ThrottleStopPPL

A proof-of-concept tool for managing Protected Process Light (PPL) protection levels on Windows Server 2022 by exploiting vulnerabilities in the ThrottleStop driver (CVE-2025-7771).

Overview

This tool demonstrates privilege escalation through arbitrary physical memory read/write capabilities exposed by the ThrottleStop driver. It allows modification of process protection levels by directly manipulating kernel memory structures.

Features

• Arbitrary physical memory read/write
• Virtual to physical address translation via Superfetch
• EPROCESS structure manipulation
• PPL protection level modification for any process

Usage

PPLmanager.exe -p <pid> -v <protection_level>

Options

• -p <pid> - Process ID to modify
• -v <protection_level> - Protection level value in hexadecimal
• -h - Display help message

Protection Levels

Requirements

• Windows Server 2022 (tested build)
• Administrator privileges
• ThrottleStop driver loaded

Build

Build using Visual Studio with the provided solution file:

ThrottleStopPPL.sln

Driver Setup

The vulnerable ThrottleStop driver can be extracted from ThrottleStop.exe using Resource Hacker.

Create and start the driver service:

sc create ThrottleStop binPath="<Path to driver>" type=kernel
sc start ThrottleStop

Vulnerable IOCTLs

• 0x80006498 - Arbitrary memory read
• 0x8000649C - Arbitrary memory write
• 0x80006430 - Arbitrary port read
• 0x80006434 - Arbitrary port write

Disclaimer

This is a proof-of-concept for educational and research purposes only. Use responsibly and only on systems you own or have explicit permission to test.

Credits

This project is inspired by the original ThrottleStopPoC by @fxrstor.

References

• CVE-2025-7771
• Superfetch Virtual-to-Physical Translation

License

For educational and research purposes only.