Privilege Escalation in iTunes for Windows

This repository contains a proof-of-concept (PoC) exploit for CVE-2023-32353, a privilege escalation vulnerability in Apple iTunes for Windows (prior to 12.12.9). The exploit is implemented in C++ and consists of two main components: a utility library (CommonUtils) for manipulating Windows symlinks, mount points, and registry links, and the main exploit logic in 'Privilege-Escalation-using-Music-Player/Source.cpp'. The exploit works by: 1. Deleting the contents of the iTunes data directory (C:\ProgramData\Apple Computer\iTunes). 2. Creating a mount point from this directory to the Windows object namespace '\RPC Control'. 3. Creating a symlink from '\RPC Control\SC Info' to '\??\C:\Windows\System32\wermgr.exe.local'. 4. Forcing a repair of iTunes via its MSI installer, which causes the installer (running as SYSTEM) to create a directory structure under wermgr.exe.local with permissive permissions. 5. Placing a crafted DLL (comctl32.dll) in a subfolder under wermgr.exe.local, named after a folder found in C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_* 6. Triggering the execution of wermgr.exe as SYSTEM via a scheduled task, causing the malicious DLL to be loaded and executed as SYSTEM. The exploit is a local privilege escalation and requires the attacker to have the ability to run code and manipulate files on the target system. The repository is well-structured, with clear separation between utility code and exploit logic, and includes a detailed README explaining the vulnerability, exploitation steps, and mitigation.