Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

BYOVD to the next level (part 2) — rootkit like it's 2025

blog.quarkslab.com | research | #windows | #post-exploitation | #kernel | #driver | #byovd | #reflective-loading

Summary

Part two of Quarkslab's BYOVD series: using read/write primitives from a vulnerable driver to reflectively load an unsigned driver from memory and bypass Windows Driver Signature Enforcement.
Published
Collected

original ↗

Related coverage

  1. Guided tour inside WinDefender’s network inspection driver (blog.quarkslab.com)
  2. BYOVD to the next level (part 1) — exploiting a vulnerable driver (CVE-2025-8061) (blog.quarkslab.com)
  3. Introducing a new section on snapshot fuzzing for kernel-level testing in the Testing Handbook (blog.trailofbits.com)
  4. When too much access is not enough: a story about Confluence and tokens (blog.quarkslab.com)
  5. Reversing Windows Container, episode II: Silo to Server Silo (blog.quarkslab.com)
  6. Post-Exploitation: Abusing the KeePass Plugin Cache (blog.quarkslab.com)

back