S1lkys/Eneio64-LPE

GitHubRepository PoCExploit

PoC files

12 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a local privilege escalation exploit for CVE-2020-12446. It uses the vulnerable ene.sys driver to map physical memory, leaks the System EPROCESS address via handle table inspection, walks the EPROCESS list to find the current process, and overwrites its token with the System token to gain NT AUTHORITY\SYSTEM privileges, spawning a shell.

Backdoor review

No backdoor observed in reviewed code

The supplied text evidence (README.md and main.cpp) describes and implements a local privilege escalation (LPE) exploit for CVE-2020-12446. The code opens a vulnerable driver, maps physical memory, leaks the System EPROCESS address, walks the process list to find the current process, overwrites its token with the System token, and spawns a command prompt. All observed behavior is consistent with the stated LPE goal. No concealed backdoor, unrelated payload, credential theft, persistence mechanism, or deceptive behavior is present in the reviewed text.

ClassificationExploit
Model confidence98%
AuthenticationRequired
LanguagesC++
Target softwareG.SKILL Trident Z Lighting Control (ene.sys driver)
Attack typesprivilege escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code actively exploits the vulnerability by mapping physical memory, manipulating kernel structures (EPROCESS token), and escalating privileges to SYSTEM, as demonstrated by the included output showing 'nt authority\system'. This is a full exploit, not just a scanner or writeup.

main.cpp:207-270README.md:14-41

Requirements

  • Local non-privileged user access to a Windows system with the vulnerable ene.sys driver loaded.README.md:1-7
  • The vulnerable ene.sys driver must be present and accessible at \\.\EneIo (implied by DEVICE_PATH).main.cpp:275

Observed behavior

  • Opens a handle to the vulnerable driver \\.\EneIo.main.cpp:275
  • Maps the entire physical address space into user space via IOCTL_WINIO_MAPPHYSTOLIN.main.cpp:207-233
  • Leaks the System EPROCESS virtual address by opening a handle to PID 4 and querying the SystemHandleInformation table.main.cpp:64-153
  • Translates the System EPROCESS virtual address to a physical address using the Superfetch method.main.cpp:33-45main.cpp:302
  • Walks the EPROCESS ActiveProcessLinks list to locate the current process's token in physical memory.main.cpp:156-203
  • Overwrites the current process token with the System process token in physical memory.main.cpp:253-270
  • Spawns a new command shell (cmd.exe) running with SYSTEM privileges.main.cpp:269
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Token patching privilege escalationThe code overwrites the current process token with the System process token to achieve privilege escalation, which is the documented purpose of the PoC.main.cpp:253-270
Process Creation
system("cmd.exe")After token replacement, the code spawns a command prompt with elevated privileges, consistent with the README description of spawning a powershell process.main.cpp:269
Driver Interaction
DeviceIoControl with IOCTL_WINIO_MAPPHYSTOLIN and IOCTL_WINIO_UNMAPPHYSADDRThe code interacts with the vulnerable driver to map and unmap physical memory, which is the core primitive of the CVE-2020-12446 exploit.main.cpp:215-224main.cpp:240-249
Review boundaries

What the analysis did not establish

  • Two binary files (Eneio64-LPE.exe and Eneio64-LPE.pdb) are present but not analyzed; analysis is based solely on the provided source code (main.cpp) and README.md.
  • The exploit relies on external headers (DeviceIO.h, superfetch.h) and a compiled binary, which are not fully inspected; exact IOCTL codes and Superfetch implementation details are not visible in the provided text.
  • Two binary files (Eneio64-LPE.exe and Eneio64-LPE.pdb) are present but were not analyzed; the compiled executable could theoretically contain additional code not present in the supplied source files.
  • Eight additional text files in the repository were omitted from the evidence packet and were not reviewed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1