Privilege Escalation in Notepad++ Installer via Insecure Executable Search Path

This repository is a minimal exploit/payload repository with 2 files: a short README and a single C source file, regsvr32.c, which contains the full exploit logic. It is not part of a larger exploit framework. The code is a Windows-native operational proof-of-concept that combines local privilege escalation behavior with a reverse shell payload. Its structure is split into clear stages: (1) FindWinlogonPid enumerates processes to locate winlogon.exe; (2) ParentDuplicateTokenAndSpawnChildDetached enables SeDebugPrivilege, opens the winlogon.exe token, duplicates it into a primary token, and re-executes the current binary with a --child argument using CreateProcessWithTokenW; (3) DoChildWorkAndServeShell runs in the child context, creates a TCP client connection to a hardcoded callback address, launches cmd.exe hidden with inherited pipes, and bridges socket I/O to the shell using two worker threads (SocketToPipe and PipeToSocket). The main capability is to provide an interactive SYSTEM shell. The payload is hardcoded and basic rather than operator-configurable, which makes the repository best classified as OPERATIONAL rather than weaponized. The exploit does not merely detect a condition; it actively attempts token theft/duplication and command execution. Fingerprintable artifacts are limited but clear: the reverse shell connects to 127.0.0.1 on TCP port 4444, the spawned shell path is C:\Windows\System32\cmd.exe, and the privileged target process is winlogon.exe. The code also explicitly enables SeDebugPrivilege, which is a notable behavioral indicator for detection. Overall, the repository appears intended to reproduce or demonstrate post-exploitation impact associated with CVE-2025-49144, likely in the context of Notepad++ as referenced by the README, but the actual code itself is a Windows token-duplication and reverse-shell payload rather than application-specific exploit logic against Notepad++ directly.

This repository is a proof-of-concept (PoC) exploit for CVE-2025-49144, targeting Microsoft Windows 10 and later. The main exploit file, 'regsvr32_loader.c', is a C program that allocates executable memory, copies embedded shellcode into it, and executes it. The shellcode is not fully shown, but the structure allows for arbitrary shellcode to be run, which could result in code execution, privilege escalation, or other post-exploitation actions depending on the shellcode used. The README provides detailed usage instructions, system requirements, and context for security researchers. No network endpoints or external IPs/URLs are hardcoded in the exploit code itself; the only fingerprintable endpoint is the loader C file. The exploit is operational, requiring the user to compile and execute the loader on a Windows system. The repository is structured simply, with a license, a README, and the exploit loader source code.

This repository provides an operational exploit for CVE-2025-49144, targeting the Notepad++ 8.8.1 Windows installer. The main file, CVE-2025-49144.py, is a Python script that automates the creation of a malicious regsvr32.exe loader. The script uses msfvenom to generate a reverse shell payload (windows/x64/shell_reverse_tcp) with attacker-supplied LHOST and LPORT, XOR-encrypts the shellcode, and embeds it in a C program that injects the payload into a suspended notepad.exe process. The C code is compiled using mingw-w64 to produce regsvr32.exe. The script then packages both the original vulnerable installer and the malicious loader into a ZIP archive for delivery. The exploit requires the victim to execute the installer in the same directory as regsvr32.exe, which triggers the payload and results in a reverse shell to the attacker's machine. The repository includes a README.md with usage instructions and requirements. The attack vector is local, relying on the victim executing the provided files. No network endpoints are hardcoded; the attacker supplies the callback IP and port at runtime.

This repository provides a proof-of-concept (PoC) exploit for CVE-2025-49144, a local privilege escalation vulnerability in Notepad++ installers (v8.8.1 and prior) on Windows. The exploit leverages the installer's failure to specify the full path to regsvr32.exe, allowing an attacker to place a malicious regsvr32.exe (compiled from regsvr32_loader.c) in the same directory as the installer (e.g., Downloads). When the installer is run, it executes the attacker's regsvr32.exe with SYSTEM privileges, which in turn runs arbitrary shellcode (commonly a reverse shell). The repository contains a single C source file (regsvr32_loader.c) for the payload loader, a README.md with detailed exploitation steps, and a license file. The exploit is a local privilege escalation and requires the attacker to have the ability to place files in the victim's installer directory. No network endpoints are hardcoded; the payload is user-supplied shellcode, typically generated with msfvenom. The exploit is a functional PoC and not weaponized for automated attacks.

This repository is a Proof-of-Concept (PoC) exploit for CVE-2025-49144, a binary planting vulnerability in the Notepad++ installer (all versions before v8.8.2) on Windows. The exploit leverages the installer's unsafe invocation of regsvr32.exe by placing a malicious executable named regsvr32.exe in the same directory as the installer (commonly the user's Downloads folder). When the user runs the installer, it executes the attacker's regsvr32.exe with SYSTEM privileges, resulting in privilege escalation. The exploit is implemented as a Go program (main.go) that uses CGO to interface with C code in the reverse_shell directory. The C code handles process creation, privilege escalation (via SYSTEM token impersonation), and launching a reverse shell using obfuscated PowerShell. The reverse shell connects back to an attacker-controlled host and port (default 127.0.0.1:4445, but configurable), providing full SYSTEM-level access. The code includes advanced evasion techniques such as string obfuscation, process hollowing, and robust error handling. Key files include: - main.go: Entry point, handles argument parsing and launching the reverse shell. - reverse_shell/*.c and *.h: Implement the reverse shell, privilege escalation, socket communication, and obfuscation. - reverse_shell/winbind.go: Go bindings for the C code. The attack vector is local (binary planting), requiring the attacker to place the malicious regsvr32.exe in the same directory as the Notepad++ installer and trick the user into running the installer. The exploit is operational and provides a working SYSTEM-level reverse shell if successful. No external network endpoints are hardcoded except for the reverse shell connection, which is configurable. The repository is well-structured, with clear separation between Go and C components, and includes detailed documentation in the README.