CVE-2025-49677

描述： Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.

---

Description

This Proof of Concept (PoC) demonstrates an interactive SYSTEM shell exploit for CVE-2025-49677.
It leverages scheduled tasks and a looping batch script running as SYSTEM to execute arbitrary commands
with NT AUTHORITY\SYSTEM privileges and interactively returns command output.

more

Reference

Usage

1. Run the Python script as Administrator on the vulnerable Windows machine.
2. The script creates a scheduled task that runs a batch script as SYSTEM user.
3. You get an interactive prompt (SYSTEM>) in your Python console.
4. Type any Windows command (e.g. whoami, dir, net user) and see the SYSTEM-level output.
5. Type exit to quit and clean up all temporary files and scheduled tasks.

Files

• PoC.py: Python script implementing the exploit and interactive shell.
• README.md: This readme file.

Requirements

• Python 3.x installed on Windows.
• Run the script with Administrator privileges.
• The script uses built-in Windows commands (schtasks, cmd.exe, timeout).

Disclaimer

Use this PoC only in authorized environments for testing and research purposes.
Disclosure responsibly. I am not responsible for misuse.

---

Video:

href

Source:

href

Time spent:

05:35:00