S1lkys
Source-scoped identity with 7 associated PoCs and 7 linked vulnerabilities.
Exploit catalog results
Showing 7 PoCs on this page
GitHubS1lkys/Eneio64-LPE
Repository PoCStars: 3Created 2026-03-01ExploitCVE-2020-1244612 files
Analysis
Technical assessment
The artifact is a local privilege escalation exploit for CVE-2020-12446. It uses the vulnerable ene.sys driver to map physical memory, leaks the System EPROCESS address via handle table inspection, walks the EPROCESS list to find the current process, and overwrites its token with the System token to gain NT AUTHORITY\SYSTEM privileges, spawning a shell.
Backdoor review
No backdoor observed in reviewed code
The supplied text evidence (README.md and main.cpp) describes and implements a local privilege escalation (LPE) exploit for CVE-2020-12446. The code opens a vulnerable driver, maps physical memory, leaks the System EPROCESS address, walks the process list to find the current process, overwrites its token with the System token, and spawns a command prompt. All observed behavior is consistent with the stated LPE goal. No concealed backdoor, unrelated payload, credential theft, persistence mechanism, or deceptive behavior is present in the reviewed text.
Classification basis and observed behavior
Classification basis
The code actively exploits the vulnerability by mapping physical memory, manipulating kernel structures (EPROCESS token), and escalating privileges to SYSTEM, as demonstrated by the included output showing 'nt authority\system'. This is a full exploit, not just a scanner or writeup.
main.cpp:207-270README.md:14-41Requirements
- Local non-privileged user access to a Windows system with the vulnerable ene.sys driver loaded.
README.md:1-7 - The vulnerable ene.sys driver must be present and accessible at \\.\EneIo (implied by DEVICE_PATH).
main.cpp:275
Observed behavior
- Opens a handle to the vulnerable driver \\.\EneIo.
main.cpp:275 - Maps the entire physical address space into user space via IOCTL_WINIO_MAPPHYSTOLIN.
main.cpp:207-233 - Leaks the System EPROCESS virtual address by opening a handle to PID 4 and querying the SystemHandleInformation table.
main.cpp:64-153 - Translates the System EPROCESS virtual address to a physical address using the Superfetch method.
main.cpp:33-45main.cpp:302 - Walks the EPROCESS ActiveProcessLinks list to locate the current process's token in physical memory.
main.cpp:156-203 - Overwrites the current process token with the System process token in physical memory.
main.cpp:253-270 - Spawns a new command shell (cmd.exe) running with SYSTEM privileges.
main.cpp:269
Behaviors behind the backdoor verdict
Observables
- Exploit Behavior
- Payload withheldThe code overwrites the current process token with the System process token to achieve privilege escalation, which is the documented purpose of the PoC.
main.cpp:253-270 - Process Creation
- Payload withheldAfter token replacement, the code spawns a command prompt with elevated privileges, consistent with the README description of spawning a powershell process.
main.cpp:269 - Driver Interaction
- Payload withheldThe code interacts with the vulnerable driver to map and unmap physical memory, which is the core primitive of the CVE-2020-12446 exploit.
main.cpp:215-224main.cpp:240-249
What the analysis did not establish
- Two binary files (Eneio64-LPE.exe and Eneio64-LPE.pdb) are present but not analyzed; analysis is based solely on the provided source code (main.cpp) and README.md.
- The exploit relies on external headers (DeviceIO.h, superfetch.h) and a compiled binary, which are not fully inspected; exact IOCTL codes and Superfetch implementation details are not visible in the provided text.
- Two binary files (Eneio64-LPE.exe and Eneio64-LPE.pdb) are present but were not analyzed; the compiled executable could theoretically contain additional code not present in the supplied source files.
- Eight additional text files in the repository were omitted from the evidence packet and were not reviewed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.