2694 matches found
NSecSoftBYOVD
NSecSoftBYOVD Update 2026.1.13: The vulnerbility has been assigned the number CVE-2025-68947 Reference: https://bbs.kafan.cn/thread-2284992-1-1.html, https://blog.csdn.net/qq40827990/article/details/148997201 Same techniques are widely used by Silverfox Group to terminate AV processes BYOVD Usage...
CVE-2022-42046
EvilWfshbr CVE-2022-42046 Proof of Concept of wfshbr64.sys local privilege escalation wfshbr64.sys and wfshbr32.sys specially crafted payload allows arbitrary user to perform bitwise operation with arbitrary EPROCESS offset and flags value to purposely elevate the game process to CodeGen Full...
BYOVD-DriverKiller
BYOVD-DriverKiller This README EN may contain errors ! β οΈ Disclaimer : This project is strictly educational and demonstrative. It is not intended for malicious use. The goal is to learn reverse engineering methodology and the exploitation steps of a Windows driver. Here I explain the approach I...
WinDriver-EXP
PoC Repository for Vulnerable Windows Drivers This repository includes PoC exploits for vulnerabilities in Windows drivers, showcasing flaws that can result in privilege escalation, arbitrary code execution, or other security risks. Intended for research and education only. POCs Vulnerability| CV...
CVE-2023-28252-Compiled-exe
CVE-2023-28252-Compiled-exe A modification of Fortra's excellent CVE-2023-2852 Privesc Exploit. Works on Windows 11 21H2 clfs.sys version 10.0.22000.1574 - also works on Windows 10 21H2, Windows 10 22H2, Windows 11 22H2 and Windows server 2022. This version retains the original functionality, but...
CVE-2015-1635-POC
CVE-2015-1635-POC, MS15-034 HTTP.sys HTTP.sys is the kernel driver for Microsoft Windows that handles HTTP requests. It was introduced from IIS6.0 to optimize IIS server performance, and the IIS service process depends on HTTP.sys. The HTTP.sys remote code execution vulnerability is essentially a...
CVE-2019-0708
CVE-2019-0708 - BlueKeep RDP RDP Connection Sequence: https://docs.microsoft.com/en-us/openspecs/windowsprotocols/ms-rdpbcgr/023f1e69-cfe8-4ee6-9ee0-7e759fb4e4ee Analysis of RDP Service Vulnerability:...
CVE-2025-66676
CVE-2025-66676 In IOBit Unlocker 1.3.0.11 and earlier, the application allows arbitrary process termination by trying to unlock a file. Background The application is used to unlock a unlocked file. By specifying the process image file of a running process as the locked file, IOBit unlocker will t...
CVE-2024-7479_CVE-2024-7481
CVE-2024-7479 & CVE-2024-7481 TeamViewer User to Kernel Elevation of Privilege This repository contains the exploit proof of concept of a vulnerability in TeamViewer that enables an unprivileged user to load an arbitrary Kernel Driver into the system. I would like to thank Zero Day Initiative for...
CVE-2022-25949
CVE-2022-25949 A years-old exploit of a local EoP vulnerability in Kingsoft Antivirus KWatch Driver version 2009.3.17.77. 2009..? I reported the issue in January 2014 and was notified of the CVE 8+ years later. I decided to upload this because it is amusing enough to find my old code and that it...
cryptodev-linux
cryptodev-linux This is a /dev/crypto device driver, equivalent to those in OpenBSD or FreeBSD. The main idea is to access existing ciphers in kernel space from userspace, thus enabling the re-use of a hardware implementation of a cipher. For questions and suggestions, please use the homepage at...
Platbox
Platbox UEFI and SMM Assessment Tool Features Platbox is a tool that helps assessing the security of the platform: Dumps the platform registers that are interesting security-wise Flash Locks MMIO and Remapping Locks SMM Base and Locks MSRs RW access to the PCI configuration space of devices. RW t...
nuc-winring0-fix
Intel NUC WinRing0 Vulnerable Driver - Permanent Removal Guide Windows Defender flags OpenHardwareMonitorLib.sys WinRing0 driver as VulnerableDriver:WinNT/Winring0 due to CVE-2020-14979. This driver is bundled with Intel's NUC Software Studio service and gets reinstalled via Windows Update. This...
exploit_mitigations
Exploitation Mitigations The goal is to list exploitation mitigations added over time in various operating systems, software, libraries or hardware. It becomes handy to know if a given vulnerability is easily exploitable or not depending on exploitation mitigations in place. An example is the...
CVE-2026-29923
CVE-2026-29923 - Local Privilege Escalation via Arbitrary Physical Memory Mapping The pstrip64.sys kernel driver exposes an IOCTL that allows low-privileged users to map arbitrary ranges of physical memory into their own virtual address space. This primitive allows full read/write access to the...
CVE-2025-61156
CVE-2025-61156 A vulnerability was discovered in the ThreatFire System Monitor =v4.7.0.53 kernel-mode TfSysMon.sys component that allows unprivileged users to perform arbitrary process termination with kernel-mode privileges. As a result, PPL and protected system processes can be forcefully...
Interceptor
Interceptor Author: @Cerbersec Interceptor is a kernel driver focused on tampering with EDR/AV solutions in kernel space by patching kernel callbacks and hooking IRPs. Interceptor was made as part of an internship at NVISO Security's Red Team. The associated blogposts can be found here kernel...
Disk-Spoofer
Disk-Spoofer Kernel driver based disk size and sector query spoofing program, can evade Windows WMIC query. Environmental dependence windows10 22H2 vs2019 Cheat off If can help you, please Star...