CVE-2025-21420

This PoC demonstrates a DLL sideloading vulnerability in the Windows Disk Cleanup Tool (cleanmgr.exe) to achieve privilege escalation by placing a malicious DLL in a specific path, which gets executed when cleanmgr.exe is run.

This PoC exploits CVE-2025-21420 by creating specific folders and files to trigger the SilentCleanup task, which deletes contents in a way that can be redirected to escalate privileges. The exploit leverages arbitrary folder deletion to achieve SYSTEM-level privileges.

The repository contains a README describing a BadUSB script that exploits CVE-2025-21420 and CVE-2025-21401 to elevate privileges and bypass security features in Windows Disk Cleanup and Microsoft Edge. No actual exploit code is provided.

This repository contains a functional proof-of-concept for CVE-2025-21420, demonstrating a DLL sideloading vulnerability in the Windows Disk Cleanup Tool (cleanmgr.exe). The PoC includes a malicious DLL that spawns multiple shells when loaded by cleanmgr.exe, leveraging the tool's elevation of privilege to execute arbitrary code.