CVE-2020-17136

This PoC exploits CVE-2020-17136, a local privilege escalation vulnerability in Windows Cloud Experience Host Service (CfApi). It abuses symbolic link and placeholder creation to overwrite arbitrary files, leading to EoP.

This PoC exploits CVE-2020-17136, a vulnerability in Windows Cloud Files Mini Filter Driver, by creating a mount point and using Cloud Filter API to write arbitrary data to a privileged location (e.g., C:\Windows\System32). The exploit leverages the CfExecute callback to bypass access controls.