Privilege Escalation in Elliptic Labs Virtual Lock Sensor

This repository contains a local privilege escalation proof-of-concept (PoC) exploit for CVE-2025-0886, targeting Elliptic Virtual Lock Sensor version 3.1.60531.2 on Windows (commonly found on Lenovo laptops). The exploit abuses weak permissions on specific registry keys (notably under 'HKLM\SOFTWARE\Elliptic Labs\Virtual Lock Sensor\UserSettings') to create a registry symlink to the 'edgeupdate' service configuration. By forcing a reinstall of the vulnerable software, the exploit causes the 'Everyone' group to gain full control over the 'edgeupdate' service registry key. The exploit then modifies the 'ImagePath' value of this service to point to an arbitrary payload, which is executed as SYSTEM when the service is started. The exploit is implemented in C++ (main.cpp) and requires the user to provide the payload command as an argument. The repository includes Visual Studio project files and references an external dependency (OffWinLib) as a submodule. The exploit does not reset the permissions on the affected registry key after execution, so manual cleanup is required. The code is a functional PoC and not weaponized for mass exploitation.