HackSysExtremeVulnerableDriver

HackSys Extreme Vulnerable Driver ooooo ooooo oooooooooooo oooooo oooo oooooooooo. 888' 888' 888' 8 888. .8' 888' Y8b 888 888 888 888. .8' 888 888 888ooooo888 888oooo8 888. .8' 888 888 888 888 888 " 888.8' 888 888 888 888 888 o 888' 888 d88' o888o o888o o888ooooood8 8' o888bood8P' Discord Server...

TopazTerminator

TopazTerminator F, Another driver got burned.. I was gatekeeping wsftprm.sys driver for a while ; but since someone posted a public POC, I'm ungatekeeping it. We all know it'll get added to the driver blocklist soon, so here's my implementation for the same — in C This project exploits the...

BadRentdrv2

BadRentdrv2 A vulnerable driver exploited by me BYOVD that is capable of terminating several EDRs and antivirus software in the market, rendering them ineffective, working for both x32 and x64. How does it work? Compile targeting the legacy x32 architecture for a wider attack range. In an elevate...

evil-mhyprot-cli

evil-mhyprot-cli Una PoC para el controlador vulnerable Mhyprot2.sys que permite leer/escribir memoria en kernel/usuario mediante un proceso de usuario sin privilegios. libmhyprot Wiki Descripción general Lo que podemos hacer con esta CLI es lo siguiente: Leer/Escribir cualquier memoria del kerne...

CVE-2025-1055-poc

CVE-2025-1055-poc PoC for CVE-2025-1055 and CVE-2025-52915 using K7RKScan.sys. This PoC use the 0x222018 IOCTL to terminate arbitrary processes. Usage Installing driver: sc.exe create K7RKScan1516.sys binPath=C:\Users\Administrator\Downloads\K7RKScan1516.sys type=kernel && sc.exe start...

nuc-winring0-fix

Intel NUC WinRing0 Vulnerable Driver - Permanent Removal Guide Windows Defender flags OpenHardwareMonitorLib.sys WinRing0 driver as VulnerableDriver:WinNT/Winring0 due to CVE-2020-14979. This driver is bundled with Intel's NUC Software Studio service and gets reinstalled via Windows Update. This...

0xKern3lCrush

💀 0xKern3lCrush-M4te-CVE-2026-0828 Windows BYOVD Research & Endpoint Recon Notes Strictly educational / security research repository. Goal: Document and understand Bring-Your-Own-Vulnerable-Driver BYOVD techniques via public disclosures — zero working exploits included. This repo collects: Safe...

BYOVD

EnPortv-Killer PoC for vulnerability in EnPortv driver from EnCase As of 2026-07-10, the driver is listed onLOLDDrivers but remains absent from Microsoft's recommended driver block rules as of 2026-07-10 Built on byovd-lib -- implements the DriverConfig trait and delegates the full BYOVD flow to...

CVE-2022-22077

✅ CVE-2022-22077 exploitation framework RTCore64.sys: This document provides a comprehensive overview of the CVE-2022-22077 exploitation framework, a sophisticated BYOVD Bring Your Own Vulnerable Driver attack toolkit that targets the RTCore64.sys driver vulnerability. This framework demonstrates...

CVE-2025-66680

CVE-2025-66680 In Wise Force Deleter 1.5.7.59 and earlier, an attacker with local administrator access can delete arbitrary file in the file system by weaponizing the app. Usage 1. Place WiseDelfile64.sys in C:\Windows 2. Compile the project 3. Create file.txt which contain the a list of files yo...

echoac-poc

CVE-2023-38817 关于 echo.ac 驱动中发现漏洞的 PoC 与详细分析。 CVE 信息 编号：CVE-2023-38817 厂商：Inspect Element Ltd 13017981，以 Echo 名义运营。 受影响产品：echo.ac 反作弊扫描工具。 受影响版本：echo.ac - 5.2.1.0，echodriver.sys - 所有已发布版本。 受影响操作系统：从 Windows 7 到 Windows 11 的 64 位 Windows 版本。 缓解措施：不要使用该软件，并将驱动签名加入黑名单。 证书已吊销 微软已将 Echo...

Silver Fox Targets Japanese Manufacturer with 3-Driver BYOVD Chain and ValleyRAT

The Chinese cybercrime group known as Silver Fox has been observed using new drivers as part of bring your own vulnerable driver BYOVD attacks targeting a Japanese organization in the industrial manufacturing sector to ultimately deliver ValleyRAT aka Winos 4.0 for persistent remote access. "In...

Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows Malware

The China-linked cybercrime group behind the use of income tax-related phishing lures targeting Indian taxpayers, tax professionals, and corporate finance teams has been observed using a sophisticated crypter service called Cruciferra. According to a new analysis by Proofpoint, Cruciferra has bee...

The Gentlemen RaaS Uses GentleKiller EDR Framework Targeting 400 Security Processes

The Gentlemen ransomware-as-a-service RaaS operation is actively developing and maintaining a suite of endpoint detection and response EDR killers that it hands out to affiliates for impairing system defenses before deploying the encryptor. This mature portfolio of EDR-terminating tools is center...

Vendor-signed UEFI applications found vulnerable to Secure Boot bypass

Overview Multiple vendor-signed UEFI applications are vulnerable to Secure Boot bypass via a "Bring Your Own Vulnerable Driver" BYOVD-style attack. If a target system trusts the affected vendor’s certificate, an attacker can exploit these applications to execute arbitrary code during the early...

PCTCore64.sys Windows kernel driver contains missing access control vulnerability

Overview The PCTCore64.sys Windows kernel driver from PC Tools Internet Security exposes its \.\PCTCoreDriver device interface with no access control, allowing any user-mode process to interact with the driver and invoke privileged IOCTL I/O Control commands. In a Bring Your Own Vulnerable Driver...

Making Vulnerable Drivers Exploitable Without Hardware - The BYOVD Perspective

1 Introduction This article provides a technical analysis of how many Windows kernel mode drivers can be interacted with from user mode without the hardware they were developed for. This work was motivated by driver-oriented vulnerability research and the need to evaluate the exploitability of...

CVE-2025-11159

Technical details such as affected product versions, root cause, and exploit information are not publicly available in the provided documents. Monitor for updates.

throttlestop-poc

throttlestop-poc This is a simple Proof-of-Concept that abuses...

Qilin and Warlock Ransomware Use Vulnerable Drivers to Disable 300+ EDR Tools

Threat actors associated with Qilin and Warlock ransomware operations have been observed using the bring your own vulnerable driver BYOVD technique to silence security tools running on compromised hosts, according to findings from Cisco Talos and Trend Micro. Qilin attacks analyzed by Talos have...