th3g3ntl3m4n84

GitHub · Repository owner · Source ID 1410153
Source profile

Source-scoped identity with 1 associated PoC and 1 linked vulnerability.

Showing 1 PoC on this page

GitHub

th3g3ntl3m4n84/CVE-2024-30088__Windows-TOCTOU-exploit

Repository PoC0Created 2026-04-16ExploitCVE-2024-300887 files

18.8 KiB

GitHubPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A modified exploit for CVE-2024-30088, a Windows Kernel TOCTOU race condition, adapted for non-interactive WinRM environments. It uses a race condition to obtain a handle to winlogon.exe, then spawns a SYSTEM-level process via CreateProcessFromHandle.

Backdoor review

No backdoor observed in reviewed code

The supplied text files (README.md, poc/ex.h, poc/main.cpp) describe and implement a proof-of-concept exploit for CVE-2024-30088, a Windows kernel TOCTOU elevation-of-privilege vulnerability. The code performs privilege escalation by racing a token information query to obtain a handle to winlogon.exe, then uses that handle to spawn a child process as SYSTEM. The hardcoded payload path payload withheld is a typical placeholder for demonstrating code execution in the SYSTEM context. No concealed backdoor, credential theft, persistence mechanism, or unrelated remote access behavior is present in the reviewed source code.

ClassificationExploit
Model confidence95%
AuthenticationRequired
LanguagesC++
Target softwareMicrosoft Windows Kernel
Attack typesTOCTOU race conditionprivilege escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code actively exploits CVE-2024-30088 by implementing a race condition to escalate privileges and spawn a SYSTEM process. It is not merely detecting the vulnerability; it exercises the vulnerability to achieve code execution with elevated privileges.

poc/main.cpp:117-140README.md:5-8

Requirements

  • Requires local low-privilege code execution on a vulnerable Windows system.poc/main.cpp:63
  • Requires a payload binary at payload withheld.poc/main.cpp:140

Observed behavior

  • Opens the current process token and leaks its kernel address.poc/main.cpp:73-74
  • Queries token information to locate a target offset for the race condition.poc/main.cpp:88-99
  • Executes a race condition by repeatedly calling NtQueryInformationToken in a loop while a high-priority thread modifies the token information buffer.poc/main.cpp:117-123
  • After winning the race, obtains a handle to winlogon.exe with PROCESS_ALL_ACCESS.poc/main.cpp:124-125
  • Uses the winlogon handle to spawn a SYSTEM-privileged process (powershell.exe launching payload withheld).poc/main.cpp:140
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Hardcoded Payload Path
Payload withheldThe exploit launches a hardcoded executable via PowerShell to demonstrate SYSTEM-level code execution. This is a standard PoC pattern and does not constitute a backdoor.poc/main.cpp:140README.md:21-28
Privilege Escalation Technique
Payload withheldThe core exploit logic races a kernel token information query to gain a handle to winlogon.exe, then creates a child process inheriting its SYSTEM token. This is the documented CVE-2024-30088 technique.poc/main.cpp:56-62poc/main.cpp:117-134poc/main.cpp:140
Review boundaries

What the analysis did not establish

  • Evidence includes only 3 of 7 repository files; 4 files are omitted and unclassified.
  • The evidence does not include the compiled binary or the payload (shellz.exe).
  • The analysis is based solely on static source code review; no dynamic execution or verification was performed.
  • Only the three text files (README.md, poc/ex.h, poc/main.cpp) were reviewed. Four additional files in the repository (likely project/solution files and a precompiled binary) were not inspected. The compiled binary could differ from the provided source code.
  • The review does not verify that the exploit works as claimed or that it is safe to execute.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.