CdpSvcLPE | Windows Local Privilege Escalation via CdpSvc service (Writeable SYSTEM path Dll Hijacking)

CdpSvcLPE is a C++ library. CdpSvcLPE has no bugs, it has no vulnerabilities and it has low support. You can download it from GitHub.

Windows Local Privilege Escalation via CdpSvc service (Writeable SYSTEM path Dll Hijacking). Connected Devices Platform Service (or CDPSvc) is a service which runs as NT AUTHORITY\LOCAL SERVICE and tries to load the missing cdpsgshims.dll DLL on startup with a call to LoadLibrary(), without specifying its absolute path. So, it can be hijack dll in the folder of Dll Search Order flow and we will get process or shell access with NT AUTHORITY\LOCAL SERVICE if we hijack the dll in SYSTEM PATH writable place such as C:\python27. Then, I just combine it with @itm4n's PrintSpoofer technique to get NT AUTHORITY\SYSTEM access. \m/ Note: when you got system cmd prompt, stop the cdpsvc service and delete dll file and bin file.