Win32k NtGdiResetDC Use-After-Free Elevation of Privilege

This repository contains a functional local privilege escalation exploit for CVE-2021-40449, a use-after-free (UAF) vulnerability in the Windows kernel component win32kfull!GreResetDCInternal. The exploit is implemented in C++ and consists of a Visual Studio solution with the main logic in 'exploit.cpp' and supporting definitions in 'defines.h'. The exploit works by leaking the current process's access token address, crafting a fake BitMapHeader structure, and using a kernel gadget (RtlSetAllBits) to overwrite the access token's privileges. It interacts with the Windows GDI subsystem, hooks printer driver callbacks, and triggers the UAF via ResetDC calls. After successful exploitation, it injects shellcode into the winlogon.exe process to spawn a SYSTEM shell. The exploit targets Windows 10 Redstone (build 14393) and requires local access. The repository is well-structured for building with Visual Studio and includes a detailed README explaining the exploitation steps and primitives used.

This repository contains a functional local privilege escalation exploit for CVE-2021-40449, a use-after-free vulnerability in the Windows Win32k subsystem. The exploit is implemented in C++ (CallbackHell/CallbackHell.cpp) and targets a range of Windows versions, including Windows Vista through Windows 10 and corresponding server editions. The exploit works by hooking a user-mode callback in a printer driver, triggering a use-after-free in the kernel via ResetDC, and manipulating kernel memory to enable all privileges on the current process token. After privilege escalation, the exploit injects shellcode (which launches cmd.exe) into the winlogon.exe process, resulting in SYSTEM-level code execution. The repository includes Visual Studio project files and a detailed README.md explaining the vulnerability, exploitation technique, and supported/targeted Windows versions. The main entry point is CallbackHell.cpp, which contains all exploit logic and the embedded shellcode payload.

This repository is a C-based proof-of-concept exploit for CVE-2021-40449, a Use-After-Free vulnerability in the Windows Win32k kernel component. The exploit is implemented as a Visual Studio project and consists of several C source and header files. The main entry point is 'main.c', which orchestrates the exploit steps: reading a user-supplied driver file, resolving kernel addresses, disabling SMEP, executing a kernel callback to map the driver, and restoring SMEP. The exploit works by hijacking a printer driver callback, triggering the UAF, and achieving arbitrary kernel function execution. The code is modular, with separate files for console output, utility functions, kernel mapping logic, and the exploit trigger. The exploit is local-only and requires access to a vulnerable Windows 10 system with a printer installed. No network endpoints are involved; the main fingerprintable artifacts are the use of 'ntoskrnl.exe' and the user-supplied driver file. The exploit is a POC and does not include weaponized or automated payload delivery, but it demonstrates reliable kernel code execution and driver mapping.

This repository contains a working local privilege escalation exploit for CVE-2021-40449, a Windows kernel vulnerability in the Win32k driver. The main exploit logic is implemented in 'CVE-2021-40449-x64.cpp', which is a C++ file targeting Windows 10 x64 versions 14393 and 17763. The exploit abuses a use-after-free (UAF) condition in the Win32k subsystem by manipulating printer device contexts and palettes, then leverages kernel memory corruption to escalate privileges. The exploit ultimately injects shellcode into the winlogon.exe process using standard Windows API calls (VirtualAllocEx, WriteProcessMemory, CreateRemoteThread), resulting in code execution as SYSTEM. The repository includes Visual Studio project files for building the exploit, and a README describing the affected Windows versions and a brief exploitation technique overview. No network or remote attack vectors are present; the exploit is purely local and requires code execution on the target machine.

This repository is a functional local privilege escalation exploit for CVE-2021-40449, a use-after-free vulnerability in the Windows win32k.sys kernel driver. The exploit is implemented in C with supporting assembly shellcode and is structured as a Visual Studio project. The main exploit logic is in 'CVE-2021-40449_poc.c', which sets up a heap spray and hooks the DrvEnablePDEV function in the XPS printer driver using the MinHook library. The exploit crafts a ROP chain and stack pivot to execute custom shellcode in kernel mode. The shellcode, defined in 'shellcode.c' and 'shellcode_iret_mystery_snail_1709.asm', locates the SYSTEM process and steals its token, granting SYSTEM privileges to the exploit process. The exploit is hardcoded for Windows 10 build 16299 (1709) and requires adaptation for other builds. The repository includes all necessary project and configuration files, as well as a README with compilation and adaptation instructions. No network endpoints are present; all exploitation is local and targets the Windows kernel via printer driver interfaces.