PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

BYOVD to the next level (part 2) — rootkit like it's 2025

blog.quarkslab.com | research | #windows | #post-exploitation | #kernel | #driver | #byovd | #reflective-loading
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Part two of Quarkslab's BYOVD series: using read/write primitives from a vulnerable driver to reflectively load an unsigned driver from memory and bypass Windows Driver Signature Enforcement.
Published
Collected

Related coverage

High · vulnerability · blog.quarkslab.com
BYOVD to the next level (part 1) — exploiting a vulnerable driver (CVE-2025-8061)
Part one of Quarkslab's BYOVD series: reverse engineering Lenovo's signed LnvMSRIO.sys driver (CVE-2025-8061) and exploiting logical bugs for MSR and physical memory access, leading to LPE.
blog · projectblack.io
Bypassing EDR with Local AI
A pentest shows Claude refuses to build an LSASS dumper, but local DeepSeek and uncensored Qwen models produce a working XOR-encrypted minidumper, making AI-assisted EDR evasion nearly effortless.
tool · github.com
IUM-Debugger: Patching Secure Kernel to Enable Debugging of VTL 1 Isolated User Mode Trustlets
Overcomes signature-enforced boot protections on securekernel.exe to unlock dynamic live debugging of Windows VBS trustlets (e.g., Credential Guard), greatly simplifying reverse engineering and vulnerability research against isolated secure enclaves.
blog · projectzero.google
Windows Drivers are True’ly Tricky
A bug in the TrueCrypt Windows driver, despite prior security audits, lets a normal user or low-integrity sandbox remap the main system drive and elevate privileges to SYSTEM or kernel.
research · blog.quarkslab.com
When too much access is not enough: a story about Confluence and tokens
Quarkslab red team story: after compromising a Confluence host and its database but lacking app credentials, they study the Confluence database structure and API token generation mechanism.
research · blog.quarkslab.com
Post-Exploitation: Abusing the KeePass Plugin Cache
A post-exploitation technique that injects code into KeePass without process injection, by abusing the cache produced when PLGX plugins are compiled.
Back