Privilege Escalation in Lenovo HardwareScanPlugin / Lenovo Diagnostics Driver

This repository contains a single Metasploit module targeting CVE-2022-3699, a local privilege escalation vulnerability in the Lenovo Diagnostics Driver for Windows. The exploit abuses incorrect access control in the driver, allowing a low-privileged user to issue IOCTLs for arbitrary memory read/write, ultimately enabling code execution as SYSTEM. The module is written in Ruby and is structured as a standard Metasploit local exploit, requiring a Meterpreter session on a compatible Windows system with the vulnerable driver present. The exploit checks for the presence of the driver (\\.\LenovoDiagnosticsDriver) and ensures the target Windows version is supported. Upon exploitation, it injects a payload (typically a Meterpreter shell) via a reflective DLL, granting elevated privileges. The repository is operational and ready for use within the Metasploit framework.

This repository is an operational exploit for CVE-2022-3699, targeting the LenovoDiagnosticsDriver (ldiagd.sys) on Windows systems. The exploit is implemented in C++ and is structured as a Visual Studio project. The main exploit logic resides in the 'LenovoMemoryMgr' class, which provides methods to interact with the vulnerable driver via IOCTLs, allowing arbitrary physical and virtual memory reads/writes and kernel function invocation. The exploit demonstrates kernel code execution by allocating kernel pool memory using ExAllocatePoolWithTag. It also includes logic to inject and execute custom shellcode in kernel space. The entry point is 'main.cpp', which initializes the exploit, locates kernel exports, and performs the kernel function call. The repository includes utility code for parsing PDB files and resolving kernel structure offsets. The primary attack vector is local, requiring the attacker to execute code on the target system with access to the vulnerable driver. Notable endpoints include the device path '\\.\LenovoDiagnosticsDriver', the driver file 'ldiagd.sys', and the Microsoft symbol server URL for PDB downloads.

This repository contains a working local privilege escalation exploit for CVE-2022-3699, targeting the Lenovo Diagnostics Driver on Windows. The exploit is implemented in C++ and consists of a Visual Studio solution with the main logic in 'LenovoMemoryMgr.cpp', 'LenovoMemoryMgr.h', and 'Source.cpp'. The exploit leverages insufficient access control in the driver, allowing unprivileged users to issue IOCTLs for arbitrary physical and virtual memory read/write operations. The code locates the EPROCESS structures for the current and SYSTEM processes, reads the SYSTEM process token, and overwrites the current process token, effectively granting SYSTEM privileges. The exploit then spawns a SYSTEM shell (cmd.exe). The device endpoint used is '\\.\LenovoDiagnosticsDriver'. The exploit requires the vulnerable driver to be present and accessible, and was tested on Windows 11 21H2 with HVCI disabled. The repository is well-structured for building with Visual Studio and provides a clear demonstration of the vulnerability's impact.