victoni/BYOVD-CVE-2023-52271-POC

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

C++ exploit for CVE-2023-52271 that opens a handle to the vulnerable wsftprm.sys driver via \\.\Warsaw_PM, sends IOCTL 0x22201C with a target PID to terminate Protected Process Light (PPL) processes, and continuously scans for and kills a hardcoded list of Microsoft Defender and security processes.

Backdoor review

No backdoor observed in reviewed code

The PoC is a straightforward C++ exploit for CVE-2023-52271 that terminates a hardcoded list of security processes via a vulnerable driver. No backdoor, persistence, credential theft, unrelated payload, or concealed operator-directed harm was observed.

ClassificationExploit
Model confidence98%
AuthenticationRequired
LanguagesC++
Target softwarewsftprm.sysTopaz AntifraudMicrosoft DefenderWindows Security
Attack typesBYOVDprocess terminationdefense evasion
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code actively exploits the vulnerability by opening the driver, sending a crafted IOCTL to terminate processes, and targeting specific security software. It is not a scanner or writeup; it performs the actual exploitation.

README.md:4main.cpp:94-102main.cpp:114-132main.cpp:173-186

Requirements

  • The vulnerable wsftprm.sys driver must be loaded on the target system.README.md:4
  • The attacker must have sufficient privileges to open a handle to the driver device \\.\Warsaw_PM.main.cpp:94-102

Observed behavior

  • Opens a handle to the vulnerable driver via CreateFileW on \\.\Warsaw_PM.main.cpp:94-102
  • Sends IOCTL 0x22201C with a 1036-byte buffer containing the target PID in the first 4 bytes to terminate a process.main.cpp:114-132
  • Continuously enumerates running processes and terminates any matching a hardcoded list of Microsoft Defender and security executables.main.cpp:26-53main.cpp:173-186
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Target Process List
MsMpEng.exe, MsMpEngCP.exe, MpDefenderCoreService.exe, MpCmdRun.exe, NisSrv.exe, SecurityHealthService.exe, SecurityHealthHost.exe, SecurityHealthSystray.exe, MsSense.exe, MsSecFw.exe, MsMpSigUpdate.exe, MsMpGfx.exe, MpDwnLd.exe, MpSigStub.exe, MsMpCom.exe, MSASCui.exe, WindowsDefender.exe, WdNisSvc.exe, WinDefend.exe, smartscreen.exeThe exploit targets Microsoft Defender and related security processes, consistent with the stated purpose of killing AV/EDR processes.main.cpp:26-53
Driver Device Path
\\.\Warsaw_PMThe PoC opens a handle to the Warsaw_PM device, which is associated with the vulnerable wsftprm.sys driver, matching the CVE description.main.cpp:94-95
Ioctl Code
0x22201CThe IOCTL code used to trigger the process termination in the vulnerable driver.main.cpp:123-125
Review boundaries

What the analysis did not establish

  • Only the two text files (README.md and main.cpp) were reviewed; no binary files were present in the evidence.
  • The review does not assess the safety or correctness of the exploit code, only the presence of backdoor or deceptive behavior.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1