Skip to content
KitploitKITPLOIT
工具博客
提交
工具博客
提交

黑客、渗透测试和网络安全工具，武装您的安全武器库！

Kitploit 是一个黑客、网络安全和渗透测试工具的目录。发现最新的项目更新，查找漏洞、分析系统、自动化测试并加强你的安全。

··订阅源·联系·隐私·© 2026 Kitploit

工具目录

分类

查看所有分类
Loading categories
HackSysExtremeVulnerableDriver — HackSys Extreme Vulnerable Driver (HEVD) - Windows 与 Linux | Kitploit
工具/GitHubGitHub/hacksysteam/hacksysextremevulnerabledriver
漏洞分析学习与教育二进制利用实验室与实践
GitHubhacksysteam/hacksysextremevulnerabledriver

HackSysExtremeVulnerableDriver

HackSys Extreme Vulnerable Driver (HEVD) - Windows 与 Linux

查看仓库

最受欢迎

查看全部 →

发现我们社区最常用的工具。

探索所有工具

浏览我们的工具集合

查看所有工具 →
分享
网站
3.1k58451年前Kitploit 审核通过

HackSys Extreme Vulnerable Driver

root@kitploit:~
           ooooo   ooooo oooooooooooo oooooo     oooo oooooooooo.   
           `888'   `888' `888'     `8  `888.     .8'  `888'   `Y8b  
            888     888   888           `888.   .8'    888      888 
            888ooooo888   888oooo8       `888. .8'     888      888 
            888     888   888    "        `888.8'      888      888 
            888     888   888       o      `888'       888     d88' 
           o888o   o888o o888ooooood8       `8'       o888bood8P'

Black Hat Arsenal Appveyor Build Status GitHub all Releases Twitter Follow Mastodon Follow Discord Server

HackSys Extreme Vulnerable Driver（HEVD） 是一个Windows内核驱动程序，故意包含多个安全漏洞。它专为安全研究人员和爱好者设计，旨在提升他们在内核级漏洞利用方面的技能。

HEVD 提供了一系列漏洞类型，从简单的栈缓冲区溢出到更复杂的问题，如释放后使用（Use-After-Free）、池缓冲区溢出和竞争条件（Race Condition）。这使研究人员能够探索每种已实现漏洞的利用技术。

Black Hat Arsenal 2016

  • 演示文稿
  • 白皮书

博客文章

  • http://www.payatu.com/hacksys-extreme-vulnerable-driver/

外部利用

  • https://github.com/wetw0rk/Exploit-Development/tree/master/HEVD-Exploits
  • https://github.com/sam-b/HackSysDriverExploits
  • https://github.com/sizzop/HEVD-Exploits
  • https://github.com/badd1e/bug-free-adventure
  • https://github.com/FuzzySecurity/HackSysTeam-PSKernelPwn
  • https://github.com/theevilbit/exploits/tree/master/HEVD
  • https://github.com/GradiusX/HEVD-Python-Solutions
  • http://pastebin.com/ALKdpDsF
  • https://github.com/Cn33liz/HSEVD-StackOverflow
  • https://github.com/Cn33liz/HSEVD-StackOverflowX64
  • https://github.com/Cn33liz/HSEVD-StackCookieBypass
  • https://github.com/Cn33liz/HSEVD-ArbitraryOverwrite
  • https://github.com/Cn33liz/HSEVD-ArbitraryOverwriteGDI
  • https://github.com/Cn33liz/HSEVD-StackOverflowGDI
  • https://github.com/Cn33liz/HSEVD-ArbitraryOverwriteLowIL
  • https://github.com/mgeeky/HEVD_Kernel_Exploit
  • https://github.com/tekwizz123/HEVD-Exploit-Solutions
  • https://github.com/FULLSHADE/Windows-Kernel-Exploitation-HEVD

外部博客文章

  • https://wetw0rk.github.io/posts/0x00-introduction-to-windows-kernel-exploitation/
  • https://wetw0rk.github.io/posts/0x00-introducci%C3%B3n-a-windows-kernel-explotaci%C3%B3n/
  • https://wetw0rk.github.io/posts/0x01-killing-windows-kernel-mitigations/
  • https://wetw0rk.github.io/posts/0x01-mat%C3%A1ndo-windows-kernel-mitigaciones/
  • https://wetw0rk.github.io/posts/0x02-introduction-to-windows-kernel-uafs/
  • https://wetw0rk.github.io/posts/0x02-introducci%C3%B3n-a-windows-kernel-uafs/
  • https://wetw0rk.github.io/posts/0x03-approaching-the-modern-windows-kernel-heap/
  • https://wetw0rk.github.io/posts/0x03-acerc%C3%A1ndose-al-heap-moderno-del-windows-kernel/
  • https://wetw0rk.github.io/posts/0x04-writing-what-where-in-the-kernel/
  • https://wetw0rk.github.io/posts/0x04-escribiendo-que-donde-en-el-kernel/
  • https://wetw0rk.github.io/posts/0x05-introduction-to-windows-kernel-type-confusion-vulnerabilities/
  • https://wetw0rk.github.io/posts/0x05-introducci%C3%B3n-a-windows-kernel-type-confusion-vulnerabilidades/
  • https://wetw0rk.github.io/posts/0x06-approaching-modern-windows-kernel-type-confusions/
  • https://wetw0rk.github.io/posts/0x06-acerc%C3%A1ndose-a-windows-kernel-type-confusions-modernos/

作者

Ashfaq Ansari

ashfaq[at]hacksys[dot]io

博客 | @HackSysTeam

HackSys Inc

https://hacksys.io/

截图

驱动程序横幅

帮助

漏洞利用

驱动程序调试输出

已实现的漏洞

  • 写入NULL
  • 双重获取（Double Fetch）
  • 缓冲区溢出
    • 栈
    • 栈 GS
    • 非分页池（NonPagedPool）
    • 非分页池NX（NonPagedPoolNx）
    • 分页池会话（PagedPoolSession）
  • 释放后使用（Use After Free）
    • 非分页池
    • 非分页池NX
  • 类型混淆（Type Confusion）
  • 整数溢出
    • 算术溢出
  • 内存泄露（Memory Disclosure）
    • 非分页池
    • 非分页池NX
  • 任意递增（Arbitrary Increment）
  • 任意覆盖（Arbitrary Overwrite）
  • 空指针解引用（Null Pointer Dereference）
  • 未初始化内存
    • 栈
    • 非分页池
  • 不安全的内核资源访问（Insecure Kernel Resource Access）

构建驱动程序

  1. 安装 Visual Studio 2017
  2. 安装 Windows 驱动程序工具包（WDK）
  3. 运行相应的驱动程序构建脚本：Build_HEVD_Vulnerable_x86.bat 或 Build_HEVD_Vulnerable_x64.bat

下载

如果你不想从头构建 HackSys Extreme Vulnerable Driver，可以下载最新版本的预构建可执行文件：

https://github.com/hacksysteam/HackSysExtremeVulnerableDriver/releases

安装驱动程序

使用 OSR Driver Loader 安装 HackSys Extreme Vulnerable Driver

测试

HackSys Extreme Vulnerable Driver 及其对应的利用程序已在 Windows 7 SP1 x86 和 Windows 10 x64 上测试通过。

已举办的会议

  • Windows 内核漏洞利用 1
  • Windows 内核漏洞利用 2
  • Windows 内核漏洞利用 3
  • Windows 内核漏洞利用 4
  • Windows 内核漏洞利用 5
  • Windows 内核漏洞利用 6
  • Windows 内核漏洞利用 7

已举办的工作坊

  • Windows 内核漏洞利用 Humla 浦那站
  • Windows 内核漏洞利用 Humla 孟买站

Linux 版 HEVD

Linux HEVD 驱动程序横幅

Linux HEVD 驱动程序安装器

Linux HEVD 驱动程序 IOCTL 测试

Linux HEVD 驱动程序 IOCTL 日志

许可

请参阅 LICENSE 文件了解复制许可信息。

贡献指南

请参阅 CONTRIBUTING.md 文件了解贡献指南。

待办事项与错误报告

请通过 GitHub 问题跟踪器提交任何改进请求或错误报告，地址如下：https://github.com/hacksysteam/HackSysExtremeVulnerableDriver/issues

致谢

感谢以下这些出色的人们：🎉

HackSys Inc

下载工具
  • https://github.com/w4fz5uck5/3XPL01t5/tree/master/OSEE_Training
  • https://wetw0rk.github.io/posts/0x07-introduction-to-windows-kernel-race-conditions/
  • https://wetw0rk.github.io/posts/0x07-introducci%C3%B3n-a-windows-kernel-race-conditions/
  • https://wetw0rk.github.io/posts/0x08-modern-windows-kernel-race-conditions/
  • https://wetw0rk.github.io/posts/0x08-race-conditions-moderno-del-windows-kernel/
  • https://wetw0rk.github.io/posts/0x09-return-of-the-stack-overflow/
  • https://wetw0rk.github.io/posts/0x09-el-regreso-del-stack-overflow/
  • http://niiconsulting.com/checkmate/2016/01/windows-kernel-exploitation/
  • http://samdb.xyz/2016/01/16/intro_to_kernel_exploitation_part_0.html
  • http://samdb.xyz/2016/01/17/intro_to_kernel_exploitation_part_1.html
  • http://samdb.xyz/2016/01/18/intro_to_kernel_exploitation_part_2.html
  • http://samdb.xyz/2017/06/22/intro_to_kernel_exploitation_part_3.html
  • https://sizzop.github.io/2016/07/05/kernel-hacking-with-hevd-part-1.html
  • https://sizzop.github.io/2016/07/06/kernel-hacking-with-hevd-part-2.html
  • https://sizzop.github.io/2016/07/07/kernel-hacking-with-hevd-part-3.html
  • https://sizzop.github.io/2016/07/08/kernel-hacking-with-hevd-part-4.html
  • https://www.fuzzysecurity.com/tutorials/expDev/14.html
  • https://www.fuzzysecurity.com/tutorials/expDev/15.html
  • https://www.fuzzysecurity.com/tutorials/expDev/16.html
  • https://www.fuzzysecurity.com/tutorials/expDev/17.html
  • https://www.fuzzysecurity.com/tutorials/expDev/18.html
  • https://www.fuzzysecurity.com/tutorials/expDev/19.html
  • https://www.fuzzysecurity.com/tutorials/expDev/20.html
  • http://dokydoky.tistory.com/445
  • https://hshrzd.wordpress.com/2017/05/28/starting-with-windows-kernel-exploitation-part-1-setting-up-the-lab/
  • https://hshrzd.wordpress.com/2017/06/05/starting-with-windows-kernel-exploitation-part-2/
  • https://hshrzd.wordpress.com/2017/06/22/starting-with-windows-kernel-exploitation-part-3-stealing-the-access-token/
  • https://osandamalith.com/2017/04/05/windows-kernel-exploitation-stack-overflow/
  • https://osandamalith.com/2017/06/14/windows-kernel-exploitation-arbitrary-overwrite/
  • https://osandamalith.com/2017/06/22/windows-kernel-exploitation-null-pointer-dereference/
  • http://dali-mrabet1.rhcloud.com/windows-kernel-exploitation-arbitrary-memory-overwrite-hevd-challenges/
  • https://blahcat.github.io/2017/08/31/arbitrary-write-primitive-in-windows-kernel-hevd/
  • https://klue.github.io/blog/2017/09/hevd_stack_gs/
  • https://glennmcgui.re/introduction-to-windows-kernel-exploitation-pt-1/
  • https://glennmcgui.re/introduction-to-windows-kernel-driver-exploitation-pt-2/
  • https://kristal-g.github.io/2021/02/07/HEVD_StackOverflowGS_Windows_10_RS5_x64.html
  • https://kristal-g.github.io/2021/02/20/HEVD_Type_Confusion_Windows_10_RS5_x64.html
  • https://wafzsucks.medium.com/hacksys-extreme-vulnerable-driver-arbitrary-write-null-new-solution-7d45bfe6d116
  • https://wafzsucks.medium.com/how-a-simple-k-typeconfusion-took-me-3-months-long-to-create-a-exploit-f643c94d445f
  • https://mdanilor.github.io/posts/hevd-0/
  • https://mdanilor.github.io/posts/hevd-1/
  • https://mdanilor.github.io/posts/hevd-2/
  • https://mdanilor.github.io/posts/hevd-3/
  • https://mdanilor.github.io/posts/hevd-4/