Windows Error Reporting Service Elevation of Privilege Vulnerability

This repository contains a single Metasploit module (Ruby file) that exploits CVE-2023-36874, a local privilege escalation vulnerability in Microsoft Windows Error Reporting. The exploit abuses the way Windows locates the error report parser by manipulating directory structures and placing a malicious executable (payload) in a crafted path, causing it to be executed as SYSTEM. The module is highly weaponized, allowing the user to select a payload (such as a reverse shell or meterpreter), which is uploaded and executed with SYSTEM privileges. The exploit requires a session on the target (meterpreter, shell, or powershell) and is primarily intended for Windows 10 22H2, though it may work on other versions. The code handles all steps: creating directories, uploading crafted error reports and payloads, and executing the exploit. The main fingerprintable endpoints are the file paths used for the error report and payload placement. The repository is structured as a single Metasploit exploit module, with all logic contained in one Ruby file.

This repository is a proof-of-concept (PoC) exploit for CVE-2023-36874, a Windows privilege escalation vulnerability. The exploit is written in C++ and consists of two main components: 1. The main exploit (main.cpp) manipulates Windows Error Reporting (WER) infrastructure by creating directories, files, and symbolic links in the Windows object namespace. It leverages COM interfaces and native Windows APIs to create a crafted WER report and symbolic links, redirecting system operations to attacker-controlled locations (notably C:\test and C:\ProgramData). 2. The payload (wermgr/main.cpp) is a separate executable that, when run as SYSTEM (due to the exploit), creates a new local user 'admin' with a preset password and adds it to the Administrators group, effectively granting full system access to the attacker. The README provides setup instructions, requiring the attacker to place a malicious wermgr.exe in C:\test\system32 and run the compiled PoC. The exploit targets Windows 10 (tested on build 19045.2006) and demonstrates a local privilege escalation scenario. No network endpoints are involved; all actions are performed locally via file system and Windows object namespace manipulation. The repository includes header files (def.h, resource.h) for COM and resource definitions, and a resource file for embedding the WER report. The exploit is operational, providing a working privilege escalation path on vulnerable systems.

This repository contains a proof-of-concept (PoC) exploit for CVE-2023-36874, a vulnerability in the Windows Error Reporting (WER) component on Microsoft Windows. The main file, PoC.cpp, is a C++ program that demonstrates how to interact with WER's COM interfaces to trigger the vulnerability. The exploit initializes COM, creates and uses several WER-related COM interfaces (IErcLuaSupport, IWerStoreFactory, IWerStore, IWerReport), and follows a sequence of method calls to enumerate, load, and submit a crafted error report (the report name is a placeholder and should be replaced with a real target report). The README.md provides a detailed step-by-step explanation of the exploit process and reiterates that the code is for educational purposes only. No network or remote endpoints are involved; the exploit is purely local and targets the Windows platform. The repository is structured simply, with one code file and a README, and is intended as a PoC rather than a weaponized or operational exploit.

This repository provides a mature, operational Cobalt Strike Beacon Object File (BOF) exploit for CVE-2023-36874, a local privilege escalation vulnerability in the Windows Error Reporting (WER) service. The exploit is implemented as a Cobalt Strike script (wer_lpe.cna) and a compiled BOF (from src/main.cpp), allowing an attacker with code execution on a vulnerable Windows 10/11 (21H1-22H2) system to upload and execute an arbitrary EXE as SYSTEM. The exploit works by creating a specially crafted directory and Report.wer file in the WER ReportArchive, then triggering the vulnerability to run the payload with elevated privileges. The code includes OPSEC features such as randomized directory names and automatic cleanup of dropped files and directories. The exploit is not effective against users with local admin rights and is not a UAC bypass. The repository is structured with source code (src/), a Cobalt Strike script (dist/wer_lpe.cna), and build instructions (makefile).

This repository contains a proof-of-concept exploit for CVE-2023-36874, targeting Microsoft Windows. The main file, poc.cpp, demonstrates a local privilege escalation technique by manipulating the Windows Error Reporting (WER) system. The exploit creates a controlled directory structure and files, sets up a symbolic link to redirect the C: drive to a user-controlled path, and uses COM interfaces to trigger WER operations. The goal is to have WER execute a controlled binary (wermgr.exe) from the attacker's directory, potentially leading to privilege escalation. The repository consists of a README and a single C++ proof-of-concept file, with no external dependencies or framework usage. The exploit is a local attack and does not involve network endpoints.