Xavi Beltran Exploits and Proofs of Concept

Showing 5 PoCs on this page

ExploitDB

Throttlestop Kernel Driver - Kernel Out-of-Bounds Write Privilege Escalation

ExploitDB exploitPublished 2026-04-22ExploitCVE-2025-77711 file

EDB-52512

Analysisdeepseek-v4-pro:cloud · 2026-08-08

Technical assessment

C source code that installs the vulnerable ThrottleStop.sys driver, opens a handle to it, and uses the exposed IOCTL (0x8000645C) to perform arbitrary physical memory reads and writes. It walks the EPROCESS list to locate lsass.exe, then writes zeros to its Protection and SignatureLevel fields to disable PPL, and finally injects a DLL into LSASS via AddSecurityPackageA.

Backdoor review

No backdoor observed in reviewed code

The PoC is a standard local privilege escalation exploit that uses a vulnerable driver to disable LSASS process protection and then loads a DLL via AddSecurityPackageA. No concealed backdoor, unrelated remote access, persistence, or credential exfiltration logic was observed. The code performs only the documented exploit steps.

ClassificationExploit

Model confidence98%

AuthenticationNot required

LanguagesC

Target softwareThrottleStop.sysWindows kernel

Attack typesprivilege escalationarbitrary kernel writePPL bypass

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The code actively exploits the vulnerability by sending the vulnerable IOCTL to perform physical memory writes that disable LSASS protections and then injects a DLL. This is a full privilege escalation exploit, not merely a scanner or writeup.

exploits/windows/local/52512.txt:1-248

Requirements

Local execution on a Windows system where the vulnerable ThrottleStop.sys driver can be loaded (e.g., via service creation).exploits/windows/local/52512.txt:150-191
Ability to create a kernel service (requires Administrator or equivalent privileges).exploits/windows/local/52512.txt:160-176

Observed behavior

Creates a kernel service to load the ThrottleStop.sys driver from C:\Users\Public\a.sys.exploits/windows/local/52512.txt:156-191
Opens a handle to the ThrottleStop device and sends IOCTL 0x8000645C to map physical memory for arbitrary read/write.exploits/windows/local/52512.txt:196-212exploits/windows/local/52512.txt:55-89exploits/windows/local/52512.txt:91-125
Reads the ntoskrnl.exe base address and uses it to locate the System EPROCESS, then walks the ActiveProcessLinks list to find the lsass.exe EPROCESS.exploits/windows/local/52512.txt:193-233
Writes 0 to the Protection (offset 0x6ca) and SignatureLevel (offset 0x6c8) fields of the lsass.exe EPROCESS to disable PPL.exploits/windows/local/52512.txt:237-240
Calls AddSecurityPackageA to load ntssp.dll into the LSASS process, achieving code injection.exploits/windows/local/52512.txt:243-245

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior: Payload withheldThis is the intended exploit payload for privilege escalation and credential dumping, consistent with the CVE description.exploits/windows/local/52512.txt:237-245
Driver Installation: Payload withheldStandard method to load the vulnerable driver for exploitation.exploits/windows/local/52512.txt:156-191
Ioctl Usage: Payload withheldMatches the documented vulnerability in ThrottleStop.sys.exploits/windows/local/52512.txt:19exploits/windows/local/52512.txt:75-79

Review boundaries

What the analysis did not establish

The evidence is the complete source code of the exploit; no external dependencies (e.g., superfetch library) are provided, so the code cannot be compiled or executed from this artifact alone.
The analysis treats the code as untrusted data and does not verify its correctness or safety.
Only the supplied text file was reviewed; no binary files were present.
The DLL loaded (ntssp.dll) is a standard Windows SSP DLL; its behavior is not analyzed, but its use is a known post-exploitation technique for credential access.
The driver file (a.sys) is not included in the evidence; its contents are not verified.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

ExploitDB