CVE-2024-30088 PoC — Microsoft Windows Kernel 安全漏洞

Source

https://github.com/Zombie-Kaiser/CVE-2024-30088-Windows-poc

Associated Vulnerability

Title:Microsoft Windows Kernel 安全漏洞 (CVE-2024-30088)
Description:Microsoft Windows Kernel是美国微软（Microsoft）公司的Windows操作系统的内核。 Microsoft Windows Kernel 存在安全漏洞。以下产品和版本受到影响：Windows Server 2022, 23H2 Edition (Server Core installation),Windows 10 for 32-bit Systems,Windows 10 for x64-based Systems,Windows 10 Version 1607 for

Description

该漏洞存在于 NtQueryInformationToken 函数中，特别是在处理AuthzBasepCopyoutInternalSecurityAttributes 函数时，该漏洞源于内核在操作对象时对锁定机制的不当管理，这一失误可能导致恶意实体意外提升权限。

Readme

# CVE-2024-30088-Windows-poc
该漏洞存在于 NtQueryInformationToken 函数中，特别是在处理AuthzBasepCopyoutInternalSecurityAttributes 函数时，该漏洞源于内核在操作对象时对锁定机制的不当管理，这一失误可能导致恶意实体意外提升权限。
![Windows 10 x64 - VMware Workstation 2024_7_5 23_55_20](https://github.com/Zombie-Kaiser/CVE-2024-30088-Windows-poc/assets/141570642/419420ad-6df9-49b2-a54c-8cbf7abf6ba8)
提权因为需要条件竞争，所以需要耐心等待一会.

File Snapshot


 [4.0K]  /data/pocs/7f11c67ccb833ac1a691d96eefaf8a44bd82d56b
├── [ 11K]  LICENSE
├── [4.0K]  poc
│   ├── [3.7K]  ex.h
│   ├── [3.9K]  main.cpp
│   ├── [6.5K]  poc.vcxproj
│   ├── [1.1K]  poc.vcxproj.filters
│   ├── [ 168]  poc.vcxproj.user
│   └── [4.0K]  x64
│       └── [4.0K]  Release
│           ├── [221K]  main.obj
│           ├── [ 327]  poc.exe.recipe
│           ├── [ 62K]  poc.iobj
│           ├── [ 22K]  poc.ipdb
│           ├── [2.1K]  poc.log
│           ├── [4.0K]  poc.tlog
│           │   ├── [ 842]  CL.command.1.tlog
│           │   ├── [ 169]  Cl.items.tlog
│           │   ├── [ 26K]  CL.read.1.tlog
│           │   ├── [ 528]  CL.write.1.tlog
│           │   ├── [1.5K]  link.command.1.tlog
│           │   ├── [4.0K]  link.read.1.tlog
│           │   ├── [ 274]  link.secondary.1.tlog
│           │   ├── [ 530]  link.write.1.tlog
│           │   └── [ 196]  poc.lastbuildstate
│           └── [140K]  vc143.pdb
├── [ 525]  README.md
└── [4.0K]  x64
    └── [4.0K]  Release
        ├── [ 14K]  poc.exe
        └── [604K]  poc.pdb

6 directories, 24 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!