STProcessMonitorBYOVD

Reference: https://bbs.kafan.cn/thread-2288675-1-1.html

Usage:

1. Place the vulnerable driver under the same directory of the exe. The version 11.11.4.0 (the older one) is with CVE-2025-70795 / CVE-2026-0828, compatible with the parameter /Kill; The version 11.26.18 (Updated) is compatible with parameter /Terminate.

2. /Init - Install the driver. /Kill - Use CVE-2025-70795 / CVE-2026-0828 to terminate processes. /Terminate - Use the updated driver to terminate processes. /Uninst - Unload the driver.

Screenshots

Exploit CVE-2025-70795 / CVE-2026-0828 (Please notice that the '/Kill' operate is without any priviledge)

The updated driver verifys if the control code is from an NT AUTHORITY\SYSTEM process, so we need to get at least Administrator priviledge to use the new driver.