CVE-2025-7771 — ThrottleStop.sys LPE

Proof-of-concept for CVE-2025-7771. ThrottleStop.sys exposes two IOCTL handlers that allow arbitrary physical memory read/write with no access control — any admin process can read or write anywhere in physical RAM.

Tested on Windows 10 22H2 and Windows 11 23H2 x64.

What I did

Started by loading the driver binary into IDA Pro to figure out how it works internally. Found the IRP_MJ_DEVICE_CONTROL dispatch routine and traced it down to two IOCTL codes:

• 0x80006498 — read from physical address
• 0x8000649C — write to physical address

Both just call MmMapIoSpace directly with whatever address you pass in. No bounds check, no caller validation, nothing. That's the bug.

From there the exploitation path is pretty straightforward:

1. Open a handle to \\.\ThrottleStop
2. Use the Superfetch PFN query (NtQuerySystemInformation class 79) to build a virtual→physical address translation map
3. Leak ntoskrnl base via NtQuerySystemInformation class 11
4. Load ntoskrnl.exe from disk to resolve PsInitialSystemProcess export RVA, add to runtime base to get the kernel VA
5. Translate that VA to physical, read it — gives you the SYSTEM EPROCESS pointer
6. Read SYSTEM token from EPROCESS+0x4b8
7. Walk ActiveProcessLinks to find our own EPROCESS
8. Write SYSTEM token over our own token field (physical write, bypasses all virtual memory protections)
9. Spawn cmd.exe — it inherits our now-SYSTEM token

The token field is _EX_FAST_REF so the low 4 bits are a refcount, not part of the pointer. Mask those out when reading SYSTEM token, preserve our own refcount bits when writing, otherwise you risk a BSOD.

Build

cl /std:c++20 /EHsc /O2 exploit_single.cpp /link ntdll.lib advapi32.lib

Requires MSVC (VS2022+) and the driver to be loaded. Run as administrator.

EPROCESS offsets

These are for Windows 10 20H2 through 22H2 and Windows 11 22H2/23H2 x64. Check with dt nt!_EPROCESS in WinDbg if you're on a different build.

References

• CVE-2025-7771
• Kaspersky research on active exploitation in the wild
• jonomango/superfetch

For educational and research purposes only. Tested on a personal VM.