Sploitus

Exploit for Use After Free in Microsoft

CVE-2023-28252CVE-2025-24983CVE-2025-29824

githubexploit · 2025-07-30

Exploit Code

README82 lines
## https://sploitus.com/exploit?id=71BAF8EF-368E-5E50-A809-704BA625CC78
🚨 CVE-2025-29824 Exploit: PipeMagic Ransomware Chain

📌 Critical Vulnerability Overview

Privilege Escalation Flaw in Windows CLFS → SYSTEM Privilege Hijack  
Exploited in Active Ransomware Attacks by Storm-2460 Threat Group

🖥️ Affected Systems

Expand System List

🧩 Exploit Chain Workflow

graph LR
    A[Initial Access] -->|certutil| B[Malicious MSBuild Payload]
    B --> C[PipeMagic Trojan]
    C -->|CVE-2025-29824| D[CLFS Kernel Exploit]
    D -->|RtlSetAllBits| E[Token Overwrite 0xFFFFFFFF]
    E --> F[SYSTEM Privileges]
    F --> G[LSASS Dumping]
    G --> H[Ransomware Deployment]


1. Initial Access  
   Unknown vector → Compromised sites via certutil
2. PipeMagic Loader  
   Modular trojan (active since 2022)
3. Kernel Exploit  
   // Core vulnerability logic
   CLFS_Trigger_Corruption();
   RtlSetAllBits(exploit_process_token, 0xFFFFFFFF);
   
4. Post-Exploitation  
   • LSASS memory dump → Credential theft

   • File encryption with .random_extension

   • RansomEXX TOR note deployment

🌩️ Attack Attribution & History

CVE Year Ransomware Vector

CVE-2023-28252 2023 Nokoyawa PipeMagic → CLFS

CVE-2025-24983 2025 Unknown PipeMagic → Win32K

CVE-2025-29824 2025 RansomEXX PipeMagic → CLFS

Targeted Industries:  
🏢 US IT/Real Estate • 🇻🇪 Venezuela Finance • 🇪🇸 Spanish Software • 🇸🇦 Saudi Retail

🛡️ Mitigation Requirements

+ Patch Applied: MS April 2025 Patch Tuesday
! Detection Priority: certutil -> MSBuild activity
- Block Pattern: RtlSetAllBits token manipulation


Win11 24H2 Immunity:  
NtQuerySystemInformation restricted to SeDebugPrivilege accounts

⚠️ Legal & Ethical Warning  

This exploit is published FOR RESEARCH PURPOSES ONLY.  

Active ransomware deployment confirmed in:



"Attacks on IT/real estate (US), finance (Venezuela), 

software (Spain), retail (Saudi Arabia)"



https://thehackernews.com/2025/04/pipemagic-trojan-exploits-windows-zero.html

!https://img.shields.io/badge/RISK-CRITICAL-red 
!https://img.shields.io/badge/PATCHED-April_2025-green 
!https://img.shields.io/badge/SCOPE-Win7→Server_2025-orange