🚨 漏洞利用PoC — 仅供安全研究、漏洞分析与防御用途
🚨 PoC DE EXPLOIT — SOLO PARA INVESTIGACIÓN DE SEGURIDAD, ANÁLISIS DE VULNERABILIDADES Y FINES DEFENSIVOS
🌐 语言 / Idiomas
🇪🇸 西班牙语文档
描述
CVE-2025-60709 是 Windows CLFS.sys（通用日志文件系统）驱动中的一个本地权限提升（LPE） 漏洞。它允许具有本地代码执行能力的攻击者通过 CLFS 容器解析中的缓冲区溢出，从标准用户提升到 NT AUTHORITY\SYSTEM，从而获得内核内存的任意写入原语。
本仓库包含两种实现：
- CVE-2025-60709.c — 原始 C 实现（直接访问 Windows 原生 API）
- CVE-2025-60709.go — Go 移植版（演示/教育版本 — 不利用真实漏洞）
🎯 漏洞详情
🏗️ 仓库结构
CVE-2025-60709/
├── CVE-2025-60709.c (5.3 KB, 157 行) — 原始 C 漏洞利用
├── CVE-2025-60709.go (9.2 KB, 285 行) — Go 移植版（教育演示）
└── README.txt (4.2 KB, 132 行) — 原始文档
🔬 详细技术分析
完整利用流程
┌─────────────────────────────────────────────────────────────┐
│ CVE-2025-60709 LPE │
└─────────────────────────────────────────────────────────────┘
[1] 防御绕过
├─ KillETW() → 修补 ntdll 中的 EtwEventWrite 为 RET（0xC3）
└─ KillAMSI() → 修补 amsi.dll 中的 AmsiScanBuffer 为 RET（0xC3）
[2] 堆布局准备（内存准备）
└─ GroomLookaside()
├─ 创建 4096 个文件：C:\Windows\Temp\groom_00000.blf
├─ 对每个文件调用 CreateLogFile() + AddLogContainer()
└─ 耗尽 lookaside 列表 → 确保可预测的堆布局
[3] 任意写入原语 — ClfsArbWrite(Address, Value)
├─ 构造畸形的 CLFS 缓冲区（0x102010 字节）
│ ├─ +0x00 处有效 CLFS 签名：0x0201
│ ├─ +0x14 处扇区大小移位：2
│ ├─ +0x28 处第一个客户端区域：0x100
│ ├─ +0x100 处超大 cbRecord：0xFF00（64 KB > 实际数据）
│ ├─ +0x9A8 处阴影区域标记：0x13371337
│ └─ 偏移 (0xFF00 + 0x100) 处虚假 CClfsContainerContext：
│ ├─ pContainer = TargetAddress - 0x10
│ └─ cbContainer = Value（要写入的数据）
├─ 计算正确的 CLFS 校验和（驱动会验证）
├─ 写入畸形容器 → C:\Windows\Temp\evil.blf
├─ 创建指向 evil.blf 的日志
├─ 调用 ClfsReadRestartArea() → 触发内核解析
└─ 驱动溢出缓冲区 → 将 Value 写入 Address ✓
[4] SYSTEM 令牌窃取
├─ 通过 PsInitialSystemProcess 读取 SYSTEM 进程的 EPROCESS
└─ 提取 EPROCESS + EPROCESS_TOKEN（偏移 0x4c0）处的令牌
[5] 权限提升
└─ ClfsArbWrite(CurrentEprocess + 0x4c0, SystemToken)
└─ 用 SYSTEM 令牌覆盖当前进程令牌 ✓
[6] C2 载荷执行
├─ VirtualAlloc(PAGE_EXECUTE_READWRITE)
├─ 复制 1789 字节的 shellcode beacon
├─ CreateThread() → 以 NT AUTHORITY\SYSTEM 运行
└─ Beacon C2：IPv6 + DoH → 回退 Gmail 草稿
└─ sRDI + sleep 混淆 + ETW/AMSI 已修补
[7] 持久化
└─ Sleep(INFINITE) → 进程保持 SYSTEM 令牌
EPROCESS 偏移量（Windows 11 24H2 build 26100.3485+）
⚠️ 这些偏移量在不同 Windows 构建版本中会变化。 需要在其他版本中更新。
CLFS 缓冲区溢出机制
合法 CLFS 容器：
[Header 0x100 字节][Record: cbRecord 字节的真实数据]
畸形容器（evil.blf）：
[有效 Header][cbRecord=0xFF00 → 内核读取 65,280 字节]
↓
内核溢出 → 到达虚假的 CClfsContainerContext
↓
pContainer = TargetKernelAddress - 0x10
cbContainer = ValueToWrite
↓
驱动使用虚假结构 → 将 ValueToWrite 写入 TargetKernelAddress
关键函数 — CVE-2025-60709.c
C 与 Go 的差异
编译
C 版本（需要 Visual Studio Build Tools + Windows SDK）：
cl /O1 /MT /link ntdll.lib advapi32.lib clfsw32.lib CVE-2025-60709.c
Go 版本（需要在 Windows x64 上安装 Go 1.19+）：
go build -ldflags="-s -w" -o CVE-2025-60709.exe CVE-2025-60709.go
🛡️ 缓解措施与检测
Windows 缓解措施
YARA 规则
rule CVE_2025_60709_CLFS_LPE {
meta:
description = "检测 CVE-2025-60709 CLFS LPE 漏洞利用"
author = "KONDORDEVSECURITYCORP"
date = "2026-03"
cve = "CVE-2025-60709"
severity = "critical"
strings:
$clfs_sig = { 01 02 00 00 }
$magic = { 37 13 37 13 }
$evil_file = "evil.blf" ascii wide
$groom_file = "groom_" ascii wide
$etw_func = "EtwEventWrite" ascii wide
$amsi_func = "AmsiScanBuffer" ascii wide
$token_off = { C0 04 00 00 } // EPROCESS_TOKEN = 0x4C0
condition:
3 of them
}
IOC — 系统痕迹
行为检测
文件： 在 C:\Windows\Temp\ 中大量创建 *.blf（数秒内超过 100 个）
文件： 创建 C:\Windows\Temp\evil.blf
进程： 实时优先级进程 + 调用 ClfsReadRestartArea
内存： 写入 PAGE_EXECUTE_READWRITE + 立即 CreateThread
API： 对 EtwEventWrite 或 AmsiScanBuffer 调用 VirtualProtect
内核： 从用户态访问 PsInitialSystemProcess
快速验证
# 检查堆布局文件
Get-ChildItem C:\Windows\Temp -Filter "groom_*.blf" | Measure-Object
# 检查漏洞利用文件
Test-Path C:\Windows\Temp\evil.blf
# 检查 ntdll 完整性（ETW 修补）
Get-AuthenticodeSignature (Get-Process -Name notepad | Select -First 1).Path
🇬🇧 English Documentation
Description
CVE-2025-60709 is a Local Privilege Escalation (LPE) vulnerability in the Windows CLFS.sys (Common Log File System) driver. It allows an attacker with local code execution to escalate from a standard user to NT AUTHORITY\SYSTEM through a buffer overflow in CLFS container parsing, obtaining an arbitrary write primitive to kernel memory.
This repository contains two implementations:
- CVE-2025-60709.c — Original C implementation (direct access to native Windows APIs)
- CVE-2025-60709.go — Go port (demonstration/educational version — does NOT exploit real vulnerabilities)
🎯 Vulnerability Details
🔬 Technical Analysis
Exploitation Flow
[1] DEFENSE EVASION
├─ KillETW() → Patch EtwEventWrite in ntdll with RET (0xC3)
└─ KillAMSI() → Patch AmsiScanBuffer in amsi.dll with RET (0xC3)
[2] HEAP GROOMING
└─ GroomLookaside()
├─ Creates 4096 files: C:\Windows\Temp\groom_00000.blf
├─ Calls CreateLogFile() + AddLogContainer() for each
└─ Exhausts lookaside lists → guarantees predictable heap layout
[3] ARBITRARY WRITE PRIMITIVE — ClfsArbWrite(Address, Value)
├─ Constructs malformed CLFS buffer (0x102010 bytes)
│ ├─ Valid CLFS signature at +0x00: 0x0201
│ ├─ Oversized cbRecord at +0x100: 0xFF00 (65,280 bytes)
│ ├─ Shadow zone marker at +0x9A8: 0x13371337
│ └─ Fake CClfsContainerContext at offset (0xFF00 + 0x100):
│ ├─ pContainer = TargetAddress - 0x10
│ └─ cbContainer = Value (data to write)
├─ Computes valid CLFS checksum (driver validates)
├─ Writes malformed container → C:\Windows\Temp\evil.blf
├─ Creates log pointing to evil.blf
├─ Calls ClfsReadRestartArea() → triggers kernel parsing
└─ Driver overflows buffer → writes Value to Address ✓
[4] SYSTEM TOKEN THEFT
├─ Reads SYSTEM process EPROCESS via PsInitialSystemProcess
└─ Extracts token at EPROCESS + 0x4C0
[5] PRIVILEGE ESCALATION
└─ ClfsArbWrite(CurrentEprocess + 0x4C0, SystemToken)
└─ Overwrites current process token with SYSTEM token ✓
[6] C2 PAYLOAD EXECUTION
├─ VirtualAlloc(PAGE_EXECUTE_READWRITE)
├─ Copy 1789-byte shellcode beacon
├─ CreateThread() → runs as NT AUTHORITY\SYSTEM
└─ Beacon: IPv6 + DoH C2 → Gmail drafts fallback
└─ sRDI + sleep obfuscation + ETW/AMSI already patched
[7] PERSISTENCE
└─ Sleep(INFINITE) → process keeps SYSTEM token
EPROCESS Offsets (Windows 11 24H2 build 26100.3485+)
⚠️ These offsets vary between Windows builds. Must be updated for other versions.
CLFS Buffer Overflow Mechanism
Legitimate CLFS container:
[0x100 byte Header][Record: cbRecord bytes of real data]
Malformed container (evil.blf):
[Valid Header][cbRecord=0xFF00 → kernel reads 65,280 bytes]
↓
Kernel overflows → reaches fake CClfsContainerContext
↓
pContainer = TargetKernelAddress - 0x10
cbContainer = ValueToWrite
↓
Driver uses fake structure → writes ValueToWrite to TargetKernelAddress
Key Functions — CVE-2025-60709.c
C vs Go Differences
Build Instructions
C version (requires Visual Studio Build Tools + Windows SDK):
cl /O1 /MT /link ntdll.lib advapi32.lib clfsw32.lib CVE-2025-60709.c
Go version (requires Go 1.19+ on Windows x64):
go build -ldflags="-s -w" -o CVE-2025-60709.exe CVE-2025-60709.go
🛡️ Mitigations and Detection
Windows Mitigations
YARA Rule
rule CVE_2025_60709_CLFS_LPE {
meta:
description = "Detects CVE-2025-60709 CLFS LPE exploit"
author = "KONDORDEVSECURITYCORP"
date = "2026-03"
cve = "CVE-2025-60709"
severity = "critical"
strings:
$evil_file = "evil.blf" ascii wide
$groom_file = "groom_" ascii wide
$etw_func = "EtwEventWrite" ascii wide
$amsi_func = "AmsiScanBuffer" ascii wide
$magic = { 37 13 37 13 }
$token_off = { C0 04 00 00 }
condition:
3 of them
}
IOCs — System Artifacts
Behavioral Detection
FILE: Mass creation of *.blf in C:\Windows\Temp\ (> 100 in seconds)
FILE: Creation of C:\Windows\Temp\evil.blf
PROCESS: REALTIME_PRIORITY process + ClfsReadRestartArea calls
MEMORY: Write to PAGE_EXECUTE_READWRITE + immediate CreateThread
API: VirtualProtect over EtwEventWrite or AmsiScanBuffer
KERNEL: PsInitialSystemProcess access from user-mode
Quick Verification
# Check grooming files
Get-ChildItem C:\Windows\Temp -Filter "groom_*.blf" | Measure-Object
# Check exploit file
Test-Path C:\Windows\Temp\evil.blf
📚 技术参考 / Technical References
⚠️ 法律声明 / Aviso Legal / Legal Notice
EN (English): This exploit PoC is published for security research, vulnerability analysis, threat intelligence, and defensive purposes ONLY. Using this code against systems without explicit written authorization is illegal and may violate the CFAA, Computer Misuse Act, and equivalent laws. Authors assume no liability for misuse.
ES (Spanish): Este PoC de exploit se publica únicamente para investigación de seguridad, análisis de vulnerabilidades, inteligencia de amenazas y fines defensivos. Usar este código contra sistemas sin autorización escrita explícita es ilegal y puede violar el CFAA, Computer Misuse Act y legislación equivalente. Los autores no asumen responsabilidad por el uso indebido.
ZH (Chinese): 本漏洞利用概念验证代码的发布仅用于安全研究、漏洞分析、威胁情报和防御目的。未经明确书面授权，将此代码用于攻击系统是违法的，违反了《计算机欺诈和滥用法案》（CFAA）、计算机滥用法案及同等法律。作者不对滥用承担任何责任。
