What is miniplasma?

MiniPlasma is a security research proof-of-concept demonstrating a privilege escalation vulnerability in Windows. Privilege escalation means a program running with limited permissions finds a way to gain full system-level access, in this case, spawning a command shell with SYSTEM privileges, the highest level of access on a Windows machine. The vulnerability exists in a Windows component called cldflt.sys (part of the Cloud Files filter driver). A Google Project Zero researcher named James Forshaw originally discovered and reported this issue to Microsoft in 2020 as CVE-2020-17103, and it was supposedly patched. However, the author of this repository re-investigated and found the same flaw is still present and exploitable, either the patch was never applied or was quietly rolled back. The exploit takes advantage of a race condition, meaning it works by timing two operations to happen simultaneously in a way the code doesn't safely handle. The readme notes the success rate can vary for this reason. The author believes all Windows versions are affected. This is a research tool used to demonstrate and document the unpatched issue.