Win32k Elevation of Privilege Vulnerability

This repository provides a local privilege escalation exploit for CVE-2023-41772, targeting Windows 10 (1809 and up) and Windows 11. The exploit leverages a logic bug in UIAccess processes and the win32kfull.sys driver, allowing a non-admin user to obtain a process handle with full rights to the dwm.exe process (running as LocalService). The main components are: - 'uiaccess_exploit.c': The main exploit executable, which checks for UIAccess privileges, attempts to obtain a privileged process handle, and spawns a new process with elevated rights. - 'uiaccess_exploit_dll.c': A helper DLL that is loaded by a privileged process and runs JuicyPotatoNG to escalate privileges to SYSTEM. - 'exploit_cleanup.bat': A batch script to clean up files dropped during exploitation. - 'README.md': Provides usage instructions, including the need to place the exploit binaries and JuicyPotatoNG.exe in C:\Exploit and run the exploit as a non-admin user. The exploit requires the user to compile the provided C code into an executable and DLL, place them along with JuicyPotatoNG.exe in a specific directory, and execute the exploit. Upon success, a SYSTEM-level command prompt is spawned. The exploit is operational and demonstrates a full privilege escalation chain, but requires manual setup and is not weaponized for automated deployment. Several file system endpoints are involved, both for setup and cleanup.