Windows CLFS Driver Privilege Escalation

This repository contains a single Metasploit module (Ruby file) that exploits CVE-2023-28252, a privilege escalation vulnerability in the Windows Common Log File System (clfs.sys) driver. The exploit targets Windows 10 21H2, Windows 11 21H2, and Windows Server 20348, leveraging specially crafted .blf files and memory manipulation to achieve SYSTEM privileges. The module checks for the presence of the vulnerable driver and appropriate Windows version, then injects a user-supplied Meterpreter payload via a reflective DLL. The attack vector is local, requiring an existing session on the target. The structure is typical for a Metasploit exploit: it includes metadata, a check method for vulnerability assessment, and an exploit method for payload execution. Notable fingerprintable endpoints include the clfs.sys driver path and the use of crafted .blf files. The exploit is weaponized, allowing for customizable payloads and full SYSTEM access upon success.

This repository contains a functional local privilege escalation exploit for CVE-2023-28252, a vulnerability in the Windows Common Log File System (CLFS) driver (CLFS.sys). The exploit is implemented in C++ and is designed to run on Windows 10/11 (21H2/22H2) and Windows Server 2022 with vulnerable versions of CLFS.sys. The exploit works by crafting and manipulating .blf log files and leveraging kernel memory operations to overwrite the process token, thereby granting SYSTEM privileges to the attacker. The main entry point is 'clfs_eop/clfs_eop.cpp', which orchestrates the environment setup, kernel address discovery, file crafting, and the actual privilege escalation. The exploit does not require network access and must be executed locally. The repository includes supporting headers and Visual Studio project files, but the core logic resides in the C++ source files. No external endpoints are targeted; the attack is purely local, focusing on the CLFS.sys driver and associated log files.

This repository contains a working local privilege escalation exploit for CVE-2023-28252, a vulnerability in the Microsoft Windows Common Log File System (CLFS) driver (CLFS.SYS). The main exploit logic is implemented in C++ (lib/clfs_eop.cpp and lib/clfs_eop.h), with supporting project files for Visual Studio. The exploit works by manipulating kernel memory structures via the CLFS driver to obtain a SYSTEM token, thereby elevating the attacker's privileges to SYSTEM. The code includes logic for kernel address discovery, pipe spraying, and direct system calls to achieve the exploit. The repository also includes two simple VBScript files (encrypt.vbs and decrypt.vbs) for text encoding/decoding, which are unrelated to the main exploit. The exploit targets multiple versions of Windows 10, Windows 11, and Windows Server (2016, 2019, 2022) as specified in the header comments. The attack vector is local, requiring the attacker to execute code on the target system. The main fingerprintable endpoint is the CLFS.SYS driver file. The exploit is operational and provides SYSTEM-level access if successful.

This repository contains a C++ implementation of a local privilege escalation exploit for CVE-2023-28252, targeting the Windows Common Log File System (CLFS) driver (clfs.sys). The exploit is based on Fortra's original proof-of-concept and is modified to allow the user to specify an arbitrary binary to execute as SYSTEM after successful exploitation. The main code is in 'clfs_eop/clfs_eop.cpp', with supporting headers and Visual Studio project files. The exploit works by manipulating kernel memory structures via the vulnerable driver, ultimately replacing the current process token with a SYSTEM token and then executing the specified payload. The exploit is operational and can be used to run any command or binary as SYSTEM on affected Windows versions. The only fingerprintable endpoint is the path to the vulnerable driver. The repository is well-structured for building with Visual Studio and includes both source and project files.