Win32k NtGdiResetDC Use-After-Free Privilege Escalation

This repository contains a single Metasploit module implementing a local privilege escalation exploit for CVE-2021-40449, a use-after-free vulnerability in the Win32k NtGdiResetDC function on Windows. The exploit targets Windows 10 x64 (RS1, RS5, and likely other builds), Windows 11, and Windows Server 2022, allowing an attacker with a Meterpreter session to elevate privileges to SYSTEM. The module checks the target's Windows build and revision to determine vulnerability, and uses reflective DLL injection to execute a custom payload as SYSTEM. The payload is typically a Meterpreter shell, but can be customized. The exploit is weaponized, as it is part of the Metasploit framework and supports arbitrary payloads. The only file present is the Metasploit Ruby module, which orchestrates the exploit and payload delivery.

This repository contains a functional local privilege escalation exploit for CVE-2021-40449, a use-after-free (UAF) vulnerability in the Windows kernel component win32kfull!GreResetDCInternal. The exploit is implemented in C++ and consists of a Visual Studio solution with the main logic in 'exploit.cpp' and supporting definitions in 'defines.h'. The exploit works by leaking the current process's access token address, crafting a fake BitMapHeader structure, and using a kernel gadget (RtlSetAllBits) to overwrite the access token's privileges. It interacts with the Windows GDI subsystem, hooks printer driver callbacks, and triggers the UAF via ResetDC calls. After successful exploitation, it injects shellcode into the winlogon.exe process to spawn a SYSTEM shell. The exploit targets Windows 10 Redstone (build 14393) and requires local access. The repository is well-structured for building with Visual Studio and includes a detailed README explaining the exploitation steps and primitives used.

This repository contains a functional local privilege escalation exploit for CVE-2021-40449, a use-after-free vulnerability in the Windows Win32k subsystem. The exploit is implemented in C++ (CallbackHell/CallbackHell.cpp) and targets a range of Windows versions, including Windows Vista through Windows 10 and corresponding server editions. The exploit works by hooking a user-mode callback in a printer driver, triggering a use-after-free in the kernel via ResetDC, and manipulating kernel memory to enable all privileges on the current process token. After privilege escalation, the exploit injects shellcode (which launches cmd.exe) into the winlogon.exe process, resulting in SYSTEM-level code execution. The repository includes Visual Studio project files and a detailed README.md explaining the vulnerability, exploitation technique, and supported/targeted Windows versions. The main entry point is CallbackHell.cpp, which contains all exploit logic and the embedded shellcode payload.

This repository is a C-based proof-of-concept exploit for CVE-2021-40449, a Use-After-Free vulnerability in the Windows Win32k kernel component. The exploit is implemented as a Visual Studio project and consists of several C source and header files. The main entry point is 'main.c', which orchestrates the exploit steps: reading a user-supplied driver file, resolving kernel addresses, disabling SMEP, executing a kernel callback to map the driver, and restoring SMEP. The exploit works by hijacking a printer driver callback, triggering the UAF, and achieving arbitrary kernel function execution. The code is modular, with separate files for console output, utility functions, kernel mapping logic, and the exploit trigger. The exploit is local-only and requires access to a vulnerable Windows 10 system with a printer installed. No network endpoints are involved; the main fingerprintable artifacts are the use of 'ntoskrnl.exe' and the user-supplied driver file. The exploit is a POC and does not include weaponized or automated payload delivery, but it demonstrates reliable kernel code execution and driver mapping.

This repository contains a working local privilege escalation exploit for CVE-2021-40449, a Windows kernel vulnerability in the Win32k driver. The main exploit logic is implemented in 'CVE-2021-40449-x64.cpp', which is a C++ file targeting Windows 10 x64 versions 14393 and 17763. The exploit abuses a use-after-free (UAF) condition in the Win32k subsystem by manipulating printer device contexts and palettes, then leverages kernel memory corruption to escalate privileges. The exploit ultimately injects shellcode into the winlogon.exe process using standard Windows API calls (VirtualAllocEx, WriteProcessMemory, CreateRemoteThread), resulting in code execution as SYSTEM. The repository includes Visual Studio project files for building the exploit, and a README describing the affected Windows versions and a brief exploitation technique overview. No network or remote attack vectors are present; the exploit is purely local and requires code execution on the target machine.

This repository is a functional local privilege escalation exploit for CVE-2021-40449, a use-after-free vulnerability in the Windows win32k.sys kernel driver. The exploit is implemented in C with supporting assembly shellcode and is structured as a Visual Studio project. The main exploit logic is in 'CVE-2021-40449_poc.c', which sets up a heap spray and hooks the DrvEnablePDEV function in the XPS printer driver using the MinHook library. The exploit crafts a ROP chain and stack pivot to execute custom shellcode in kernel mode. The shellcode, defined in 'shellcode.c' and 'shellcode_iret_mystery_snail_1709.asm', locates the SYSTEM process and steals its token, granting SYSTEM privileges to the exploit process. The exploit is hardcoded for Windows 10 build 16299 (1709) and requires adaptation for other builds. The repository includes all necessary project and configuration files, as well as a README with compilation and adaptation instructions. No network endpoints are present; all exploitation is local and targets the Windows kernel via printer driver interfaces.

This repository is a proof-of-concept (POC) exploit for CVE-2021-40449, a use-after-free vulnerability in the Windows GDI (NtGdiResetDC) subsystem. The exploit targets Windows 10 version 1809 x64 and leverages user-space memory allocation to trigger the vulnerability. The main exploit logic is implemented in 'Source/main.cpp', which orchestrates the following steps: retrieves a printer name, prepares the environment, creates a printer device context, hooks a driver function, and triggers the vulnerability via ResetDC. Upon successful exploitation, the code injects shellcode into the winlogon.exe process using VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread, resulting in a SYSTEM-level command shell (cmd.exe). The repository also includes 'Source/detours.h', a third-party header for function detouring, but the exploit logic is self-contained in the main.cpp file. The attack vector is local privilege escalation, requiring the attacker to execute code on the target system. The exploit is operational, with a hardcoded payload and specific targeting of Windows 10 1809 x64.