CVE-2025-60709/
├── CVE-2025-60709.c    (5.3 KB, 157 líneas) — Exploit C original
├── CVE-2025-60709.go   (9.2 KB, 285 líneas) — Port Go (demo educativa)
└── README.txt          (4.2 KB, 132 líneas) — Documentación original

┌─────────────────────────────────────────────────────────────┐
│                    CVE-2025-60709 LPE                       │
└─────────────────────────────────────────────────────────────┘

[1] EVASIÓN DE DEFENSAS
    ├─ KillETW()   → Parchea EtwEventWrite en ntdll con RET (0xC3)
    └─ KillAMSI()  → Parchea AmsiScanBuffer en amsi.dll con RET (0xC3)

[2] HEAP GROOMING (preparación de memoria)
    └─ GroomLookaside()
       ├─ Crea 4096 archivos: C:\Windows\Temp\groom_00000.blf
       ├─ Llama CreateLogFile() + AddLogContainer() por cada uno
       └─ Agota lookaside lists → garantiza layout de heap predecible

[3] PRIMITIVA DE ESCRITURA ARBITRARIA — ClfsArbWrite(Address, Value)
    ├─ Construye buffer CLFS malformado (0x102010 bytes)
    │    ├─ Firma válida CLFS en +0x00: 0x0201
    │    ├─ Sector size shift en +0x14: 2
    │    ├─ First client region en +0x28: 0x100
    │    ├─ cbRecord OVERSIZED en +0x100: 0xFF00 (64 KB > datos reales)
    │    ├─ Marcador shadow zone en +0x9A8: 0x13371337
    │    └─ CClfsContainerContext falso en offset (0xFF00 + 0x100):
    │         ├─ pContainer = TargetAddress - 0x10
    │         └─ cbContainer = Value (dato a escribir)
    ├─ Calcula checksum CLFS correcto (driver lo valida)
    ├─ Escribe contenedor malformado → C:\Windows\Temp\evil.blf
    ├─ Crea log apuntando a evil.blf
    ├─ Llama ClfsReadRestartArea() → dispara parsing kernel
    └─ Driver desborda buffer → escribe Value en Address ✓

[4] ROBO DE TOKEN SYSTEM
    ├─ Lee EPROCESS del proceso SYSTEM via PsInitialSystemProcess
    └─ Extrae token en EPROCESS + EPROCESS_TOKEN (offset 0x4c0)

[5] ESCALACIÓN DE PRIVILEGIOS
    └─ ClfsArbWrite(CurrentEprocess + 0x4c0, SystemToken)
       └─ Sobreescribe token del proceso actual con token SYSTEM ✓

[6] EJECUCIÓN DE PAYLOAD C2
    ├─ VirtualAlloc(PAGE_EXECUTE_READWRITE)
    ├─ Copia shellcode beacon de 1789 bytes
    ├─ CreateThread() → ejecución como NT AUTHORITY\SYSTEM
    └─ Beacon C2: IPv6 + DoH → fallback Gmail drafts
       └─ sRDI + sleep obfuscation + ETW/AMSI ya parcheados

[7] PERSISTENCIA
    └─ Sleep(INFINITE) → proceso mantiene token SYSTEM

Contenedor CLFS legítimo:
  [Header 0x100 bytes][Record: cbRecord bytes de datos reales]

Contenedor malformado (evil.blf):
  [Header válido][cbRecord=0xFF00 → kernel lee 65,280 bytes]
                          ↓
  Kernel overflow → llega a CClfsContainerContext falso
                          ↓
  pContainer  = TargetKernelAddress - 0x10
  cbContainer = ValueToWrite
                          ↓
  Driver usa estructura falsa → escribe ValueToWrite en TargetKernelAddress

cl /O1 /MT /link ntdll.lib advapi32.lib clfsw32.lib CVE-2025-60709.c

go build -ldflags="-s -w" -o CVE-2025-60709.exe CVE-2025-60709.go

rule CVE_2025_60709_CLFS_LPE {
    meta:
        description = "Detects CVE-2025-60709 CLFS LPE exploit"
        author      = "KONDORDEVSECURITYCORP"
        date        = "2026-03"
        cve         = "CVE-2025-60709"
        severity    = "critical"

    strings:
        $clfs_sig   = { 01 02 00 00 }
        $magic      = { 37 13 37 13 }
        $evil_file  = "evil.blf" ascii wide
        $groom_file = "groom_" ascii wide
        $etw_func   = "EtwEventWrite" ascii wide
        $amsi_func  = "AmsiScanBuffer" ascii wide
        $token_off  = { C0 04 00 00 }       // EPROCESS_TOKEN = 0x4C0

    condition:
        3 of them
}

ARCHIVO:   Creación masiva de *.blf en C:\Windows\Temp\ (> 100 en segundos)
ARCHIVO:   Creación de C:\Windows\Temp\evil.blf
PROCESO:   Proceso en modo REALTIME_PRIORITY + llamadas a ClfsReadRestartArea
MEMORIA:   Escritura en PAGE_EXECUTE_READWRITE + CreateThread inmediato
API:       VirtualProtect sobre EtwEventWrite o AmsiScanBuffer
KERNEL:    Acceso a PsInitialSystemProcess desde user-mode

# Verificar archivos de grooming
Get-ChildItem C:\Windows\Temp -Filter "groom_*.blf" | Measure-Object

# Verificar archivo exploit
Test-Path C:\Windows\Temp\evil.blf

# Verificar integridad de ntdll (ETW patch)
Get-AuthenticodeSignature (Get-Process -Name notepad | Select -First 1).Path

[1] DEFENSE EVASION
    ├─ KillETW()   → Patch EtwEventWrite in ntdll with RET (0xC3)
    └─ KillAMSI()  → Patch AmsiScanBuffer in amsi.dll with RET (0xC3)

[2] HEAP GROOMING
    └─ GroomLookaside()
       ├─ Creates 4096 files: C:\Windows\Temp\groom_00000.blf
       ├─ Calls CreateLogFile() + AddLogContainer() for each
       └─ Exhausts lookaside lists → guarantees predictable heap layout

[3] ARBITRARY WRITE PRIMITIVE — ClfsArbWrite(Address, Value)
    ├─ Constructs malformed CLFS buffer (0x102010 bytes)
    │    ├─ Valid CLFS signature at +0x00: 0x0201
    │    ├─ Oversized cbRecord at +0x100: 0xFF00 (65,280 bytes)
    │    ├─ Shadow zone marker at +0x9A8: 0x13371337
    │    └─ Fake CClfsContainerContext at offset (0xFF00 + 0x100):
    │         ├─ pContainer  = TargetAddress - 0x10
    │         └─ cbContainer = Value (data to write)
    ├─ Computes valid CLFS checksum (driver validates)
    ├─ Writes malformed container → C:\Windows\Temp\evil.blf
    ├─ Creates log pointing to evil.blf
    ├─ Calls ClfsReadRestartArea() → triggers kernel parsing
    └─ Driver overflows buffer → writes Value to Address ✓

[4] SYSTEM TOKEN THEFT
    ├─ Reads SYSTEM process EPROCESS via PsInitialSystemProcess
    └─ Extracts token at EPROCESS + 0x4C0

[5] PRIVILEGE ESCALATION
    └─ ClfsArbWrite(CurrentEprocess + 0x4C0, SystemToken)
       └─ Overwrites current process token with SYSTEM token ✓

[6] C2 PAYLOAD EXECUTION
    ├─ VirtualAlloc(PAGE_EXECUTE_READWRITE)
    ├─ Copy 1789-byte shellcode beacon
    ├─ CreateThread() → runs as NT AUTHORITY\SYSTEM
    └─ Beacon: IPv6 + DoH C2 → Gmail drafts fallback
       └─ sRDI + sleep obfuscation + ETW/AMSI already patched

[7] PERSISTENCE
    └─ Sleep(INFINITE) → process keeps SYSTEM token

Legitimate CLFS container:
  [0x100 byte Header][Record: cbRecord bytes of real data]

Malformed container (evil.blf):
  [Valid Header][cbRecord=0xFF00 → kernel reads 65,280 bytes]
                        ↓
  Kernel overflows → reaches fake CClfsContainerContext
                        ↓
  pContainer  = TargetKernelAddress - 0x10
  cbContainer = ValueToWrite
                        ↓
  Driver uses fake structure → writes ValueToWrite to TargetKernelAddress

cl /O1 /MT /link ntdll.lib advapi32.lib clfsw32.lib CVE-2025-60709.c

go build -ldflags="-s -w" -o CVE-2025-60709.exe CVE-2025-60709.go

rule CVE_2025_60709_CLFS_LPE {
    meta:
        description = "Detects CVE-2025-60709 CLFS LPE exploit"
        author      = "KONDORDEVSECURITYCORP"
        date        = "2026-03"
        cve         = "CVE-2025-60709"
        severity    = "critical"

    strings:
        $evil_file  = "evil.blf" ascii wide
        $groom_file = "groom_" ascii wide
        $etw_func   = "EtwEventWrite" ascii wide
        $amsi_func  = "AmsiScanBuffer" ascii wide
        $magic      = { 37 13 37 13 }
        $token_off  = { C0 04 00 00 }

    condition:
        3 of them
}

FILE:    Mass creation of *.blf in C:\Windows\Temp\ (> 100 in seconds)
FILE:    Creation of C:\Windows\Temp\evil.blf
PROCESS: REALTIME_PRIORITY process + ClfsReadRestartArea calls
MEMORY:  Write to PAGE_EXECUTE_READWRITE + immediate CreateThread
API:     VirtualProtect over EtwEventWrite or AmsiScanBuffer
KERNEL:  PsInitialSystemProcess access from user-mode

# Check grooming files
Get-ChildItem C:\Windows\Temp -Filter "groom_*.blf" | Measure-Object

# Check exploit file
Test-Path C:\Windows\Temp\evil.blf