cwjchoi01/cve-2025-66676Proof-of-concept exploit for CVE-2025-66676 demonstrating arbitrary process termination via IOBit Unlocker kernel driver, with checksum bypass through executable padding.
In IOBit Unlocker 1.3.0.11 and earlier, the application allows arbitrary process termination by trying to unlock a file.
The application is used to unlock a unlocked file. By specifying the process image file of a running process as the locked file, IOBit unlocker will try to kill the running process (the process that "locked" the process image file) from kernel mode. There is a simple control to prevent arbtirary process from interacting with the driver using checksum. This can be bypassed by modifying our exploit executable by adding padding at the end of the executable.
IObitUnlocker.sys at C:\Windows\System32\Drivers\IObitUnlockerKiller in x86IOBitUnlockerKiller.exe) by:
IOBitUnlockerKiller.exe into same directory as patch_exe.pypython3 patche_exe.py IOBitUnlockerKiller.exep.txt (line break separated) and place it in the same directory as IOBitUnlockerKiller.exeIOBitUnlockerKiller.exe as AdministratorThe exploit will run indefinitely by looping over the file specified in p.txt.
Note 1: If you recieve error [-] Failed to Load/Start Driver, run sc stop IOBitUnlocker and sc delete IOBitUnlocker and run the exploit again.
Note 2: The vulnerable driver will not be shared in this project.
patch_exe.pyThe underlying driver of IOBit Unlocker will compare the checksum (alternate checksum and XOR checksum) with a fixed value. The python script will add padding to the exploit executable to make it match the designated value.
check_xor_alt.pyJust a helper script to calucate the alternate and XOR checksum.
This tool is for educational and research purposes only. Use it only on systems you own or have explicit permission to test. The author is not responsible for any misuse or damage caused by this program.
