CVE-2018-6606

This exploit demonstrates a local privilege escalation vulnerability in MalwareFox AntiMalware 2.74.0.150 by abusing an IOCTL (0x80002010) to register a process as trusted by the driver, then using another IOCTL (0x8000204C) to obtain a full-access handle to winlogon.exe, ultimately injecting shellcode to spawn a SYSTEM shell.

This repository contains a functional exploit for CVE-2018-6606, which leverages a vulnerable driver (ZemanaAntiMalware) to terminate arbitrary processes by PID. The exploit embeds a malicious driver in its resources, loads it as a service, and uses DeviceIoControl to interact with the driver for privilege escalation and process termination.