CVE-2022-25943

This PoC exploits a DLL hijacking vulnerability in Kingsoft WPS Office (CVE-2022-25943) by planting a malicious DLL in a writable directory, which is then loaded by the WPS Cloud service running as NT AUTHORITY. The exploit escalates privileges to SYSTEM by changing the Administrator password and stealing the winlogon token.

This repository contains a working proof-of-concept exploit for CVE-2022-25943, which leverages a DLL hijacking vulnerability in WPS Office to achieve local privilege escalation (LPE). The exploit involves placing a malicious DLL in a writable directory and restarting the WPS Cloud service to load the DLL with elevated privileges.