Terminator

Terminator zam64.sys 드라이버를 악용하여 모든 EDR/XDR/AV 프로세스를 종료하는 Spyboy 기법을 재현합니다. Spyboy는 Terminator 소프트웨어를 $3,000에 판매하고 있었습니다. 자세한 내용 샘플은 loldrivers에서 가져왔습니다. 사용법 컴파일된 버전은 여기에서 찾을 수 있습니다. 드라이버 Terminator.sys를 실행 파일과 같은 경로에 배치하세요. 프로그램을 관리자 권한으로 실행하세요. 프로그램을 계속 실행하여 서비스가 안티멀웨어를 다시 시작하지 못하게 하세요. 기술적 세부 사...

CVE-2026-16006

Exposure of Sensitive System Information to an Unauthorized Control Sphere in Armoury Crate driver allows a local user to obtain kernel virtual addresses via a crafted IOCTL request by bypassing the driver's verification, potentially providing further insight into the kernel memory layout.Refer t...

EUVD-2026-72625

Sensitive Information in Resource Not Removed Before Reuse in ASUS Armoury Crate driver allows a local user to disclose sensitive information from uninitialized memory via a crafted IOCTL request that bypasses the driver's security verification mechanism. Refer to the ' Security Update for Armour...

CVE-2026-16006

Exposure of Sensitive System Information to an Unauthorized Control Sphere in Armoury Crate driver allows a local user to obtain kernel virtual addresses via a crafted IOCTL request by bypassing the driver's verification, potentially providing further insight into the kernel memory layout.Refer t...

EUVD-2026-72621

Exposure of Sensitive System Information to an Unauthorized Control Sphere in Armoury Crate driver allows a local user to obtain kernel virtual addresses via a crafted IOCTL request by bypassing the driver's verification, potentially providing further insight into the kernel memory layout.Refer t...

CVE-2026-16006

Exposure of Sensitive System Information to an Unauthorized Control Sphere in Armoury Crate driver allows a local user to obtain kernel virtual addresses via a crafted IOCTL request by bypassing the driver's verification, potentially providing further insight into the kernel memory layout.Refer t...

PT-2026-86972

Name of the Vulnerable Software and Affected Versions Armoury Crate driver affected versions not specified Description An issue in the Armoury Crate driver allows a local user to obtain kernel virtual addresses by bypassing the driver verification process through a crafted IOCTL Input/Output...

EUVD-2026-71685

PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a hard-coded credentials vulnerability in DirectIo64.sys that allows local attackers to perform arbitrary physical memory writes by extracting an 8-byte key embedded ...

PT-2026-58874

Name of the Vulnerable Software and Affected Versions ASUS System Control Interface v3 affected versions not specified ASUS System Control Interface affected versions not specified ASUS Business Manager affected versions not specified Description An untrusted pointer dereference exists in the...

SUSE CVE-2019-10063

Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1.3.1 allows a sandbox bypass. Flatpak versions since 0.8.1 address CVE-2017-5226 by using a seccomp filter to prevent sandboxed apps from using the TIOCSTI ioctl, which could otherwise be used to inject commands into the...