Elevation of Privilege in Windows Cross Device Service

Repository contains a complete local privilege escalation proof-of-concept for CVE-2026-66804, a Windows Cross Device virtual camera / Camera FrameServer missing-path DLL planting issue. The repo is not tied to a common exploit framework. Its main operational content is under fresh-vm-repro/: a guarded batch runner (Run-CrossDevicePoC.cmd), the malicious COM DLL source (crossdevice_v7_public.c), a Media Foundation trigger program (trigger_v3_public.c), a COM unmarshalling helper (unmarshal_helper.c), a DLL export definition file, cleanup tooling, and evidence/transcripts. The exploit chain is: verify HKLM COM registration for CLSID {E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}, confirm C:\ProgramData\CrossDevice does not yet exist, create that directory as a standard user, plant CrossDevice.Streaming.Source.dll there, then invoke MFCreateVirtualCamera and IMFVirtualCamera::Start to cause Windows Camera FrameServer to load the attacker DLL as LOCAL SERVICE. The DLL then executes an adapted GodPotato-style OXID resolver / named-pipe impersonation technique to leverage SeImpersonatePrivilege and obtain a SYSTEM token, writing proof files to C:\Users\Public\cdv and C:\Windows. Supporting docs in README.md and docs/technical-report.md explain the vulnerability, affected condition, and reproduction steps; archived wrappers and command notes are retained for historical context. Overall, this is a real exploit PoC with a working payload chain for local EoP to SYSTEM on vulnerable Windows systems in the specific uninitialized-path state.

This repository is a real Windows local privilege escalation proof-of-concept for CVE-2026-66804 affecting Microsoft Windows 10/11 Cross Device / FrameServer behavior. The repo contains 11 files total, with primary exploit logic in five code files: a Bash build script, a launcher, a malicious/proxy DLL, a SYSTEM shell helper, and a virtual camera trigger/probe. It is not part of a common exploit framework. Repository structure and purpose: build.sh compiles all Windows components with MinGW and assembles a single final executable, CrossDeviceLPE.exe. src/resources.rc embeds the runtime components into that launcher so the final executable is self-contained. src/launcher.c is the main entry point: it verifies the caller is non-admin, checks the vulnerable COM registration under HKLM, ensures C:\ProgramData\CrossDevice does not already exist, creates that directory, drops the embedded binaries, and launches virtualcamera_probe.exe to trigger the vulnerable code path. src/crossdevice_system_chain_wrapper.c is the planted DLL that FrameServer loads; it proxies COM class resolution to a benign reference DLL while asynchronously starting the privilege-escalation chain if running as LOCAL SERVICE. src/crossdevice_system_shell.c is the final payload that expects to run as SYSTEM and creates an interactive cmd.exe on winsta0\default in the active user session. src/virtualcamera_probe.c uses Media Foundation virtual camera APIs to create/start a virtual camera and exercise device-source creation, which is the trigger that causes FrameServer to load the planted DLL. Exploit flow: a standard user runs CrossDeviceLPE.exe; the launcher stages files into C:\ProgramData\CrossDevice; the virtual camera probe triggers FrameServer; FrameServer loads CrossDevice.Streaming.Source.dll as LOCAL SERVICE because the registered path points into a user-creatable location; the malicious DLL starts SigmaPotato.exe with crossdevice_system_shell.exe as payload; SigmaPotato leverages SeImpersonatePrivilege from the LOCAL SERVICE context to obtain SYSTEM; the final helper duplicates a SYSTEM token for the active session and launches cmd.exe interactively. The exploit also writes multiple diagnostic/status files under C:\Windows\Temp. Capabilities: attacker-controlled DLL planting at a machine-wide registered COM path, forced privileged DLL load via Media Foundation/FrameServer virtual camera activity, privilege escalation from low-privileged user to LOCAL SERVICE to SYSTEM, and interactive SYSTEM shell creation. No external network communication is present; this is a purely local attack chain.