proof-of-Concept that abuses...

Qilin and Warlock Ransomware Use Vulnerable Drivers to Disable 300+ EDR Tools

Threat actors associated with Qilin and Warlock ransomware operations have been observed using the bring your own vulnerable driver BYOVD technique to silence security tools running on compromised hosts, according to findings from Cisco Talos and Trend Micro. Qilin attacks analyzed by Talos have...