mbanyamer/cve-2025-24076Python exploit for CVE-2025-24076, a Windows Cross Device Service privilege escalation vulnerability. Replaces a DLL to achieve SYSTEM privileges via local attack.
This script exploits a vulnerability in the Windows Cross Device Service that allows privilege escalation on Windows 11, Windows Server 2025, and Windows Server 2022 23H2 (Server Core installation) systems.
The vulnerability stems from improper access control in the Windows Cross Device Service, allowing a low-privileged local attacker to overwrite a critical DLL file (CrossDevice.Streaming.Source.dll) located in a writable directory.
When the user opens the Windows "Mobile devices" Settings page, the system loads this DLL. If the attacker replaces it with a malicious DLL, the code executes with SYSTEM privileges, resulting in full privilege escalation.
gcc (MinGW) installed for compiling the malicious DLL from C source code.C:\poc_only_admin_can_write_to_c.txt as confirmation of successful exploitation.Keep your systems patched by applying official Microsoft updates to mitigate this vulnerability.
The exploit script is written in Python and uses gcc (MinGW) to compile a malicious DLL. It performs DLL replacement after detecting that the original DLL is unlocked, triggering privilege escalation once the malicious DLL is loaded by the system.
If you need help running the script or further explanations, feel free to ask! 😊