rusty_drivers

RustyDrivers 该项目是一个 BYOVD 集合，专注于终止 EDR / AV 进程。 目前支持以下驱动程序： 驱动程序| 参数名称| 已阻止 ---|---|--- Process Explorer| processexplorer| 是 Genshin Impact| genshin| 是 Rentdrv2| rentdrv2| 否 TrueSight| truesight| 否 “已阻止”表示该驱动程序位于 Microsoft 的阻止列表中，无法在最新版 Windows 上执行。 构建 cargo build --release 用法 rustydrivers.exe...

Mhyprot2DrvControl

Mhyprot2DrvControl mhyprot2 ドライバを使用してプロセスモジュールの列挙、プロセスメモリの読み書き、プロセスの強制終了を可能にするライブラリです。 使用方法 ビルドして実行してください。利用可能な関数と使用方法については Driver\MhyProt2.cs を参照してください。 デモ...

CVE-2022-1227_Exploit

CVE-2022-1227Exploit CVE-2022-1227을 익스플로잇하는 스크립트입니다. 배경 Ubuntu 20.10이 권장됩니다. Podman TODO: 이 취약점의 원리 추가하기 Podman 설치 공식 문서의 지침을 따르세요: https://podman.io/getting-started/installationinstalling-on-linux Ubuntu 20.10의 경우 설치 명령어는 다음과 같아야 합니다: sudo apt-get install podman=3.4.4+ds1-1ubuntu1 빠른 시작 간단한 익스플로...

DsArk64

DsArk64 DsArk64.sys は 360 Total Security に同梱されています。Microsoft による WHQL 署名済み。LOLDrivers: magicsword-io/LOLDrivers308。CVE: 申請中 MITRE。 プリミティブ プロセス強制終了 リング0 IOCTL 0x80863008、入力: 4バイトの生PID ドライバはカーネルから ZwOpenProcessALLACCESS + ZwTerminateProcess を呼び出す このIOCTLに暗号化はなし PPL、EDRの自己保護、改ざん防止をバイパス カーネル読み取り IOCT...

BYOVD

BYOVD 는 취약한 드라이버를 악용하여 AV/EDR 솔루션을 비활성화하는 방법을 시연하는 PoC 모음입니다. 이 컬렉션에는 문서화되지 않은 드라이버와 LOLDDrivers 또는 Microsoft의 권장 드라이버 차단 규칙에 이미 포함된 드라이버가 모두 포함되어 있습니다. 최초 발견 이후, TfSysMon 드라이버는 LOLDrivers에 추가되었으며 Sophos 및 ESET이 보고한 바와 같이 랜섬웨어 그룹이 EDRKillShifter 도구를 사용하여 악용하고 있습니다. 📚 목차 🔍 개요 🏗️ 프로젝트 구조 🔧 빌드 📦...

Raccine

Raccine シンプルなランサムウェア対策 なぜ ランサムウェアが vssadmin を使ってすべてのシャドウコピーを削除するのをよく見かけます。その要求をインターセプトして、呼び出したプロセスを強制終了できたらどうでしょうか？シンプルなワクチンを作ってみましょう。 仕組み 私たちは、コンパイル済みの raccine.exe を vssadmin.exe（および wmic.exe）用のデバッガとして登録します。Raccine は、まず親プロセスの PID をすべて収集し、その後すべての親プロセスを強制終了しようとするバイナリです。 長所: この方法はかなり汎用的です...

Malicious code in flydev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e8d7456b5f0f3d2d3115eed9624272036cad1316cd50ee05e4134e5fa30f8ca The package advertises itself as a generic 'Utility' but ships a purely destructive payload hidden under a deeply nested single-letter directory tree...

DEBIAN-CVE-2026-15060

When systemd-machined = v259 or v258 with a custom polkit policy that allows register-machine access is running on a desktop system, an unprivileged user logged in a desktop graphical session can kill arbitrary processes, even privileged ones. - versions older than v259 are not affected, unless...

CVE-2026-59677

A Missing Authorization vulnerability in selinux policycoreutils seunshares allows a user that is running in unconfined context to kill e.g. root-owned processes running also in unconfined context This issue affects policycoreutils through 3.10...

CVE-2026-59677

The CVE-2026-59677 issue is a local vulnerability in SELinux policycoreutils seunshares (up to version 3.10) that permits a user running in an unconfined context to kill root-owned processes also in unconfined context. Documented under PT-2026-61060 as a Local DoS/vector in seunshare, with the af...

PT-2026-61059

A Time-of-check Time-of-use TOCTOU Race Condition vulnerability in seunshare of selinux policycoreutils allows a user calling seunshare that is running in the unconfined SELinux domain to delete arbitrary root-owned files, This issue affects policycoreutils through 3.10...

CVE-2026-27486

OpenClaw CVE-2026-27486 affects the OpenClaw CLI up to version 2026.2.13, where cleanup uses system-wide process enumeration and pattern-based termination without verifying process ownership. On shared hosts, unrelated processes matching the pattern could be terminated. The issue is addressed in ...

EUVD-2026-5440

In the Linux kernel, the following vulnerability has been resolved: arm64/fpsimd: signal: Fix restoration of SVE context When SME is supported, Restoring SVE signal context can go wrong in a few ways, including placing the task into an invalid state where the kernel may read from out-of-bounds...

EUVD-2013-4176

Malware in sbrugna...

Linux Distros Unpatched Vulnerability : CVE-2017-14681

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The daemon in P3Scan 3.0rc1 and earlier creates a p3scan.pid file after dropping privileges to a non-root account, which might allow local users to kill arbitra...

Linux Distros Unpatched Vulnerability : CVE-2022-49829

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/scheduler: fix fence ref counting We leaked dependency fences when processes were beeing killed. Additional to that grab a reference to the last scheduled...

CVE-2023-32695

socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. A patch has been released in version 4.2.3...

CVE-2025-2794

CVE-2025-2794 describes an unsafe reflection vulnerability in Kentico Xperience (affecting Xperience up to and including version 13.0.180). An unauthenticated attacker can trigger the vulnerability to terminate the current process, resulting in a Denial-of-Service condition. The issue is rooted i...

Low: Red Hat Security Advisory: cockpit security update

An update for cockpit is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

DEBIAN-CVE-2024-50015

In the Linux kernel, the following vulnerability has been resolved: ext4: dax: fix overflowing extents beyond inode size when partially writing The daxiomaprw does two things in each iteration: map written blocks and copy user data to blocks. If the process is killed by userSee signal handling in...