59 matches found
criPPLe
criPPLe プロセス保護（PP）およびプロセス保護ライト（PPL）を削除するWindowsカーネルドライバ。 これはZero-Point Securityの"Offensive Driver Developmentコース"の助けを借りて作成されました このカーネルドライバは、指定されたpidからプロセス保護を削除します。プロセスのPSPROTECTION構造体へのポインタを取得し、これらの値を0に設定します。 root@kitploit: PSPROTECTION +0x000 Level : UChar +0x000 Type : Pos 0, 3 Bits +0x000 Audi...
HITCON-2023-Demo-CVE-2023-20562
HITCON 2023 Демонстрация CVE-2023-20562 Описание Эта демонстрация прошла на HITCON 2023 в Тайване. Демо показывает эксплуатацию драйвера AMDCpuProfiler.sys в составе AMD μProf. Вызывая произвольную запись в токене EPROCESS, достигается повышение привилегий до уровня SYSTEM. Отключение флага DSE...
CVE-2026-69421
Integer underflow wrap or wraparound in Windows Kernel Mode Driver allows an authorized attacker to elevate privileges locally...
EUVD-2026-73489
Integer underflow wrap or wraparound in Windows Kernel Mode Driver allows an authorized attacker to elevate privileges locally...
CVE-2017-11882-Blocker
CVE-2017-11882-Blocker CVE-2017-11882를 무력화하는 Windows 드라이버 : 작동 방식 이 프로젝트는 커널 드라이버와 사용자 모드 알림 구성 요소로 나뉘며, 역호출 모델inverted call model을 사용하여 사용자 정의 장치를 통해 통신합니다. 커널 드라이버 1. 프로세스 콜백 - DriverEntry는 PsSetCreateProcessNotifyRoutineEx 콜백을 등록하여 새 프로세스가 실행되기 전에 시스템 전체의 모든 프로세스 생성 시 드라이버가 동기적으로 호출됩니다. 2. 부모...
AxHunter — Updated!
AxHunter PoCs for Wellbia XIGNCODE3 anti-cheat xhunter driver family — xhunter1.sys v2023.12.7.78 CVE-2026-3609 and xhunter2.sys v2026.6.1.192 CVE-2026-15430. Workspace layout Cargo workspace, three crates: root@kitploit: AxHunter/ ├── Cargo.toml workspace manifest ├── axhunter-lsa/ shared crate ...
CVE-2026-62699 Windows Universal Disk Format File System Driver (UDFS) Remote Code Execution Vulnerability
...
CVE-2026-58602
CVE-2026-58602 is a Windows kernel-mode-driver vulnerability described as a use-after-free that enables an authorized, local attacker to achieve elevation of privilege. The public documents do not provide product/vendor specifics beyond “Windows kernel” and “kernel-mode driver,” nor details on af...
SignalRGB kernel driver contains improper access control and IOCTL vulnerabilities
Overview The SignalRGB kernel driver, SignalIo.sys, contains two vulnerabilities involving improper access control and unsafe memory handling. The device object is created with an overly permissive Discretionary Access Control List DACL that allows user-mode processes to access privileged hardwar...
CVE-2026-8501
Improper access control in the PCTCore64.sys Windows kernel driver from PC Tools Internet Security allows user-mode processes to access the PCTCoreDriver WDM device interface and invoke privileged IOCTL handlers. A local attacker with the ability to access or load the affected driver can exploit...
CVE-2026-8501
Improper access control in the PCTCore64.sys Windows kernel driver from PC Tools Internet Security allows user-mode processes to access the PCTCoreDriver WDM device interface and invoke privileged IOCTL handlers. A local attacker with the ability to access or load the affected driver can exploit...
CVE-2026-8501
CVE-2026-8501 affects the PC Tools PCTCore64.sys Windows kernel driver. The driver exposes the .�5CPCTCoreDriver WDM device interface with no access control, allowing user-mode processes to invoke privileged IOCTL handlers and perform low-level operations. Documented impacts include credential th...
EUVD-2026-33669
Improper access control in the PCTCore64.sys Windows kernel driver from PC Tools Internet Security allows user-mode processes to access the PCTCoreDriver WDM device interface and invoke privileged IOCTL handlers. A local attacker with the ability to access or load the affected driver can exploit...
CVE-2026-8501
Improper access control in the PCTCore64.sys Windows kernel driver from PC Tools Internet Security allows user-mode processes to access the PCTCoreDriver WDM device interface and invoke privileged IOCTL handlers. A local attacker with the ability to access or load the affected driver can exploit...
PCTCore64.sys Windows kernel driver contains missing access control vulnerability
Overview The PCTCore64.sys Windows kernel driver from PC Tools Internet Security exposes its \.\PCTCoreDriver device interface with no access control, allowing any user-mode process to interact with the driver and invoke privileged IOCTL I/O Control commands. In a Bring Your Own Vulnerable Driver...
CVE-2025-11156
Netskope was notified about a potential gap in its agent NS Client on Windows systems. If this gap is successfully exploited, a local, authenticated user with Administrator privileges can improperly load the driver as a generic kernel service. This triggers the flaw, causing a system crash...
CVE-2025-11156
Netskope was notified about a potential gap in its agent NS Client on Windows systems. If this gap is successfully exploited, a local, authenticated user with Administrator privileges can improperly load the driver as a generic kernel service. This triggers the flaw, causing a system crash...
EUVD-2018-1756
Malware in sbrugna...
