Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2025-48799 PoC — Windows Update Service Elevation of Privilege Vulnerability

Source
https://github.com/painoob/CVE-2025-48799
Associated Vulnerability
Title:Windows Update Service Elevation of Privilege Vulnerability (CVE-2025-48799)
Description:Improper link resolution before file access ('link following') in Windows Update Service allows an authorized attacker to elevate privileges locally.
Readme
# Description
This is PoC for CVE-2025-48799, an elevation of privilege vulnerability in Windows Update service.

This vulnability affects windows clients (win11/win10) with at least 2 hard drives. When machine have multiple hard drives it is possible to change location where new content is saved using the Storage Sense. If location for new applications is changed to secondary drive, during the installation of new application the wuauserv service will perform arbitrary folder deletion without checking for symbolic links (if file is encountered the service will check final path using GetFinalPathByHandle) which leads to LPE.

This PoC utilise method (and some code) descibed in ZDI blog post: https://www.zerodayinitiative.com/blog/2022/3/16/abusing-arbitrary-file-deletes-to-escalate-privilege-and-other-great-tricks

## PoC

https://github.com/user-attachments/assets/eb099fbb-299d-42c1-be60-7514207918c3
File Snapshot

 [4.0K]  /data/pocs/bba7fa14e027f7a34c0aac7a4365bd9b043d2004
├── [ 915]  README.md
└── [4.0K]  WinUpdateEoP
    ├── [558K]  5eeabb3.rbs
    ├── [4.0K]  bin
    │   └── [1.0M]  WinUpdateEoP.exe
    ├── [4.2K]  def.h
    ├── [4.4K]  FileOplock.cpp
    ├── [1.0K]  FileOplock.h
    ├── [ 16K]  FileOrFolderDelete.cpp
    ├── [ 10K]  main.cpp
    ├── [184K]  Msi_EoP.msi
    ├── [ 440]  resource.aps
    ├── [ 300]  resource.h
    ├── [2.1K]  resource.rc
    ├── [1.4K]  WinUpdateEoP.sln
    ├── [6.8K]  WinUpdateEoP.vcxproj
    ├── [1.6K]  WinUpdateEoP.vcxproj.filters
    └── [ 168]  WinUpdateEoP.vcxproj.user

2 directories, 16 files
Shenlong Bot has cached this for you
Remarks
    1. It is advised to access via the original source first.
    2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.
    3. Mirroring, verifying, and maintaining this POC archive takes ongoing effort, so local snapshots are a paid feature. Your subscription keeps the archive online — thank you for the support. View subscription plans →