Windows Exploitation Tricks: Trapping Virtual Memory Access (2025 Update)
Summary: Google Project Zero's James Forshaw describes a Windows 11 24H2 change that lets the SMB client specify a destination TCP port from the command line, so that net use \\localhost\c$ /TCPPORT:12345 routes UNC path access through port 12345 instead of the fixed port 445. This lets an attacker run a fake SMB server on a non-standard local port without administrator rights, removing the need for a remote server or the Cloud Filter API to build a virtual memory access trap for exploiting TOCTOU kernel bugs.
Key Takeaway: The feature is enabled by default and can only be turned off by an administrator through Group Policy, which Forshaw calls a mistake likely to cause problems for Windows going forward - and it makes the False File Immutability bug class locally exploitable.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026