BYOVD-DriverKiller

BYOVD-DriverKiller ⚠️ Aviso : Este proyecto es estrictamente educativo y demostrativo. No está pensado para utilizarse en un contexto malintencionado. El objetivo es aprender la metodología de ingeniería inversa y los pasos de explotación de un driver de Windows. Aquí explico el proceso que seguí...

AV-EDR-Killer

AV/EDR Killer https://github.com/user-attachments/assets/1eda3340-2af2-4136-b74e-be7a3f4b3924 Este proyecto demuestra cómo un controlador legítimo y firmado puede ser armado para obtener acceso a nivel de kernel. 🚨 El controlador vulnerable: wsftprm.sys, firmado por TPZ SOLUCOES DIGITAIS LTDA, y...

CVE-2026-3796

CVE-2026-3796 En QAX Virus Removal, versión del 2025-10-22 y anteriores, el controlador afectado QKSecureIOImp.sys depende de la imagen del proceso llamador para determinar si se le permite comunicarse con el controlador mini filter. Los atacantes podrían suplantar la imagen de un proceso llamado...

CVE-2026-82671

A vulnerability has been found in IObit Unlocker 1.3.0.12. This vulnerability affects the function ZwTerminateProcess in the library IObitUnlocker.sys of the component IRPMJDEVICECONTROL Handler. The manipulation leads to improper privilege management. An attack has to be approached locally. The...

CVE-2026-82671

IObit Unlocker 1.3.0.12 contains a vulnerability in the ZwTerminateProcess function within the IObitUnlocker.sys driver, specifically in the IRP_MJ_DEVICE_CONTROL Handler component. The root cause is improper privilege management . An attacker with local and high-level privileges can exploit this...

EUVD-2026-68456

A vulnerability has been found in IObit Unlocker 1.3.0.12. This vulnerability affects the function ZwTerminateProcess in the library IObitUnlocker.sys of the component IRPMJDEVICECONTROL Handler. The manipulation leads to improper privilege management. An attack has to be approached locally. The...

CVE-2026-82671 IObit Unlocker IRP_MJ_DEVICE_CONTROL IObitUnlocker.sys ZwTerminateProcess privileges management

A vulnerability has been found in IObit Unlocker 1.3.0.12. This vulnerability affects the function ZwTerminateProcess in the library IObitUnlocker.sys of the component IRPMJDEVICECONTROL Handler. The manipulation leads to improper privilege management. An attack has to be approached locally. The...

PT-2026-83774

Name of the Vulnerable Software and Affected Versions IObit Unlocker version 1.3.0.12 Description Improper privilege management occurs within the IRP MJ DEVICE CONTROL Handler component of the IObitUnlocker.sys library. Specifically, the issue resides in the ZwTerminateProcess function. This flaw...

EUVD-2026-10288

A weakness has been identified in Qi-ANXIN QAX Virus Removal up to 2025-10-22. The affected element is the function ZwTerminateProcess in the library QKSecureIOImp.sys of the component Mini Filter Driver. Executing a manipulation can lead to improper access controls. The attack is restricted to...

CVE-2026-3796 Qi-ANXIN QAX Virus Removal Mini Filter Driver QKSecureIO_Imp.sys ZwTerminateProcess access control

A weakness has been identified in Qi-ANXIN QAX Virus Removal up to 2025-10-22. The affected element is the function ZwTerminateProcess in the library QKSecureIOImp.sys of the component Mini Filter Driver. Executing a manipulation can lead to improper access controls. The attack is restricted to...

CVE-2026-3796 Qi-ANXIN QAX Virus Removal Mini Filter Driver QKSecureIO_Imp.sys ZwTerminateProcess access control

A weakness has been identified in Qi-ANXIN QAX Virus Removal up to 2025-10-22. The affected element is the function ZwTerminateProcess in the library QKSecureIOImp.sys of the component Mini Filter Driver. Executing a manipulation can lead to improper access controls. The attack is restricted to...

CVE-2026-3796

CVE-2026-3796 affects Qi-ANXIN QAX Virus Removal (Mini Filter Driver component) via ZwTerminateProcess in QKSecureIO_Imp.sys. The vulnerability arises from a manipulation that enables improper access controls; attack is local and there is publicly available exploit. Multiple trusted sources (NVD,...

QiAnXin QAX Virus Removal 访问控制错误漏洞

QiAnXin QAX Virus Removal is a malware and virus removal tool developed by QiAnXin Corporation. Versions of QiAnXin QAX Virus Removal released on or before October 22, 2025, have a vulnerability related to access control. This vulnerability stems from incorrect operations on the function...

Microsoft Windows Kernel - Local Privilege Escalation (MS06-049)

/ MS06-049 Windows ZwQuerySystemInformation Local Privilege Escalation Vulnerability Exploit Created by SoBeIt Main file of exploit Tested on: Windows 2000 PRO SP4 Chinese Windows 2000 PRO SP4 Rollup 1 Chinese Windows 2000 PRO SP4 English Windows 2000 PRO SP4 Rollup 1 English Usage:ms06-049.exe /...

MS Windows (Windows Kernel) Privilege Escalation Exploit (MS06-049)

Exploit for unknown platform in category local exploits =================================================================== MS Windows Windows Kernel Privilege Escalation Exploit MS06-049 =================================================================== / MS06-049 Windows ZwQuerySystemInformati...

Microsoft Windows Kernel - Local Privilege Escalation (MS06-049)

Microsoft Windows Kernel - Local Privilege Escalation MS06-049 / MS06-049 Windows ZwQuerySystemInformation Local Privilege Escalation Vulnerability Exploit Created by SoBeIt Main file of exploit Tested on: Windows 2000 PRO SP4 Chinese Windows 2000 PRO SP4 Rollup 1 Chinese Windows 2000 PRO SP4...