Ancillary Function Driver Elevation of Privilege Vulnerability

This repository is a small standalone local privilege-escalation exploit for MS11-046 / CVE-2011-1249 affecting the Windows AFD.sys driver. It contains only two files: a README describing the vulnerability, MinGW-related fixes, build instructions, and usage examples; and a single C source file, ms11-046.c, which implements the exploit logic. The code is not part of a larger framework. The exploit targets vulnerable 32-bit Windows systems and requires prior local code execution as a low-privileged user. Its core capability is elevating privileges to NT AUTHORITY\SYSTEM by abusing the AFD driver through a crafted DeviceIoControl request. After kernel execution is achieved, it triggers execution through the HalDispatchTable/NtQueryIntervalProfile technique and then runs a post-exploitation command in SYSTEM context. A notable modification in this fork is operational usability rather than exploit-chain changes: it fixes MinGW compilation issues by replacing a generic FARPROC declaration for ZwQuerySystemInformation with a typed function pointer, fixes a dangling-pointer bug in patch-list handling, and adds argv[1]-based custom command execution. As a result, the exploit can either spawn cmd.exe as SYSTEM or execute arbitrary commands/payload paths supplied by the operator, such as adding a user or launching a custom executable. Fingerprintable artifacts are mostly local rather than network-based. The main target endpoint is the Windows device path \\.\AFD\Endpoint, and the exploit uses IOCTL 0x00012007 to reach the vulnerable code path. There are no hardcoded C2 servers, remote URLs, or exfiltration endpoints in the exploit logic itself. The remaining URLs in the repository are documentation and patch-reference links. Overall, this is a real, functional local kernel LPE proof-of-concept with a basic but practical payload execution mechanism, making it operational rather than merely demonstrative.

This repository contains a local privilege escalation exploit for Microsoft Windows (CVE-2011-1249, MS11-046), targeting a vulnerability in the AFD (Ancillary Function Driver) kernel driver (afd.sys). The exploit is implemented in C (file: 40564.c) and is designed to be compiled for Windows x86 systems using MinGW. The exploit requires local access to a vulnerable, unpatched Windows system (XP, Server 2003, Vista, Server 2008, or Windows 7 x86). Upon execution, it leverages a flaw in afd.sys to elevate the current user's privileges to SYSTEM and spawns a SYSTEM-level command shell (cmd.exe). The README provides compilation instructions and screenshots of successful exploitation. No network endpoints are involved; the attack vector is strictly local. The exploit is operational and provides a working SYSTEM shell if the target is vulnerable.