painoob/cve-2025-48799Proof-of-concept exploit for CVE-2025-48799, an elevation of privilege vulnerability in Windows Update service (wuauserv) via arbitrary folder deletion and symbolic link abuse on multi-drive systems.
This is PoC for CVE-2025-48799, an elevation of privilege vulnerability in Windows Update service.
This vulnability affects windows clients (win11/win10) with at least 2 hard drives. When machine have multiple hard drives it is possible to change location where new content is saved using the Storage Sense. If location for new applications is changed to secondary drive, during the installation of new application the wuauserv service will perform arbitrary folder deletion without checking for symbolic links (if file is encountered the service will check final path using GetFinalPathByHandle) which leads to LPE.
This PoC utilise method (and some code) descibed in ZDI blog post: https://www.zerodayinitiative.com/blog/2022/3/16/abusing-arbitrary-file-deletes-to-escalate-privilege-and-other-great-tricks
https://github.com/user-attachments/assets/eb099fbb-299d-42c1-be60-7514207918c3
