关联漏洞
标题:Microsoft Win32k 资源管理错误漏洞 (CVE-2021-40449)Description:Microsoft Win32k是美国微软（Microsoft）公司的一个用于Windows多用户管理的系统文件。 Microsoft Windows Win32K存在资源管理错误漏洞。以下产品和版本受到影响：Windows 10 Version 1809 for 32-bit Systems,Windows 10 Version 1809 for x64-based Systems,Windows 10 Version 1809 for ARM64-based Systems,Windows Serve
Description
Exploit for CVE-2021-40449
介绍
# CVE-2021-40449
More info here: [https://kristal-g.github.io/2021/11/05/CVE-2021-40449_POC.html](https://kristal-g.github.io/2021/11/05/CVE-2021-40449_POC.html)
## Compiling
I did a bit of a hack with the MinHook library so it supports (somewhat partially) the 2019 Platform Toolset.
That's why I included the lib files with this repo.
## Windows Version Adapting
To adapt this repo to another Windows build you have to fix:
* ntoskrnl.exe gadgets offsets for the rop chain
* `MiGetPteAddress` offset in ntoskrnl.exe
* The size of palettes, according to the (undocumented) size of `PDEVOBJ` (look at `win32kbase!PDEV::Allocate`)
* Shellcode offsets of various structs (`shellcode_offsets` struct)
文件快照
[4.0K] /data/pocs/f1490b6520d726367e238d02f1dd61c5fd0a2e87
├── [4.0K] CVE-2021-40449_poc
│ ├── [9.8K] CVE-2021-40449_poc.c
│ ├── [8.0K] CVE-2021-40449_poc.vcxproj
│ ├── [1.2K] CVE-2021-40449_poc.vcxproj.filters
│ ├── [ 132] packages.config
│ ├── [8.7K] shellcode.c
│ ├── [ 804] shellcode.h
│ └── [4.0K] x64
│ └── [4.0K] Release
│ └── [154K] CVE-2021-40449_poc.exe
├── [1.4K] CVE-2021-40449_poc.sln
├── [4.0K] packages
│ └── [4.0K] minhook.1.3.3
│ ├── [4.0K] build
│ │ └── [4.0K] native
│ │ └── [ 15K] minhook.targets
│ └── [4.0K] lib
│ └── [4.0K] native
│ ├── [4.0K] include
│ │ └── [7.3K] MinHook.h
│ └── [4.0K] lib
│ ├── [ 38K] libMinHook.lib
│ ├── [ 38K] libMinHook.x64.lib
│ ├── [ 38K] libMinHook-x64-v140-mdd.lib
│ ├── [267K] libMinHook-x64-v140-md.lib
│ ├── [ 38K] libMinHook-x64-v140-mtd.lib
│ ├── [267K] libMinHook-x64-v140-mt.lib
│ ├── [ 38K] libMinHook-x64-v141-mdd.lib
│ ├── [269K] libMinHook-x64-v141-md.lib
│ ├── [ 38K] libMinHook-x64-v141-mtd.lib
│ ├── [269K] libMinHook-x64-v141-mt.lib
│ ├── [213K] libMinHook-x64-v142-mtd.lib
│ ├── [ 26K] libMinHook-x86-v140-mdd.lib
│ ├── [249K] libMinHook-x86-v140-md.lib
│ ├── [ 26K] libMinHook-x86-v140-mtd.lib
│ ├── [249K] libMinHook-x86-v140-mt.lib
│ ├── [ 26K] libMinHook-x86-v141-mdd.lib
│ ├── [251K] libMinHook-x86-v141-md.lib
│ ├── [ 26K] libMinHook-x86-v141-mtd.lib
│ └── [251K] libMinHook-x86-v141-mt.lib
├── [ 706] README.md
└── [1.6K] shellcode_iret_mystery_snail_1709.asm
11 directories, 31 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮件到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对 POC 代码进行快照，为了长期维护，请考虑为本地 POC 付费/捐赠，感谢您的支持。