Local Privilege Escalation in EnTech Taiwan PowerStrip pstrip64.sys

This repository is a compact Windows local privilege escalation proof-of-concept for CVE-2026-29923. It contains three files: a minimal README naming the CVE, a header defining IOCTL values, request structures, and Windows kernel structure offsets, and a single C++ exploit source file implementing the attack. The exploit is not part of a larger framework. The main file, pstrip64_poc.cpp, opens the vulnerable device \\.\PSTRIP64 and uses two custom IOCTLs to map and unmap physical memory through the driver. It iterates over a large physical memory range in 2 MB steps, skipping the 3 GB to 4 GB MMIO region, and searches mapped memory for process objects by looking for the 'Proc' pool tag and validating candidate EPROCESS structures using hardcoded offsets. It aims to identify both the current process token and the SYSTEM process token (PID 4). Once both are found, it maps the page containing the current process token, overwrites that token with the SYSTEM token value, and then launches cmd.exe in a new console, yielding a SYSTEM shell. The header file, pstrip64_poc.h, shows the exploit’s dependency on specific Windows kernel layout assumptions. It defines offsets for fields such as UniqueProcessId, ImageFileName, and Token, with comments stating they are for Windows 10 22H2 and may need updating for other builds. This indicates the exploit is operational but somewhat brittle across versions. There are no network callbacks, remote targets, or C2-style endpoints. The exploit is purely local and interacts only with the vulnerable kernel driver device, its IOCTL interface, the kernel physical memory section referenced by the driver, and the local cmd.exe binary. Overall, the repository’s purpose is to demonstrate exploitation of an arbitrary physical memory mapping capability in the PSTRIP64 driver to achieve SYSTEM privileges via token stealing.