CVE-2021-40449 PoC — Win32k Elevation of Privilege Vulnerability

Source

https://github.com/Kristal-g/CVE-2021-40449_poc

Associated Vulnerability

Title: Win32k Elevation of Privilege Vulnerability (CVE-2021-40449)
Description:Win32k Elevation of Privilege Vulnerability

Description

Exploit for CVE-2021-40449

Readme

# CVE-2021-40449
More info here: [https://kristal-g.github.io/2021/11/05/CVE-2021-40449_POC.html](https://kristal-g.github.io/2021/11/05/CVE-2021-40449_POC.html)

## Compiling
I did a bit of a hack with the MinHook library so it supports (somewhat partially) the 2019 Platform Toolset.  
That's why I included the lib files with this repo.  
  
## Windows Version Adapting
To adapt this repo to another Windows build you have to fix:
* ntoskrnl.exe gadgets offsets for the rop chain
* `MiGetPteAddress` offset in ntoskrnl.exe
* The size of palettes, according to the (undocumented) size of `PDEVOBJ` (look at `win32kbase!PDEV::Allocate`)
* Shellcode offsets of various structs (`shellcode_offsets` struct)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →