This PoC demonstrates a race condition in the Windows kernel leading to a double-free vulnerability, allowing local privilege escalation to SYSTEM. The exploit uses multithreaded handle manipulation and heap spraying to trigger the flaw under controlled conditions.# CVE-2025-62215 Exploit PoC
Original code credit: https://github.com/dexterm300
## 🧨 Description
This repository contains a proof-of-concept exploit for **CVE-2025-62215**, a **race condition** vulnerability in the Windows kernel that can be triggered via concurrent manipulation of kernel object handles. Under specific conditions, this results in a **double-free**, which can be exploited for **local privilege escalation** to **SYSTEM**.
The exploit works by:
- Creating multiple threads that rapidly open and close kernel object handles
- Exploiting a timing window to trigger double-free conditions
- Using heap spraying to manipulate memory layout
- Detecting elevated privileges using a monitor thread
---
## ⚠️ Disclaimer
This code is provided **for educational and authorized security testing purposes only**. Running this on production systems or without explicit permission is **strictly prohibited**.
---
## 🛠️ Features
- Multithreaded race condition trigger
- Heap spray for layout control
- Privilege check using access token elevation
- Test mode for safer execution
- Thread-safe logging and graceful shutdown
- Minimal dependencies; builds cleanly with `cl.exe` (MSVC)
---
## 🧪 Requirements
- Windows 10/11 (x64)
- MSVC (`cl.exe`) compiler with Debug CRT (`/MDd`)
- Administrator rights for full privilege escalation
- `ntdll.dll` for direct syscall bindings
---
## 🛠️ Build Instructions
### 🪟 Visual Studio (Recommended)
1. Open in Visual Studio
2. Set configuration to `Debug x64`
3. Build and run with elevated privileges
### 🔧 Command Line (PowerShell or Developer CMD)
May need to install C++ build tools: https://visualstudio.microsoft.com/visual-cpp-build-tools/
& "C:\Program Files (x86)\Microsoft Visual Studio\2022\BuildTools\Common7\Tools\VsDevCmd.bat"
```bash
cl.exe poc.cpp /Od /ZI /RTC1 /MDd /link /OUT:unicorn.exe
[*] Starting CVE-2025-62215 exploitation...
[*] Performing heap spray...
[+] Allocated 100 heap chunks
[*] Spawning 8 threads to trigger race condition...
[*] Waiting for race condition...
[+] SUCCESS: Privilege escalation detected!
[+] EXPLOITATION SUCCESSFUL!
[+] Privileges escalated to SYSTEM
登录后查看神龙缓存的 POC 文件快照
登录查看