Windows Cross Device Service Local Privilege Escalation

Repository contains a full local privilege escalation proof-of-concept for CVE-2026-66804, a Windows Cross Device Virtual Camera / Camera FrameServer missing-path DLL planting vulnerability. It is not framework-based; the canonical exploit lives under fresh-vm-repro/. The main components are: (1) Run-CrossDevicePoC.cmd, a guarded batch runner that verifies the victim is a standard-user medium-integrity session, checks the HKLM COM registration, ensures C:\ProgramData\CrossDevice is absent, copies the malicious DLL and helper into place, launches the trigger, and validates proof artifacts; (2) crossdevice_v7_public.c, the malicious COM DLL source that is planted as CrossDevice.Streaming.Source.dll and loaded by FrameServer, logs execution, exposes COM class factory exports, and contains an adapted GodPotato-style OXID resolver / named-pipe impersonation chain to escalate from LOCAL SERVICE to SYSTEM; (3) trigger_v3_public.c, a small Media Foundation trigger that dynamically loads mfsensorgroup.dll, calls MFCreateVirtualCamera with the Cross Device CLSID, and starts the virtual camera to force DLL loading; and (4) unmarshal_helper.c, a helper process that reads a crafted OBJREF file and calls CoUnmarshalInterface to force RPCSS/OXID resolution in a separate process as part of the impersonation chain. Supporting files include a .def export file, cleanup PowerShell script that hash-verifies and removes only known PoC artifacts, extensive README/reporting material, archived wrappers, and evidence transcripts. The exploit’s capability is clear and actionable: a low-privileged local user can create the missing trusted ProgramData path, plant the expected COM DLL, trigger Camera FrameServer to load attacker code as LOCAL SERVICE, then leverage SeImpersonatePrivilege to obtain NT AUTHORITY\SYSTEM. The repository includes operational safeguards and proof receipts rather than a customizable post-exploitation payload, so it is best classified as OPERATIONAL rather than weaponized.

Repository contains a complete local privilege escalation proof-of-concept for CVE-2026-66804, a Windows Cross Device virtual camera / Camera FrameServer missing-path DLL planting issue. The repo is not tied to a common exploit framework. Its main operational content is under fresh-vm-repro/: a guarded batch runner (Run-CrossDevicePoC.cmd), the malicious COM DLL source (crossdevice_v7_public.c), a Media Foundation trigger program (trigger_v3_public.c), a COM unmarshalling helper (unmarshal_helper.c), a DLL export definition file, cleanup tooling, and evidence/transcripts. The exploit chain is: verify HKLM COM registration for CLSID {E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}, confirm C:\ProgramData\CrossDevice does not yet exist, create that directory as a standard user, plant CrossDevice.Streaming.Source.dll there, then invoke MFCreateVirtualCamera and IMFVirtualCamera::Start to cause Windows Camera FrameServer to load the attacker DLL as LOCAL SERVICE. The DLL then executes an adapted GodPotato-style OXID resolver / named-pipe impersonation technique to leverage SeImpersonatePrivilege and obtain a SYSTEM token, writing proof files to C:\Users\Public\cdv and C:\Windows. Supporting docs in README.md and docs/technical-report.md explain the vulnerability, affected condition, and reproduction steps; archived wrappers and command notes are retained for historical context. Overall, this is a real exploit PoC with a working payload chain for local EoP to SYSTEM on vulnerable Windows systems in the specific uninitialized-path state.

This repository is a real Windows local privilege escalation proof-of-concept for CVE-2026-66804 affecting Microsoft Windows 10/11 Cross Device / FrameServer behavior. The repo contains 11 files total, with primary exploit logic in five code files: a Bash build script, a launcher, a malicious/proxy DLL, a SYSTEM shell helper, and a virtual camera trigger/probe. It is not part of a common exploit framework. Repository structure and purpose: build.sh compiles all Windows components with MinGW and assembles a single final executable, CrossDeviceLPE.exe. src/resources.rc embeds the runtime components into that launcher so the final executable is self-contained. src/launcher.c is the main entry point: it verifies the caller is non-admin, checks the vulnerable COM registration under HKLM, ensures C:\ProgramData\CrossDevice does not already exist, creates that directory, drops the embedded binaries, and launches virtualcamera_probe.exe to trigger the vulnerable code path. src/crossdevice_system_chain_wrapper.c is the planted DLL that FrameServer loads; it proxies COM class resolution to a benign reference DLL while asynchronously starting the privilege-escalation chain if running as LOCAL SERVICE. src/crossdevice_system_shell.c is the final payload that expects to run as SYSTEM and creates an interactive cmd.exe on winsta0\default in the active user session. src/virtualcamera_probe.c uses Media Foundation virtual camera APIs to create/start a virtual camera and exercise device-source creation, which is the trigger that causes FrameServer to load the planted DLL. Exploit flow: a standard user runs CrossDeviceLPE.exe; the launcher stages files into C:\ProgramData\CrossDevice; the virtual camera probe triggers FrameServer; FrameServer loads CrossDevice.Streaming.Source.dll as LOCAL SERVICE because the registered path points into a user-creatable location; the malicious DLL starts SigmaPotato.exe with crossdevice_system_shell.exe as payload; SigmaPotato leverages SeImpersonatePrivilege from the LOCAL SERVICE context to obtain SYSTEM; the final helper duplicates a SYSTEM token for the active session and launches cmd.exe interactively. The exploit also writes multiple diagnostic/status files under C:\Windows\Temp. Capabilities: attacker-controlled DLL planting at a machine-wide registered COM path, forced privileged DLL load via Media Foundation/FrameServer virtual camera activity, privilege escalation from low-privileged user to LOCAL SERVICE to SYSTEM, and interactive SYSTEM shell creation. No external network communication is present; this is a purely local attack chain.