CVE-2023-21752 PoC — Microsoft Windows 安全漏洞

Source

https://github.com/Wh04m1001/CVE-2023-21752

Associated Vulnerability

Title:Microsoft Windows 安全漏洞 (CVE-2023-21752)
Description:Microsoft Windows是美国微软（Microsoft）公司的一套个人设备使用的操作系统。 Microsoft Windows Backup Service存在安全漏洞。攻击者利用该漏洞可以提升权限。

Readme

# CVE-2023-21752

PoC for arbitrary file delete vulnerability in Windows Backup service.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21752

This repo contains two exploits:

v1 - Just perform file delete of user choice 

v2 - Tries to abuse arb delete to spawn elevated cmd shell (not very stable probably need to run it couple of times, better work on phisycal machine)





https://user-images.githubusercontent.com/44291883/211601142-c04534e5-f718-478d-b91a-65d6a4f06080.mp4


# Timeline

- 07/07/2022 - Vulnerability reported to MSRC
- 08/10/2022 - MSRC confirmed vulnerability 
- 08/12/2022 - Bounty awarded
- 01/10/2023 - Patch released

File Snapshot


 [4.0K]  /data/pocs/aa408a4cd2a7084f318391ccf1f7a938711f10f0
├── [ 664]  README.md
├── [4.0K]  v1
│   └── [4.0K]  SDRsvcEop
│       ├── [5.5K]  def.h
│       ├── [4.3K]  FileOplock.cpp
│       ├── [ 986]  FileOplock.h
│       ├── [8.9K]  main.cpp
│       ├── [1.4K]  SDRsvcEop.sln
│       ├── [7.2K]  SDRsvcEop.vcxproj
│       ├── [1.3K]  SDRsvcEop.vcxproj.filters
│       └── [ 168]  SDRsvcEop.vcxproj.user
└── [4.0K]  v2
    └── [4.0K]  SDRsvcEop
        ├── [558K]  cmd.rbs
        ├── [6.0K]  def.h
        ├── [4.3K]  FileOplock.cpp
        ├── [ 986]  FileOplock.h
        ├── [ 14K]  main.cpp
        ├── [184K]  Msi_Rollback.msi
        ├── [ 514]  resource.h
        ├── [1.6K]  resource.rc
        ├── [1.4K]  SDRsvcEop.sln
        ├── [7.3K]  SDRsvcEop.vcxproj
        ├── [1.5K]  SDRsvcEop.vcxproj.filters
        └── [ 168]  SDRsvcEop.vcxproj.user

4 directories, 21 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!