Elevation of Privilege in Windows Disk Cleanup Tool

This repository provides a proof-of-concept (POC) exploit for CVE-2025-21420, a local privilege escalation vulnerability in Microsoft Windows related to the 'SilentCleanup' scheduled task and improper folder cleanup. The main code file, 'CVE-2025-21420_POC.py', is a Python script that creates three specific folders (C:\$Windows.~WS, C:\ESD\Windows, C:\ESD\Download) and places a dummy file in each. It then prompts the user to trigger the 'SilentCleanup' scheduled task, which is known to run with elevated privileges. The README.md provides detailed background, including references to related research and the necessary steps to chain this POC with other tools (FolderOrFileDeleteToSystem and FolderContentsDeleteToFolderDelete) to redirect the cleanup operation to a sensitive folder (C:\Config.msi), potentially leading to SYSTEM-level privilege escalation. The exploit is not weaponized and requires manual steps and additional tools to achieve full exploitation. The attack vector is local, requiring code execution on the target system. The repository is structured simply, with one Python POC and a comprehensive README explaining the vulnerability and exploitation process.

This repository contains a BadUSB (likely Rubber Ducky) script designed to exploit privilege escalation vulnerabilities in Windows Disk Cleanup (CVE-2025-21420 and CVE-2025-21401). The main file, 'edge-maradeur.txt', is a DuckyScript that automates keyboard input to open PowerShell, create a scheduled task to run PowerShell as SYSTEM, and then copy the Microsoft Edge login database. The script then uploads the copied database to a remote FTP server using hardcoded credentials and finally deletes the local copy. The attack requires physical or logical access to the target machine and leverages local privilege escalation to access protected browser data. The repository is structured with a README describing the exploit and a single script file containing the attack logic. No detection or fake code is present; the exploit is operational and demonstrates real-world data exfiltration techniques.

This repository provides a proof-of-concept (PoC) exploit for CVE-2025-21420, a local privilege escalation vulnerability in the Windows Disk Cleanup Tool (cleanmgr.exe) via DLL sideloading. The exploit involves crafting a malicious DLL (dokan1.dll) that exports the same functions as the legitimate DLL. When cleanmgr.exe is executed (either manually or by the system), it loads the attacker's DLL from a writable location, resulting in arbitrary code execution as SYSTEM. The PoC code (in C) demonstrates this by spawning message boxes and launching powershell shells. The repository contains only documentation and code snippets, with no actual DLL or build scripts included. The exploit is at a research/PoC stage and is not weaponized. No network endpoints are involved; the attack vector is local file system manipulation.