Description

The PoC program exploits the IMFForceDelete driver which exposes an ioctl that allows unprivileged users to delete files and folders. We can turn this into a privilege escalation by using a technique explained by ZDI and Halov, which exploits the MSI rollback mechanism which is designed to maintain system integrity in case of issues. By deleting and recreating it with a weak DACL and fake RBF and RBS files we can gain the ability to make arbitrary changes to the system as NT AUTHORITY\SYSTEM.

VID

2025-01-08.06-39-30.mp4

No idea if it’s fixed or not. At the time of posting the PoC, it was still unfixed. The arbitrary file/folder deletion was already reported by another researcher and was known by the vendor and they didn’t fix it, I only escalated it from a not-so-cool bug to a much cooler bug with a higher impact see the write up below.