## https://sploitus.com/exploit?id=0BC64FC2-15BB-5937-BD3C-89B5629F91B8
## Diffing cleanmgr.exe
The new version of `cleanmgr.exe` includes a call to the [SetProcessMitigationPolicy](https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-setprocessmitigationpolicy) function.
With `MitigationPolicy` set to 16, corresponding to **ProcessRedirectionTrustPolicy**.
Combined with Microsoft's description of [CWE-59: Improper Link Resolution Before File Access ('Link Following')](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21420), we can infer that `cleanmgr.exe` has Redirection Guard enabled.
After reading two blog posts by *Simon Zuckerbraun* and *enigma0x3*:
1. [From Arbitrary Folder Delete/Move/Rename to SYSTEM EoP](https://www.zerodayinitiative.com/blog/2022/3/16/abusing-arbitrary-file-deletes-to-escalate-privilege-and-other-great-tricks)
2. [Bypass UAC](https://enigma0x3.net/2016/07/22/bypassing-uac-on-windows-10-using-disk-cleanup/)
The `SilentCleanup` task may have sufficient privileges to delete the `C:/Config.msi` folder, as mentioned by Simon Zuckerbraun. We only need to locate an *Arbitrary Folder Delete/Move/Rename* vulnerability inside the `SilentCleanup` task (which runs `cleanmgr.exe` with **Run with highest priv**) and redirect it to the `C:/Config.msi` folder.
## Observations via Procmon
Run the `SilentCleanup` task and observe `cleanmgr.exe` behavior.
The process checks whether the listed folders exist (interestingly, it doesn't verify if `C:\ESD` is a junction, but it does check `Windows` and `Download` โ which we wonโt dive into here).
Create the folders `C:\$Windows.~WS`, `C:\ESD\Windows`, `C:\ESD\Download`, drop some random files into them, rerun `SilentCleanup` and observe again.
We can see `SilentCleanup` deletes the contents within the `Windows` and `Download` folders. This can be leveraged using the technique described in [From Folder Contents Delete to SYSTEM EoP](https://www.zerodayinitiative.com/blog/2022/3/16/abusing-arbitrary-file-deletes-to-escalate-privilege-and-other-great-tricks).
## Exploit
1. Python script creates 3 folders: `C:\$Windows.~WS`, `C:\ESD\Windows`, `C:\ESD\Download`, inserts dummy `.txt` files and pauses.
2. Run [FolderOrFileDeleteToSystem](https://github.com/thezdi/PoC/tree/main/FilesystemEoPs) to set up the `Config.msi`.
3. Run [FolderContentsDeleteToFolderDelete](https://github.com/thezdi/PoC/tree/main/FilesystemEoPs) to redirect content cleanup from `C:\ESD\Windows` to `C:/Config.msi`.
**Note:** Exclude these two processes in Defender as AV may detect this exploit technique.
4. Resume the Python script and run `SilentCleanup` to trigger content cleanup.
5. Run `osk.exe`, then hit Ctrl-Alt-Delete.
https://github.com/user-attachments/assets/d66b43ea-6706-4bce-94c4-ca3a6e97857f