BYOVD: A journey through weaponizable anti-rootkit drivers

Overview

Approaching kernel exploitation can often lead to a serious headache. Modern operating systems implement a wide range of protection mechanisms designed to safeguard kernel structures (PatchGuard), making low-level attacks increasingly difficult. A common starting point is looking into driver vulnerabilities. Drivers operate in ring-0 and whenever they're flawed, they can provide a pathway into kernel space, potentially resulting in full operating system compromise.

Once a driver vulnerability is abused, you effectively step into “kernel-land” where the system grants a high degree of control. In theory, this could involve actions such as bypassing signature requirements, tampering with protected processes, or interfering with security components such as disabling AntiVirus/EDR. If you’re new to kernel exploitation and want to understand how driver exploitation works, a great learning resource is the HackSys Extreme Vulnerable Driver project: https://github.com/hacksysteam/HackSysExtremeVulnerableDriver.

Before diving deeper, it’s important to understand how drivers receive input. Drivers expose specific IOCTL (Input/Output Control) codes, which define the operations that user-mode applications can request. These IOCTLs form the communication channel between user-land and kernel-land. To make this communication possible, the driver must also expose a symbolic link, typically located under \Device or \DosDevices. Tools like WinObj allow you to inspect these symbolic links quickly and visually.

CVE-2025-60752 – Tinyc-http-server Stack Buffer Overflow

Overview

This write-up covers the discovery of a Stack Buffer Overflow vulnerability in tinyc-http-server. The CVE-2025-60752 allows an attacker to cause a Denial of Service (Crash).

I wrote a Proof of Concept available at https://github.com/zer0matt/CVE-2025-60752

Which is actually a single bash command wrapped inside a shell script.

For more official information, see the CVE entry: CVE-2025-60752.

CVE-2025-60751 – GeographicLib Stack Buffer Overflow

Overview

This write-up covers the discovery of a Stack Buffer Overflow vulnerability in GeographicLib. The CVE-2025-60751 allows an attacker to cause a Denial of Service (Crash) and potentially execute arbitrary code under certain conditions.

I wrote a Proof of Concept available at https://github.com/zer0matt/CVE-2025-60751

For more official information, see the CVE entry: CVE-2025-60751.