Safetica ProcessMonitorDriver.sys IOCTL Privilege Bypass for Protected Process Termination

This repository is a compact two-file Windows local privilege escalation/BYOVD proof of concept for CVE-2026-0828 affecting Safetica ProcessMonitorDriver.sys. The structure is simple: README.md documents the vulnerability, affected/fixed versions, build and usage steps, and exploit.c contains the full exploit implementation. The code is standalone C, not tied to a larger exploitation framework. The exploit has two main phases. First, it abuses the vulnerable driver device \\.\STProcessMonitorDriver by sending IOCTL 0xB822200C with attacker-supplied PIDs. The driver reportedly calls ZwOpenProcess(PROCESS_ALL_ACCESS) and ZwTerminateProcess in kernel context without validating caller privileges, allowing arbitrary process termination and bypass of Protected Process Light. The PoC enumerates running processes and attempts to kill a hardcoded list of security products including Microsoft Defender components, CrowdStrike Falcon, SentinelOne, and SafeticaAgent. Second, after reducing defenses, the exploit performs local privilege escalation to SYSTEM entirely from user mode: it enables SeDebugPrivilege in the current token, locates winlogon.exe, opens its token, duplicates it as a primary token, and launches cmd.exe with CreateProcessWithTokenW on the interactive desktop winsta0\default. The end result is an interactive NT AUTHORITY\SYSTEM shell. Operationally, this is a real exploit rather than a detector. It requires local admin rights to load/start the vulnerable driver and access to a Windows system where the vulnerable Safetica driver is present. The payload is basic but functional and hardcoded, so OPERATIONAL is the best maturity fit rather than WEAPONIZED.

This repository is a small Windows BYOVD-focused project with 11 files: one C source file, one C header, and supporting Markdown documentation. Despite README claims that it is only safe reconnaissance, the actual code in src/0xPoC.c is an operational local exploit for Safetica ProcessMonitorDriver.sys (CVE-2026-0828). The program opens the device \\.\STProcessMonitorDriver, enumerates running processes via Toolhelp32 APIs, compares process names against a hardcoded security-product target list from src/0xtargets.h, and for each match sends DeviceIoControl with IOCTL 0xB822200C and a 64-bit PID. Successful execution results in kernel-assisted termination of targeted AV/EDR processes. Repository structure: src/0xPoC.c is the main exploit entry point; src/0xtargets.h contains the hardcoded kill list (Defender, CrowdStrike, SentinelOne, Carbon Black, Cylance, McAfee, Symantec/Norton, Kaspersky, ESET, Bitdefender, Sophos, Malwarebytes, Safetica, etc.). The remaining files are documentation: README.md describes BYOVD research themes; drivers/0xhashes.md lists hashes, device symlink, and IOCTL details for Safetica; research/0xsafetica-cve-2026-0828.md and research/0xthrottlestop-medusalocker.md summarize two vulnerable-driver cases; docs/0xmitigations.md provides defensive guidance. Main exploit capability: local post-compromise abuse of a vulnerable signed Windows driver to kill protected or security-relevant processes. There is no network communication, persistence, or shell payload. The exploit is dependent on the vulnerable driver already being present and started as a service. The code is straightforward and hardcoded rather than modular, so OPERATIONAL is the best maturity fit rather than WEAPONIZED.

This repository is a small Visual Studio C++ Windows project named KillChain that acts as a user-mode controller for an embedded vulnerable kernel driver. The structure is straightforward: KillChain.sln and KillChain.vcxproj define the build, KillChain.cpp contains the main program logic and CLI handling, Logger.h implements colored/file logging and banner output, and LoadDriver.h contains the driver extraction, privilege adjustment, service creation/loading, unload, and cleanup logic. The project references an embedded driver blob via driverBytes.h, but that file content is not included in the provided archive listing. Core capability: the executable loads an embedded .sys driver into the Windows kernel, opens the device \\.\STProcessMonitorDriver, and repeatedly sends IOCTL 0xB822200C with a target PID. The target can be supplied directly with --pid or resolved repeatedly from a process name with --name, allowing the tool to wait for and kill a process when it appears. The code loops for up to 360 seconds, sleeping 2 seconds between attempts, and logs successes/failures. This is not a scanner or detector; it is an active local exploitation/abuse utility intended to leverage a vulnerable driver to terminate processes, including protected ones. A secondary capability is defense impairment. If --disable-defender is supplied, after at least two successful terminations the program writes multiple policy values under HKLM\SOFTWARE\Policies\Microsoft\Windows Defender and its Real-Time Protection subkey, setting DisableAntiSpyware and several Disable* monitoring/protection values to 1. This is a persistence/evasion-oriented post-exploitation action rather than part of the kernel exploit itself. Driver lifecycle handling is fairly complete. LoadDriver.h enables SeLoadDriverPrivilege, extracts the embedded driver to %TEMP%\EmbeddedDriverService.sys, uses native APIs from ntdll.dll (NtLoadDriver/NtUnloadDriver) against \Registry\Machine\System\CurrentControlSet\Services\EmbeddedDriverService, checks whether the driver is present in memory via EnumDeviceDrivers, and provides an uninstall path that unloads the driver, removes service artifacts, and deletes the temporary driver file. That makes the tool operational rather than a bare proof of concept. No network communication, C2, or remote endpoints are present. The attack vector is local on Windows and depends on administrative rights and kernel driver loading privileges. The claimed target in comments is ProcessMonitorDriver.sys associated with CVE-2026-0828, though the actual exploit path shown here is generic vulnerable-driver abuse through a custom device interface rather than memory corruption code in user mode.

Repository purpose/structure: - Visual Studio C++ solution implementing a local Windows BYOVD-style utility named STProcessMonitorBYOVD. - Core files: - STProcessMonitorBYOVD/Main.cpp: CLI entry point implementing driver load/unload and process termination actions. - STProcessMonitorBYOVD/Service.cpp: helper routines to create/start/stop/delete a kernel driver service via SCM. - STProcessMonitorBYOVD/FindProcess.cpp: enumerates processes via Toolhelp32 to resolve PIDs by process name. - STProcessMonitorBYOVD/TokenAdjust.cpp: enables SeDebugPrivilege (and SeTcbPrivilege, though unused in Main.cpp) for token/process access. - STProcessMonitorBYOVD/Struct.h + Functions.h: shared declarations. - Project includes two driver binaries as non-code artifacts: STProcessMonitor.sys and STProcessMonitorNew.sys. Exploit capabilities (what it actually does): - Driver installation (local): /Init computes the driver path as <exe_dir>\\STProcessMonitor.sys and installs it as a demand-start kernel driver service named "STProcessMonitor" using CreateServiceW + StartService. - Driver removal: /Uninst stops and deletes the service. - Arbitrary process termination via driver IOCTLs: - /Kill <names...>: opens device \\.\STProcessMonitorDriver and for each provided process name, finds all matching PIDs and sends IOCTL 0xB822200C with a TerminateProcessInfo{ProcessId=<pid>} buffer. - /Terminate <names...>: if already running as SYSTEM, performs the same PID-by-name loop but uses IOCTL 0xB822A00C. - Self-elevation to SYSTEM (local token theft): if not SYSTEM in /Terminate mode, it enables SeDebugPrivilege, locates a SYSTEM-owned winlogon.exe instance, duplicates its token (DuplicateTokenEx) and relaunches the current command line with CreateProcessWithTokenW to obtain a SYSTEM process, then expects the user to re-run/continue under SYSTEM. Notable targeting indicators: - README claims relation to CVE-2025-70795 and CVE-2026-0828, but the code itself is a generic BYOVD driver-control utility: it relies on a bundled driver exposing a known device name and IOCTLs to terminate processes. Network activity: - None in code. No HTTP/DNS/IP endpoints; all interaction is local (SCM + device IOCTL + process/token APIs).

Repository purpose: a Windows C++ console tool demonstrating BYOVD (Bring Your Own Vulnerable Driver) abuse of the STProcessMonitor driver to terminate arbitrary processes, referencing CVE-2025-70795. It supports loading/unloading the driver as a kernel service and sending crafted IOCTLs to the driver’s device object to kill processes by PID resolved from process names. Key capabilities (from Main.cpp and helpers): - Driver service management: /Init creates a SERVICE_KERNEL_DRIVER service named "STProcessMonitor" pointing to a driver file expected next to the EXE ("\STProcessMonitor.sys"), then starts it (Service.cpp). /Uninst stops and deletes the service. - Process discovery: FindProcess.cpp enumerates processes via Toolhelp32 snapshot and returns all PIDs matching a provided executable name (case-insensitive). - Process termination via driver IOCTL: - /Kill <names...>: opens the device "\\.\STProcessMonitorDriver" and for each matching PID sends DeviceIoControl with code 0xB822200C and a small input struct containing the PID handle. README claims this path works “without any privilege” with driver version 11.11.4.0 (CVE-2025-70795). - /Terminate <names...>: intended for an updated driver (README mentions 11.26.18) that checks the caller is NT AUTHORITY\SYSTEM. The program first checks if it is already SYSTEM; if yes, it sends IOCTL 0xB822A00C to terminate processes. - Local privilege escalation to SYSTEM (to satisfy updated driver checks): if not SYSTEM, the tool enables SeDebugPrivilege, locates a SYSTEM-owned winlogon.exe, duplicates its token (DuplicateTokenEx), and relaunches itself with CreateProcessWithTokenW using the same command line. This is a token-theft style elevation that typically requires Administrator/SeDebugPrivilege. Repository structure: - STProcessMonitorBYOVD/Main.cpp: primary entry point implementing CLI parsing and the IOCTL abuse + SYSTEM relaunch logic. - STProcessMonitorBYOVD/Service.cpp: SCM routines to create/start/stop/delete the kernel driver service. - STProcessMonitorBYOVD/FindProcess.cpp: PID lookup by process name. - STProcessMonitorBYOVD/TokenAdjust.cpp: privilege enabling helpers (SeDebugPrivilege, SeTcbPrivilege though SeTcb is not used in Main.cpp). - STProcessMonitorBYOVD/Struct.h + Functions.h: shared declarations. - Visual Studio solution/project files; project references two driver binaries (STProcessMonitor.sys and STProcessMonitorNew.sys), though the runtime path in code expects STProcessMonitor.sys in the EXE directory. Overall, this is a local Windows BYOVD exploit utility (not a network exploit) focused on abusing a vulnerable/abusable driver interface to terminate protected processes, with an added SYSTEM token duplication step for newer driver versions that restrict IOCTL callers.

Repository purpose: BYOVD research focused on Windows vulnerable signed drivers, with documentation plus a working user-mode PoC that abuses Safetica’s ProcessMonitorDriver.sys (CVE-2026-0828) to terminate processes via a vulnerable IOCTL. Structure (11 files): - Documentation-heavy: README.md, SECURITY.md, docs/0xmitigations.md (defensive guidance), research/*.md (case studies/patterns), drivers/0xhashes.md (hashes and sources for ProcessMonitorDriver.sys). - Code: src/0xPoC.c (main program) and src/0xtargets.h (hardcoded list of security product process names). Main exploit capability (src/0xPoC.c): - Opens the device interface `\\.\STProcessMonitorDriver` with read/write access. - Enumerates processes using Toolhelp32 APIs (CreateToolhelp32Snapshot / Process32First/Next). - For each process whose name matches the list in 0xtargets.h (Defender, CrowdStrike, SentinelOne, etc.), sends `DeviceIoControl` with IOCTL `0xB822200C` and an 8-byte PID (UINT64). - Reports per-target success/failure and totals. This is an AV/EDR “kill” primitive implemented through a vulnerable driver (BYOVD), not merely reconnaissance. Targeting notes: - CVE-2026-0828: Safetica ProcessMonitorDriver.sys, versions 10.5.75.0 and 11.11.4.0; unprivileged IOCTL path allows arbitrary process termination. - CVE-2025-7771: ThrottleStop.sys is discussed in research notes only (no code in repo for that chain), including device `\\.\ThrottleStop` and example IOCTLs in narrative. Notable observables for defenders: - Device name: `\\.\STProcessMonitorDriver` (and referenced `\\.\ThrottleStop`). - IOCTL: `0xB822200C` used for termination. - Process target list in src/0xtargets.h can be used as an indicator of intent (EDR/AV neutralization). Sanity: Despite README claims of “zero working exploits,” the included C program does implement an operational IOCTL-based process termination routine against the Safetica driver, contingent on the vulnerable driver being present and loaded.

Repository purpose: BYOVD research PoC from KOSEC demonstrating abuse of a Safetica kernel driver to bypass privilege/policy by terminating arbitrary processes. Structure: - README.md: top-level project description (BYOVD research). - Safetica/README.md: vulnerability overview, affected versions/hashes, tested Windows builds, instructions to compile (cl poc.c), install/load the driver via sc.exe, and where to obtain the vulnerable driver (ProcessMonitorDriver.sys under C:\Program Files\Safetica\). - Safetica/src/poc.c: Windows C PoC that opens the device \\.\STProcessMonitorDriver and sends IOCTL 0xB822200C with an 8-byte PID input buffer. Exploit capabilities: - Local user-mode program that communicates with the Safetica ProcessMonitorDriver.sys device interface. - Accepts a PID from stdin and issues a single IOCTL intended to kill that process. - Practical impact is arbitrary process termination via a signed/installed driver (BYOVD-style), which can be leveraged to disable security tools or bypass protections, but it does not include code for privilege escalation beyond the process-kill primitive, nor persistence, lateral movement, or network C2. No network communication is present; the key fingerprintable artifacts are the device name (\\.\STProcessMonitorDriver), IOCTL code (0xB822200C), service name (STProcessMonitor), and driver path/name (ProcessMonitorDriver.sys).