CVE-2024-0197 PoC — Privilege Escalation in Thales SafeNet Sentinel HASP LDK

Source

https://github.com/ewilded/CVE-2024-0197-POC

Associated Vulnerability

Title: Privilege Escalation in Thales SafeNet Sentinel HASP LDK (CVE-2024-0197)
Description:A flaw in the installer for Thales SafeNet Sentinel HASP LDK prior to 9.16 on Windows allows an attacker to escalate their privilege level via local access.

Description

Proof of concept for Local Privilege Escalation in Thales Sentinel HASP LDK.

Readme

# CVE-2024-0197-POC
Proof of concept for Local Privilege Escalation in Thales Sentinel HASP LDK.
I initially wanted to develop one, but eventually that turned out to be unnecessary.
There is no race condition to win, and a simple DLL search order hijacking from a known location suffices to attain SYSTEM.

We simply:
1. compile raw.cpp as fltlib.dll and put it into AppData\Local\Temp (it has to be a proper proxy DLL leading to C:\Windows\System32\fltlib.dll).
2. then just run msiexec.exe /fa PATH_TO_MSI.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →