HackSysExtremeVulnerableDriver

HackSys Extreme Vulnerable Driver root@kitploit: ooooo ooooo oooooooooooo oooooo oooo oooooooooo. 888' 888' 888' 8 888. .8' 888' Y8b 888 888 888 888. .8' 888 888 888ooooo888 888oooo8 888. .8' 888 888 888 888 888 " 888.8' 888 888 888 888 888 o 888' 888 d88' o888o o888o o888ooooood8 8' o888bood8P'...

0xKern3lCrush

💀 0xKern3lCrush-M4te-CVE-2026-0828 Notas de Pesquisa BYOVD para Windows e Reconhecimento de Endpoint Repositório estritamente educacional / de pesquisa em segurança. Objetivo: Documentar e entender técnicas Bring-Your-Own-Vulnerable-Driver BYOVD por meio de divulgações públicas — zero exploits...

CVE-2025-1055-poc

CVE-2025-1055-poc PoC für CVE-2025-1055 und CVE-2025-52915 mithilfe von K7RKScan.sys. Dieser PoC verwendet die 0x222018-IOCTL, um beliebige Prozesse zu beenden. Verwendung Treiber installieren: root@kitploit: sc.exe create K7RKScan1516.sys binPath=C:\Users\Administrator\Downloads\K7RKScan1516.sys...

TopazTerminator

TopazTerminator F, un altro driver è stato bruciato.. Stavo tenendo per me il driver wsftprm.sys per un po' ; ma visto che qualcuno ha pubblicato un POC pubblico, lo rilascio. Sappiamo tutti che presto verrà aggiunto alla lista dei driver bloccati, quindi ecco la mia implementazione per lo stesso...

CVE-2025-66680

CVE-2025-66680 No Wise Force Deleter 1.5.7.59 e versões anteriores, um atacante com acesso de administrador local pode deletar arquivos arbitrários no sistema de arquivos ao armamentar o aplicativo. Uso 1. Coloque WiseDelfile64.sys em C:\Windows 2. Compile o projeto 3. Crie um arquivo file.txt...

CVE-2022-22077

✅ CVE-2022-22077 Exploit-Framework RTCore64.sys: Dieses Dokument bietet einen umfassenden Überblick über das CVE‑2022‑22077 Exploit‑Framework, ein anspruchsvolles BYOVD Bring Your Own Vulnerable Driver Angriffstoolkit, das die Schwachstelle im RTCore64.sys‑Treiber ausnutzt. Das Framework...

BadRentdrv2

BadRentdrv2 मेरे द्वारा शोषित एक कमजोर ड्राइवर BYOVD जो बाजार में कई EDRs और एंटीवायरस सॉफ्टवेयर को समाप्त करने में सक्षम है, उन्हें अप्रभावी बनाता है, और x32 और x64 दोनों के लिए काम करता है। यह कैसे काम करता है? व्यापक हमले की सीमा के लिए लीगेसी x32 आर्किटेक्चर को लक्षित करके संकलित करें। एक उन्...

nuc-winring0-fix

دليل إزالة برنامج تشغيل WinRing0 الضعيف في Intel NUC - بشكل دائم يقوم Windows Defender بوضع علامة على OpenHardwareMonitorLib.sys برنامج تشغيل WinRing0 كـ VulnerableDriver:WinNT/Winring0 بسبب CVE-2020-14979. يتم تضمين هذا البرنامج مع خدمة Intel NUC Software Studio ويتم إعادة تثبيته عبر Windows...

BYOVD

BYOVD is a collection of PoCs demonstrating how vulnerable drivers can be exploited to disable AV/EDR solutions. The collection includes both undocumented drivers and those with existing coverage in LOLDDrivers or Microsoft's recommended driver block rules. Since its initial discovery, the TfSysM...

Silver Fox Targets Japanese Manufacturer with 3-Driver BYOVD Chain and ValleyRAT

The Chinese cybercrime group known as Silver Fox has been observed using new drivers as part of bring your own vulnerable driver BYOVD attacks targeting a Japanese organization in the industrial manufacturing sector to ultimately deliver ValleyRAT aka Winos 4.0 for persistent remote access. "In...

Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows Malware

The China-linked cybercrime group behind the use of income tax-related phishing lures targeting Indian taxpayers, tax professionals, and corporate finance teams has been observed using a sophisticated crypter service called Cruciferra. According to a new analysis by Proofpoint, Cruciferra has bee...

The Gentlemen RaaS Uses GentleKiller EDR Framework Targeting 400 Security Processes

The Gentlemen ransomware-as-a-service RaaS operation is actively developing and maintaining a suite of endpoint detection and response EDR killers that it hands out to affiliates for impairing system defenses before deploying the encryptor. This mature portfolio of EDR-terminating tools is center...

Vendor-signed UEFI applications found vulnerable to Secure Boot bypass

Overview Multiple vendor-signed UEFI applications are vulnerable to Secure Boot bypass via a "Bring Your Own Vulnerable Driver" BYOVD-style attack. If a target system trusts the affected vendor’s certificate, an attacker can exploit these applications to execute arbitrary code during the early...

PCTCore64.sys Windows kernel driver contains missing access control vulnerability

Overview The PCTCore64.sys Windows kernel driver from PC Tools Internet Security exposes its \.\PCTCoreDriver device interface with no access control, allowing any user-mode process to interact with the driver and invoke privileged IOCTL I/O Control commands. In a Bring Your Own Vulnerable Driver...

Making Vulnerable Drivers Exploitable Without Hardware - The BYOVD Perspective

1 Introduction This article provides a technical analysis of how many Windows kernel mode drivers can be interacted with from user mode without the hardware they were developed for. This work was motivated by driver-oriented vulnerability research and the need to evaluate the exploitability of...

CVE-2025-11159

Technical details such as affected product versions, root cause, and exploit information are not publicly available in the provided documents. Monitor for updates.

throttlestop-poc

throttlestop-poc This is a simple Proof-of-Concept that abuses...

Qilin and Warlock Ransomware Use Vulnerable Drivers to Disable 300+ EDR Tools

Threat actors associated with Qilin and Warlock ransomware operations have been observed using the bring your own vulnerable driver BYOVD technique to silence security tools running on compromised hosts, according to findings from Cisco Talos and Trend Micro. Qilin attacks analyzed by Talos have...

Exploit for CVE-2024-51324

CVE-2024-51324 — BYOVD: BdApiUtil64.sys Process Killer · Maste...

PT-2026-27351

Name of the Vulnerable Software and Affected Versions EnTech Taiwan TVicPort Product version 4.0 Description An issue in the TVicPort64.sys component allows attackers to escalate privileges by sending crafted IOCTL 0x80002008 requests. This can lead to a kernel takeover via a Bring Your Own...