CVE-2025-1055-poc

CVE-2025-1055-poc PoC for CVE-2025-1055 and CVE-2025-52915 using K7RKScan.sys. This PoC use the 0x222018 IOCTL to terminate arbitrary processes. Usage Installing driver: root@kitploit: sc.exe create K7RKScan1516.sys binPath=C:\Users\Administrator\Downloads\K7RKScan1516.sys type=kernel && sc.exe...

nuc-winring0-fix

Controlador Vulnerable WinRing0 de Intel NUC - Guía de Eliminación Permanente Windows Defender marca OpenHardwareMonitorLib.sys controlador WinRing0 como VulnerableDriver:WinNT/Winring0 debido a CVE-2020-14979. Este controlador se incluye con el servicio NUC Software Studio de Intel y se reinstal...

TopazTerminator

TopazTerminator F, Another driver got burned.. I was gatekeeping wsftprm.sys driver for a while ; but since someone posted a public POC, I'm ungatekeeping it. We all know it'll get added to the driver blocklist soon, so here's my implementation for the same — in C This project exploits the...

CVE-2022-22077

✅ CVE-2022-22077 exploitation framework RTCore64.sys: This document provides a comprehensive overview of the CVE-2022-22077 exploitation framework, a sophisticated BYOVD Bring Your Own Vulnerable Driver attack toolkit that targets the RTCore64.sys driver vulnerability. This framework demonstrates...

HackSysExtremeVulnerableDriver

HackSys Extreme Vulnerable Driver root@kitploit: ooooo ooooo oooooooooooo oooooo oooo oooooooooo. 888' 888' 888' 8 888. .8' 888' Y8b 888 888 888 888. .8' 888 888 888ooooo888 888oooo8 888. .8' 888 888 888 888 888 " 888.8' 888 888 888 888 888 o 888' 888 d88' o888o o888o o888ooooood8 8' o888bood8P'...

0xKern3lCrush

💀 0xKern3lCrush-M4te-CVE-2026-0828 Notas de investigación de BYOVD para Windows y reconocimiento de endpoints Repositorio estrictamente educativo / de investigación en seguridad. Objetivo: documentar y comprender las técnicas de Bring-Your-Own-Vulnerable-Driver BYOVD mediante divulgaciones públic...

BYOVD

BYOVD es una colección de PoCs que demuestran cómo se pueden explotar controladores vulnerables para deshabilitar soluciones AV/EDR. La colección incluye tanto controladores no documentados como aquellos con cobertura existente en LOLDDrivers o en las reglas de bloqueo de controladores recomendad...

CVE-2025-66680

CVE-2025-66680 En Wise Force Deleter 1.5.7.59 y versiones anteriores, un atacante con acceso de administrador local puede eliminar archivos arbitrarios del sistema de archivos al convertir la aplicación en un arma. Uso 1. Coloque WiseDelfile64.sys en C:\Windows 2. Compile el proyecto 3. Cree...

echoac-poc

CVE-2023-38817 Un PoC y writeup sobre vulnerabilidades descubiertas en el driver de echo.ac. Información del CVE Número: CVE-2023-38817 Proveedor: Inspect Element Ltd 13017981, operando como Echo. Productos afectados: herramienta de escaneo AntiCheat echo.ac. Versiones afectadas: echo.ac - 5.2.1....

BadRentdrv2

BadRentdrv2 Un driver vulnerable explotado por mí BYOVD que es capaz de terminar varios EDRs y software antivirus en el mercado, volviéndolos ineficaces, funcionando tanto para x32 como para x64. ¿Cómo funciona? Compile apuntando a la arquitectura x32 heredada para un rango de ataque más amplio. ...

evil-mhyprot-cli

evil-mhyprot-cli Una PoC para el controlador vulnerable Mhyprot2.sys que permite leer/escribir memoria en kernel/usuario mediante un proceso de usuario sin privilegios. libmhyprot Wiki Descripción general Lo que podemos hacer con esta CLI es lo siguiente: Leer/Escribir cualquier memoria del kerne...

Silver Fox Targets Japanese Manufacturer with 3-Driver BYOVD Chain and ValleyRAT

The Chinese cybercrime group known as Silver Fox has been observed using new drivers as part of bring your own vulnerable driver BYOVD attacks targeting a Japanese organization in the industrial manufacturing sector to ultimately deliver ValleyRAT aka Winos 4.0 for persistent remote access. "In...

Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows Malware

The China-linked cybercrime group behind the use of income tax-related phishing lures targeting Indian taxpayers, tax professionals, and corporate finance teams has been observed using a sophisticated crypter service called Cruciferra. According to a new analysis by Proofpoint, Cruciferra has bee...

The Gentlemen RaaS Uses GentleKiller EDR Framework Targeting 400 Security Processes

The Gentlemen ransomware-as-a-service RaaS operation is actively developing and maintaining a suite of endpoint detection and response EDR killers that it hands out to affiliates for impairing system defenses before deploying the encryptor. This mature portfolio of EDR-terminating tools is center...

Vendor-signed UEFI applications found vulnerable to Secure Boot bypass

Overview Multiple vendor-signed UEFI applications are vulnerable to Secure Boot bypass via a "Bring Your Own Vulnerable Driver" BYOVD-style attack. If a target system trusts the affected vendor’s certificate, an attacker can exploit these applications to execute arbitrary code during the early...

PCTCore64.sys Windows kernel driver contains missing access control vulnerability

Overview The PCTCore64.sys Windows kernel driver from PC Tools Internet Security exposes its \.\PCTCoreDriver device interface with no access control, allowing any user-mode process to interact with the driver and invoke privileged IOCTL I/O Control commands. In a Bring Your Own Vulnerable Driver...

Making Vulnerable Drivers Exploitable Without Hardware - The BYOVD Perspective

1 Introduction This article provides a technical analysis of how many Windows kernel mode drivers can be interacted with from user mode without the hardware they were developed for. This work was motivated by driver-oriented vulnerability research and the need to evaluate the exploitability of...

CVE-2025-11159

Technical details such as affected product versions, root cause, and exploit information are not publicly available in the provided documents. Monitor for updates.

throttlestop-poc

throttlestop-poc This is a simple Proof-of-Concept that abuses...

Qilin and Warlock Ransomware Use Vulnerable Drivers to Disable 300+ EDR Tools

Threat actors associated with Qilin and Warlock ransomware operations have been observed using the bring your own vulnerable driver BYOVD technique to silence security tools running on compromised hosts, according to findings from Cisco Talos and Trend Micro. Qilin attacks analyzed by Talos have...