
CVE-2022-22077
BYOVD exploitation framework for CVE-2022-22077 targeting RTCore64.sys. Demonstrates kernel token theft, privilege escalation to SYSTEM, and C2…

BYOVD exploitation framework for CVE-2022-22077 targeting RTCore64.sys. Demonstrates kernel token theft, privilege escalation to SYSTEM, and C2…

PoC for WinNotify, demonstrated through a driver mapper, and local privilege escalation.

Simple Kernel Mode Driver for Swapping Process Token

Windows rootkit for Intel x64 with 25+ features, demonstrating rootkit techniques compatible with all Windows 10 and Windows 11 versions.

C# tool for LSASS minidump with multiple evasion techniques including indirect syscalls, ETW patching, and PPL bypass via driver or WER fault.…

Proof-of-concept exploit for CVE-2026-0828, a BYOVD vulnerability in Safetica ProcessMonitorDriver.sys allowing unprivileged termination of…

Kernel Process Termination Tool ( CVE-2026-0828 exploit)

Windows LPE PoC exploiting the AsInsHelp64.sys driver via arbitrary physical memory read/write to overwrite kernel tokens and gain SYSTEM privileges.

Proof-of-concept BYOVD exploit targeting kprocesshacker.sys driver to kill or suspend processes with kernel-level privileges on Windows systems.

Proof-of-concept exploit for CVE-2024-26229, a Windows kernel privilege escalation vulnerability targeting specific system components for local…

Weaponizes vulnerable signed drivers to bypass EDR kernel callbacks, object callbacks, ETW TI provider, and userland hooks for LSASS memory dumping…

Kernel Arbitrary Read Vulnerability + Superfetch EOP based on reacher from https://starlabs.sg/blog/2022/06-trying-to-exploit-a-windows-kernel-arbitra…

Windows kernel driver that removes Process Protection (PP) and Process Protection Light (PPL).

Exploit code for CVE-2020-17086, a Windows kernel privilege escalation vulnerability.

:palm_tree:Linux、macOS、Windows Kernel privilege escalation vulnerability collection, with compilation environment, demo GIF map, vulnerability…

Dumping LSASS with a duplicated handle from custom LSA plugin

Windows UAC bypass tool using whitelist-based technique to elevate privileges silently, compatible with Cobalt Strike payloads for post-exploitation…

A PoC for Mhyprot2.sys vulnerable driver that allowing read/write memory in kernel/user via unprivileged user process.