9 matches found
CVE-2025-7771
CVE-2025-7771 ThrottleStopドライバを悪用して、ユーザーモードから任意のカーネルモード関数を呼び出すエクスプロイト。 デモ 参照 https://github.com/jonomango/superfetch https://securelist.com/av-killer-exploiting-throttlestop-sys/117026/...
ThrottleStopPPL
ThrottleStopPPL Windows Server 2022 上の Protected Process Light PPL 保護レベルを管理するための概念実証ツールです。ThrottleStop ドライバの脆弱性（CVE-2025-7771）を悪用します。 概要 このツールは、ThrottleStop ドライバによって公開された任意の物理メモリ読み取り/書き込み機能を介した特権昇格を示します。カーネルメモリ構造を直接操作することで、プロセス保護レベルの変更を可能にします。 特徴 任意の物理メモリ読み取り/書き込み Superfetch を介した仮想アドレスから物理アドレスへの変...
EUVD-2025-23820
Malicious code in bioql PyPI...
Exploit for CVE-2025-7771
CVE-2025-7771 Minimal exploit to...
Exploit for CVE-2025-7771
CVE-2025-7771 – ThrottleStop.sys Privilege Escalation Vuln...
CVE-2025-7771
ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary read and write access to physical memory via the MmMapIoSpace function. This insecure implementation can be exploited by a malicious user-mode application to patch the running Windows kernel and invoke...
Driver of destruction: How a legitimate driver is being used to take down AV processes
Introduction In a recent incident response case in Brazil, we spotted intriguing new antivirus AV killer software that has been circulating in the wild since at least October 2024. This malicious artifact abuses the ThrottleStop.sys driver, delivered together with the malware, to terminate numero...
CVE-2025-7771 Code Execution / Escalation of Privileges in ThrottleStop
ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary read and write access to physical memory via the MmMapIoSpace function. This insecure implementation can be exploited by a malicious user-mode application to patch the running Windows kernel and invoke...
PT-2025-32145
Name of the Vulnerable Software and Affected Versions ThrottleStop.sys version 3.0.0.0 ThrottleStop.sys affected versions not specified Description The ThrottleStop.sys driver contains an insecure implementation of the MmMapIoSpace function, which exposes two IOCTL interfaces allowing arbitrary...