Public Exploit On Windows Privilege Escalation

The security researchers has publicly released an exploit for a Windows local privilege elevation flaw (CVE-2022-21882) that allows anyone to gain admin privileges in Windows 10.

The Win32k elevation of privilege vulnerability was fixed this month as part of the January 2022 Patch Tuesday, it is the result of a bypass for the previously CVE-2021-1732 flaw.

An authenticated attacker could gain elevated local system or administrator privileges through a vulnerability in the Win32k.sys driver.

By exploiting the vulnerability, threat actors with limited access to a compromised device can easily elevate their privileges to help spread laterally within the network, create new administrative users, or perform privileged commands.

Attacker can intercept this through hook in KernelCallbackTable,anduse NtUserConsoleControl method to set the ConsoleWindow flag of the tagWND object, which will modify the window type. Once after the final callback, the system does not check whether the window type has changed, and the wrong data is referenced due to type confusion.

The difference before and after the flag modified is that before setting the flag, the system thinks that tagWND.WndExtra saves a user_mode pointer. After the flag is set, the system thinks that tagWND. WndExtra is the offset of the kernel desktop heap, and attacker can control this offset, then cause out-of-bounds R&W.

Administrators that have yet to install January 2022 security updates are recommended to do it as soon as possible to prevent attacks exploiting this issue.