
MAL-002
MAL-002: Force System Restart via Installed Windows MSIs

MAL-002: Force System Restart via Installed Windows MSIs
Windows kernel driver utility that abuses vulnerable signed drivers (BYOVD) to bypass DSE, load unsigned drivers, hijack protected processes, and…

LKM rootkit for Linux Kernels 2.6.x/3.x/4.x/5.x/6.x (x86/x86_64 and ARM64)

Post-exploitation and evasion research toolkit for Linux.

Bootkit for Windows Sandbox to disable DSE/PatchGuard.

Scripts for performing and detecting parent PID spoofing

Local PE injection technique using hardware breakpoints and vectored exception handling to manipulate DLL loading and execute arbitrary payloads, as…

Some Rust program I wrote while learning Malware Development

Kernel Process Termination Tool ( CVE-2026-0828 exploit)

A sample POC for CVE-2021-30657 affecting MacOS

POC OF CVE-2022-21970

Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

This is working POC of CVE-2022-36271

A simple PoC demonstrating the vulnerability in the ThrottleStop.sys driver, showcasing arbitrary physical memory read and write capabilities, as…

DLL Hijacking in Quickheal Total Security/ Internet Security/ Antivirus Pro (Installers)

Windows kernel driver experiment based on KasperskyHook that uses direct syscalls for interprocess memory copying, with support for unloading the…

Demonstrates arbitrary file write and privilege escalation in Hasleo Backup Suite Free <= 4.9.4 via symbolic links, enabling attackers to overwrite…

Use cve-2026-36425 killer edr,360 can killer