PoC Exploit Unveiled for Windows Disk Cleanup Elevation Vulnerability

Microsoft addressed a high-severity elevation of privilege vulnerability (CVE-2025-21420) in its Windows Disk Cleanup Utility (cleanmgr.exe) during February 2025’s Patch Tuesday.

The flaw, scoring 7.8 on the CVSS scale, enabled attackers to execute malicious code with SYSTEM privileges through DLL sideloading and a directory traversal technique.

Technical Analysis of CVE-2025-21420

The vulnerability stems from cleanmgr.exe’s failure to validate DLL loading paths and mitigate symbolic link attacks.

Key components include:

1. Exploitation Mechanism

• DLL Sideloading: Attackers plant malicious libraries (e.g., dokannp1.dll) in writable system directories. bashcp .\dokan1.dll C:\Users\<username>\System32\System32\System32\dokannp1.dll cleanmgr /sageset:2 This command chain exploits path interception vulnerabilities to load unsigned DLLs.
• SilentCleanup Task Hijacking: The Windows Task Scheduler’s SilentCleanup task (running as SYSTEM) deletes folder contents without proper symlink checks. Attackers abuse this via: python# Exploit script structure os.makedirs(r'C:\$Windows.~WS') os.makedirs(r'C:\ESD\Windows') open(r'C:\ESD\Windows\dummy.txt', 'w').close() By redirecting folder deletions to C:\Config.Msi, attackers trigger arbitrary file operations.

2. Vulnerability Chain

Proof-of-Concept (PoC) Workflow

Security researchers demonstrated exploitation using a multi-stage process:

1. Folder Setup: Create nested directories (C:\ESD\Windows) with dummy files to trigger SilentCleanup’s deletion routine.
2. Junction Redirection: Use FolderContentsDeleteToFolderDelete to convert C:\ESD\Windows into a junction pointing to C:\Config.Msi.
3. Privilege Escalation: Execute osk.exe post-cleanup to spawn a SYSTEM shell via the compromised Config.Msi directory.

python# Sample exploit script (abridged)
import os, time
os.makedirs(r'C:\$Windows.~WS', exist_ok=True)
os.makedirs(r'C:\ESD\Windows', exist_ok=True)
with open(r'C:\ESD\Windows\dummy.txt', 'w') as f: f.write('trigger')
input("Press Enter after setting up junctions...")
os.startfile(r'C:\Windows\System32\cleanmgr.exe')

Mitigation and Patch Deployment

Microsoft’s February 2025 update resolves the flaw through:

• Redirection Guard: Blocks symlink attacks via PROCESS_MITIGATION_REDIRECTION_TRUST_POLICY.
• DLL Signature Enforcement: cleanmgr.exe now validates digital signatures before loading libraries.

Recommended Actions:

• Apply KB5025321 via Windows Update/WSUS immediately.
• Audit system directories for unauthorized DLLs (e.g., dokannp1.dll).
• Monitor cleanmgr.exe executions in non-standard contexts.

This patch is part of a broader update fixing 67 vulnerabilities, including actively exploited zero-days in Windows Ancillary Function Driver (CVE-2025-21418) and NTLM (CVE-2025-21377).

Organizations should prioritize patch deployment given the exploit’s low complexity and high impact.

Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates