TopazTerminator

TopazTerminator 又一个驱动被烧了... 我之前一直藏着 wsftprm.sys 驱动 😉 但既然有人发了公开的 PoC，我也就不再藏着掖着了。我们都知道它很快就会被加入驱动黑名单，所以我用 C 语言实现了同样的功能。 该项目利用存在漏洞的 wsftprm.sys（Topaz Antifraud 内核驱动）来终止 Windows 上的受保护进程（例如杀毒软件/EDR 服务）。 截至 2026 年 1 月 ，wsftprm.sys（SHA-256:...

WinDefenderKiller

WinDefenderKiller DeshabilitaciónPermanenteDesdeRegistro Código en C++ para deshabilitar permanentemente Windows Defender mediante claves de registro ¡Solo compílalo y ejecútalo! Y cuando lo reinicie: BYOVDWindowsDefenderKiller Este módulo implementa una técnica BYOVD Bring Your Own Vulnerable...

CVE-2025-61156

CVE-2025-61156 Se descubrió una vulnerabilidad en el componente TfSysMon.sys del modo kernel de ThreatFire System Monitor =v4.7.0.53 que permite a usuarios sin privilegios realizar la terminación arbitraria de procesos con privilegios de modo kernel. Como resultado, los procesos PPL y los proceso...

CVE-2025-1055-poc

CVE-2025-1055-poc PoC para CVE-2025-1055 y CVE-2025-52915 usando K7RKScan.sys. Este PoC utiliza el IOCTL 0x222018 para terminar procesos arbitrarios. Uso Instalación del controlador: sc.exe create K7RKScan1516.sys binPath=C:\Users\Administrator\Downloads\K7RKScan1516.sys type=kernel && sc.exe sta...

BYOVD-DriverKiller

BYOVD-DriverKiller ⚠️ Aviso : Este proyecto es estrictamente educativo y demostrativo. No está pensado para utilizarse en un contexto malintencionado. El objetivo es aprender la metodología de ingeniería inversa y los pasos de explotación de un driver de Windows. Aquí explico el proceso que seguí...

Blackout

Blackout aprovechando el controlador gmer para deshabilitar o matar eficazmente EDRs y AVs. sortea HVCI sin problemas la muestra proviene de loldrivers https://www.loldrivers.io/drivers/7ce8fb06-46eb-4f4f-90d5-5518a6561f15/ uso Coloca el controlador Blackout.sys en la misma ruta que el ejecutable...

GHSA-PQF9-H8G4-8GMH Vikunja: Unbounded CSV row cardinality permits API process termination

Unbounded CSV row cardinality permits API process termination Summary The authenticated v2 CSV migration route caps upload bytes but not parsed row cardinality. It reads every record into a string and then materializes a full task object for every row before insertion. Two million one-cell rows f...

Vikunja: Unbounded nested task-filter recursion permits API process termination

Unbounded nested task-filter recursion permits API process termination Summary Authenticated task-list routes accept a filter expression without a length or nesting-depth bound, preprocess it, parse it recursively through fexpr, and recursively convert the resulting expression tree. A syntactical...

Reaper

「💀」 关于 Reaper Reaper 是一个概念验证工具，旨在利用 BYOVD（自带易受攻击驱动程序）漏洞。这种恶意技术涉及将一个合法的、易受攻击的驱动程序插入目标系统，从而使攻击者能够利用该驱动程序执行恶意操作。 Reaper 专门设计用于利用 kprocesshacker.sys 驱动程序 2.8.0.0 版本中存在的漏洞，利用其弱点来获取对目标系统的特权访问和控制。 注意： Reaper 不会杀死 Windows Defender 进程，因为它有保护机制，Reaper 只是一个简单的概念验证。 功能 终止进程 挂起进程 帮助 / \ / // / / / / / / / ,...

EUVD-2026-95910

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API rpc function in apiblueprint.py handles multipart/form-data uploads by reading the whole content of the uploaded file into memory with file.read. This occurs before the data is sent to the...

CVE-2026-48484

The pyLoad download manager is vulnerable to a Denial of Service (DoS) due to a lack of input size validation. Specifically, the rpc function in api_blueprint.py processes multipart/form-data uploads by using file.read() to load the entire file into memory before further processing. Because no si...

CVE-2026-19193-PoC

CVE-2026-19193 - Prueba de Concepto Terminación arbitraria de procesos a través del manejador de mensajes de minifiltro no autenticado en el controlador de núcleo de Jiangmin Antivirus kvcore.sys Activo afectado: Producto: Jiangmin Antivirus V21 Componente: kvcore.sys controlador de núcleo...

GhostDriver

GhostDriver 👻 Acerca de GhostDriver es una herramienta de eliminación de AV construida en Rust que utiliza BYOVD. Cómo empezar 1. Instala Rust desde rust-lang.org 2. Clona: git clone https://github.com/BlackSnufkin/GhostDriver.git 3. Compila: cargo build --release --target=x8664-pc-windows-msvc 4...

CVE-2018-6606

CVE-2018-6606 Esto termina cualquier PID. Probado en Windows 10 64 bits, Flare VM. Se requieren privilegios de administrador. Pueden ser necesarios algunos ajustes: consulte resource.rc. Cadena de herramientas Descarga:...

BadRentdrv2

BadRentdrv2 一个我利用的易受攻击驱动程序（BYOVD），能够终止市场上多种EDR和杀毒软件，使其失效，同时支持x32和x64架构。 它是如何工作的？ 编译时针对传统的x32架构，以获得更广的攻击范围。 在以管理员身份运行的命令提示符中，使用以下命令行： BadRentdrv2.exe 这将毫不费力地终止受保护的进程。 注意：在这个概念验证中，我只编写了通过PID终止进程的功能。它还支持其他方法，例如按进程名称终止，以及按父进程名称终止进程及其子进程。只需稍作修改即可实现。请阅读概念验证代码以了解详情。 对市场上最知名的安全系统的测试： 360杀毒软件 卡巴斯基杀毒软件...

CVE-2026-107737

The multi-format reader SumatraPDF for Windows is vulnerable to an out-of-bounds object lookup in versions 3.6.1 and earlier , and in pre-release 3.7.0.20369 when WebView2 is absent or fails to initialize. The root cause lies in the ParseProtoUrl() function, which accepts the signed host componen...

CVE-2026-107737 SumatraPDF CHM `its://` signed index causes an out-of-bounds object lookup

SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, and in pre-release 3.7.0.20369 when WebView2 is absent or cannot initialize, ParseProtoUrl accepts the signed host component of an its:// URL and FindHtmlWindowById uses it directly as an index into gHtmlWindows. Opening a...

CVE-2026-107733

In SumatraPDF version 3.6.1 and earlier for Windows, a null-pointer dereference occurs within the FrameOnCommand() function when handling CmdExec while no document tab is open. The root cause is the passing of a null current-tab pointer to RunWithExe(), leading to the dereferencing of WindowTab::...

EUVD-2026-95254

The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decodeall API can cause the application proce...

CVE-2026-106435

The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decodeall API can cause the application proce...