Inside of Windows: How a Double-Fetch Vulnerability Leads to SYSTEM Access
24H2 NT Kernel Exploit [POC]
📌Target: NT kernel in Windows 11 24H2 Insider Preview.
📌Vulnerabilities: Multiple kernel vulnerabilities in ntoskrnl.exe.
Exploit Technique:
📌Uses process token swap to gain NT AUTHORITY\SYSTEM privileges.
📌Walks the PsActiveProcessHead list to find a privileged process and its token.
📌Replaces the token of the exploit process with the privileged token.
📌Spawns a new command prompt with SYSTEM privileges.
Bypassing KASLR:
📌Uses side-channel attacks to locate the kernel base address.
📌Highlights weaknesses in the new KASLR implementation.
Components:
📌teb_nt_poc.c: The main exploit code.
📌prefetch_asm.asm and prefetch_leak.h: Used for side-channel attacks to bypass kernel ASLR.
📌find_nt_offsets.h and find_nt_offsets.c: Finds non-exported globals in NT using Capstone.
📌ntos.h: Contains miscellaneous non-public structs and functions related to NT.
CVE-2024-21345 [POC]
📌Vulnerability: Proof-of-Concept (PoC) for CVE-2024-21345.
📌Target: Specific vulnerability in a software component
Exploit Details:
📌The vulnerability involves a double-fetch issue in NtQueryInformationThread, leading to an arbitrary write.
📌Exploitation can result in high integrity and confidentiality impacts, with availability also rated as high.
CVE-2024-26218 [POC]
📌Vulnerability: Proof-of-Concept (PoC) for CVE-2024-26218.
📌Target: Specific vulnerability in a software component.
Exploit Details:
📌The vulnerability allows attackers to elevate their privileges to SYSTEM level, which can lead to full control over the affected system.
Vkontakte
Twitter
Одноклассники
