victoni
Source-scoped identity with 2 associated PoCs and 3 linked vulnerabilities.
Exploit catalog results
Showing 2 PoCs on this page
GitHubvictoni/BYOVD-CVE-2023-52271-POC
Repository PoCStars: 10Created 2026-01-21ExploitCVE-2023-522712 files
Analysis
Technical assessment
C++ exploit for CVE-2023-52271 that opens a handle to the vulnerable wsftprm.sys driver via payload withheld, sends IOCTL payload withheld with a target PID to terminate Protected Process Light (PPL) processes, and continuously scans for and kills a hardcoded list of Microsoft Defender and security processes.
Backdoor review
No backdoor observed in reviewed code
The PoC is a straightforward C++ exploit for CVE-2023-52271 that terminates a hardcoded list of security processes via a vulnerable driver. No backdoor, persistence, credential theft, unrelated payload, or concealed operator-directed harm was observed.
Classification basis and observed behavior
Classification basis
The code actively exploits the vulnerability by opening the driver, sending a crafted IOCTL to terminate processes, and targeting specific security software. It is not a scanner or writeup; it performs the actual exploitation.
README.md:4main.cpp:94-102main.cpp:114-132main.cpp:173-186Requirements
- The vulnerable wsftprm.sys driver must be loaded on the target system.
README.md:4 - The attacker must have sufficient privileges to open a handle to the driver device payload withheld.
main.cpp:94-102
Observed behavior
- Opens a handle to the vulnerable driver via CreateFileW on payload withheld.
main.cpp:94-102 - Sends IOCTL payload withheld with a 1036-byte buffer containing the target PID in the first 4 bytes to terminate a process.
main.cpp:114-132 - Continuously enumerates running processes and terminates any matching a hardcoded list of Microsoft Defender and security executables.
main.cpp:26-53main.cpp:173-186
Behaviors behind the backdoor verdict
Observables
- Target Process List
- Payload withheldThe exploit targets Microsoft Defender and related security processes, consistent with the stated purpose of killing AV/EDR processes.
main.cpp:26-53 - Driver Device Path
- Payload withheldThe PoC opens a handle to the Warsaw_PM device, which is associated with the vulnerable wsftprm.sys driver, matching the CVE description.
main.cpp:94-95 - Ioctl Code
- Payload withheldThe IOCTL code used to trigger the process termination in the vulnerable driver.
main.cpp:123-125
What the analysis did not establish
- Only the two text files (README.md and main.cpp) were reviewed; no binary files were present in the evidence.
- The review does not assess the safety or correctness of the exploit code, only the presence of backdoor or deceptive behavior.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.