CVE-2016-3309 PoC — Microsoft Win32k 特权提升漏洞

Source

https://github.com/siberas/CVE-2016-3309_Reloaded

Associated Vulnerability

Title:Microsoft Win32k 特权提升漏洞 (CVE-2016-3309)
Description:Microsoft Windows是美国微软（Microsoft）公司发布的一系列操作系统。kernel-mode drivers是其中的一个内核驱动管理软件。Graphics是其中的一个图形驱动器组件。 Microsoft Windows中的kernel-mode驱动程序存在特权提升漏洞，该漏洞源于程序没有正确处理内存中的对象。本地攻击者可利用该漏洞在内核模式下执行任意代码。以下版本受到影响：Microsoft Windows Vista SP2，Windows Server 2008 SP2和R2 S

Description

Exploits for the win32kfull!bFill vulnerability on Win10 x64 RS2 using Bitmap or Palette techniques

Readme

## Kernel Exploitation Case Study - "Wild" Pool Overflow on Win10 x64 RS2 (CVE-2016-3309 Reloaded)

This Github repo contains exploits for the recently-patched win32kfull!bFill vulnerability. Executing the Palette or Bitmap exploit will give you SYSTEM privileges on the affected system. The exploits should work fine on Windows 10 x64 with Creators Update, build 15063.540 (latest version of Win10 before the release of Microsoft's September Updates).

The Visual Studio solution contains three exploits:

- CVE-2016-3309_Reloaded_Bitmaps: Exploit using the Bitmaps technique
- CVE-2016-3309_Reloaded_Palettes: Exploit using the Palettes technique
- CVE-2016-3309_Reloaded_Deadlock: POC exploit showcasing the system deadlock which happens due to improved Handle validation

We also published a [blog post](https://siberas.de/blog/2017/10/05/exploitation_case_study_wild_pool_overflow_CVE-2016-3309_reloaded.html) which goes into detail about the exploitation of this "wild" Pool-based overflow.

File Snapshot


 [4.0K]  /data/pocs/c0ec2cfeaa0e37350f5f25143ce89d28e91061ef
├── [4.0K]  CVE-2016-3309_Reloaded_Bitmaps
│   ├── [7.3K]  CVE-2016-3309_Reloaded_Bitmaps.vcxproj
│   ├── [ 964]  CVE-2016-3309_Reloaded_Bitmaps.vcxproj.filters
│   └── [ 23K]  main_bitmaps.cpp
├── [4.0K]  CVE-2016-3309_Reloaded_Deadlock
│   ├── [7.3K]  CVE-2016-3309_Reloaded_Deadlock.vcxproj
│   ├── [ 965]  CVE-2016-3309_Reloaded_Deadlock.vcxproj.filters
│   └── [8.7K]  main_deadlock.cpp
├── [4.0K]  CVE-2016-3309_Reloaded_Palettes
│   ├── [7.3K]  CVE-2016-3309_Reloaded_Palettes.vcxproj
│   ├── [ 965]  CVE-2016-3309_Reloaded_Palettes.vcxproj.filters
│   └── [ 21K]  main_palettes.cpp
├── [2.9K]  CVE-2016-3309_Reloaded.sln
├── [ 50K]  CVE-2016-3309_Reloaded.suo
└── [1007]  README.md

3 directories, 12 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!