# CVE-2025-47181 Privilege Escalation PoC (Conceptual Model)

## Overview

This repository contains a conceptual proof-of-concept (PoC) for **CVE-2025-47181**, a "link following" privilege escalation vulnerability in **Microsoft Edge (Chromium-based)**. This vulnerability allows an attacker to exploit improper link resolution and symbolic link (symlink) handling by a trusted Edge updater process to write to privileged system files and potentially gain **SYSTEM** privileges.

> **Disclaimer:**  
> This PoC is for educational and research purposes only. Use it responsibly on isolated test environments or virtual machines. Unauthorized use against production systems or without permission is illegal.

---

## Developed and Researched by

This exploit concept and PoC were developed and researched by **nu11secur1ty**.

---

## Vulnerability Details

- **CVE ID:** CVE-2025-47181  
- **Type:** Symlink-based Privilege Escalation  
- **Affected Software:** Microsoft Edge (Chromium-based) Updater  
- **Severity:** Critical  
- **Impact:**  
  An attacker who successfully exploits this vulnerability can trick the trusted Edge updater to write malicious content to privileged locations on disk, such as `C:\Windows\System32\driver_config.dll`. This leads to privilege escalation from a low-privileged user to SYSTEM-level access.

---

## How It Works

1. The attacker creates a malicious symbolic link inside a trusted Edge temporary directory, pointing to a sensitive system file.
2. The Edge updater, running with SYSTEM privileges, follows the symlink and writes data into the sensitive file.
3. This causes the attacker-controlled content to be written to a SYSTEM-protected file.
4. The attacker thereby gains SYSTEM privileges, achieving privilege escalation.

---

## PoC Components

- **`cve_2025_47181_exploit_concept.py`**  
  Conceptual Python model simulating the vulnerability, showing how the symlink attack can manipulate privileged writes.

- **`gnaccess.py`**  
  Enhanced PoC demonstrating privilege escalation with controlled environment setup, write simulation, and cleanup.

- **`freeze_cmd.py`**  
  Auxiliary script to freeze a system command prompt window, useful for interactive testing during exploitation.

---

## Usage Instructions

1. **Setup Environment**  
   Run the PoC scripts inside a Windows virtual machine or isolated test environment.  
   Administrator privileges are required for full simulation.

2. **Run PoC**  
   Execute the Python scripts (`gnaccess.py`, `cve_2025_47181_exploit_concept.py`) to simulate and verify the vulnerability.

3. **Privilege Escalation**  
   Use PsExec or similar tools to attempt executing the PoC with SYSTEM privileges after exploiting the vulnerability.

4. **Cleanup**  
   The PoC scripts include cleanup routines to restore the environment after testing.

---

## Requirements

- Python 3.8 or higher  
- Windows OS (preferably a VM for safety)  
- [PsExec](https://learn.microsoft.com/en-us/sysinternals/downloads/psexec) (for privilege escalation simulation)  
- Administrator access (for some operations)

---

## Important Notes

- This PoC does **not** exploit any real system vulnerabilities by itself, but models the exploitation process conceptually.  
- Running this on production machines or without proper authorization is illegal and unethical.  
- Use this PoC only in isolated environments for research and defensive security purposes.

---

## References

- [Microsoft Security Advisory for CVE-2025-47181](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47181)  
- Official Microsoft Edge Security Documentation  
- [nu11secur1ty GitHub](https://github.com/nu11secur1ty) (Researcher Profile)

---

## License

MIT License — Feel free to use and modify for educational, research, and defensive purposes.

---

## Contact

For questions or collaboration, contact:

- **nu11secur1ty**: nu11secur1ty@chukasilno.com

---

*Stay safe and responsible in your security research!*
