Windows Common Log File System Driver Elevation of Privilege Vulnerability

This is a compact Windows local privilege escalation repository consisting of a single substantive source file (main.cpp) plus a resource header. It is not a framework module. The code is a native C++ proof-of-concept/operational exploit targeting a Windows kernel vulnerability identified by the repository metadata as CVE-2024-49138 and using CLFS-related components (clfsw32.h / Clfsw32.lib). Repository structure: main.cpp contains all exploit logic, including kernel base discovery, handle-to-kernel-address resolution, setup of native API function pointers, vulnerability triggering, validation of arbitrary read/write, token stealing, and shell spawning. resource.h only defines a resource identifier and appears ancillary. Main exploit capability: the code aims to convert a vulnerability trigger into arbitrary kernel read/write primitives by calling NtReadVirtualMemory and NtWriteVirtualMemory with pseudo-handle -1 after the bug is triggered. It then enumerates loaded drivers to find the ntoskrnl base, uses hardcoded offsets for kernel globals/structures (such as PsActiveProcessHead, ActiveProcessLinks, UniqueProcessId, Token, and token privilege fields), walks the active process list to find the current process, reads the SYSTEM token from the SYSTEM EPROCESS, overwrites the current process token with that SYSTEM token, restores KTHREAD PreviousMode, and finally launches cmd.exe. This is classic token-stealing LPE behavior. Notable implementation details: the exploit uses EnumDeviceDrivers/GetDeviceDriverBaseName to identify the kernel base; dynamically resolves NtQuerySystemInformation from ntdll; allocates and parses SystemHandleInformation to map user handles to kernel object addresses; and relies on build-specific hardcoded offsets, which means reliability is likely limited to specific Windows versions/builds. The presence of CLFS headers and library linkage strongly suggests the vulnerability trigger abuses CLFS internals, though the provided excerpt truncates the exact trigger path. Overall purpose: achieve local elevation from a normal user context to SYSTEM on a vulnerable Windows host, then provide an interactive SYSTEM shell. This is a real exploit, not merely a detector, and includes an actual post-exploitation payload.

This repository is a Proof-of-Concept (PoC) exploit for CVE-2024-49138, a privilege escalation vulnerability in the Microsoft Windows CLFS.sys driver. The main exploit logic is implemented in 'CVE-2024-49138-POC.cpp', which is a C++ program designed to be built as a 64-bit Windows executable. The exploit works by leveraging a vulnerability in CLFS.sys to achieve arbitrary kernel read/write, then locates the current process's EPROCESS structure, swaps its token with that of the SYSTEM process, and finally spawns a SYSTEM-level command shell (cmd.exe). The exploit uses several hardcoded kernel structure offsets and interacts directly with kernel memory via NtReadVirtualMemory and NtWriteVirtualMemory. It creates and uses the directory 'C:\temp' and a resource file 'mylogdddd.blf.blf' as part of the exploitation process. The repository includes Visual Studio project files for building the exploit, a resource header and script, and a README with build instructions and sample output demonstrating successful privilege escalation. No network endpoints are involved; the attack vector is local privilege escalation on a vulnerable Windows system.

This repository contains a working proof-of-concept (POC) exploit for CVE-2024-49138, a local privilege escalation vulnerability in the Microsoft Windows CLFS.sys driver. The main exploit logic is implemented in 'CVE-2024-49138-POC.cpp', which is a C++ application designed to be built and run on Windows 11 23H2. The exploit abuses a vulnerability in CLFS.sys to achieve arbitrary kernel read/write, then locates and swaps the current process token with the SYSTEM process token, finally spawning a SYSTEM shell (cmd.exe). The README provides hashes of the tested driver and kernel files, as well as detailed usage instructions and output examples. The exploit requires local access and is not a remote exploit. The repository includes Visual Studio project files, a resource script, and a small resource file, but the core exploit is in the C++ source file. The attack vector is local, targeting the Windows kernel via a vulnerable driver. The exploit is operational and provides a SYSTEM shell if successful.