uname1able/CVE-2022-24481

GitHubRepository PoCExploit

PoC files

20 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact contains two C++ programs (win10_poc.cpp and win11_poc.cpp) that exploit CVE-2022-24481, a Windows Common Log File System (CLFS) driver elevation of privilege vulnerability. The code crafts a malicious .blf log file, triggers the vulnerability via CreateLogFile, and uses kernel memory manipulation to replace the current process token with a SYSTEM token, ultimately spawning an elevated command prompt.

Backdoor review

No backdoor observed in reviewed code

The supplied PoC code for CVE-2022-24481 performs expected privilege escalation steps: it creates and manipulates CLFS log files, triggers the vulnerability, and then replaces the current process token with a SYSTEM token to launch a command prompt. No concealed backdoor, unrelated payload, or deceptive behavior was observed in the reviewed text files.

ClassificationExploit
Model confidence95%
AuthenticationRequired
LanguagesC++
Target softwareMicrosoft Windows Common Log File System Driver
Attack typeselevation_of_privilegetoken_manipulation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code actively exploits the vulnerability by crafting a malicious .blf file, triggering the kernel bug, and using the resulting arbitrary kernel read/write to replace the process token with a SYSTEM token, ultimately spawning an elevated command prompt. This is a full end-to-end exploit, not merely a scanner or writeup.

win10_poc/win10_poc.cpp:87-157win11_poc/win11_poc.cpp:207-261

Requirements

  • Low-privilege user execution on a vulnerable Windows version (e.g., Windows 10 21H2, Windows 11 21H2).README.md:3-5
  • Ability to create and modify CLFS log files and containers in the current directory.win10_poc/win10_poc.cpp:31-51
  • Requires kernel function addresses (ClfsEarlierLsn, SeSetAccessStateGenericMapping) obtained via GetKernelFunctionAddresses.win10_poc/win10_poc.cpp:122

Observed behavior

  • Creates a CLFS log file and container, then parses and modifies the .blf file to inject a fake container object pointer and virtual table address (0x50000).win10_poc/win10_poc.cpp:31-116
  • Sets up a fake virtual table in user-controlled memory at 0x50000 with gadget addresses to redirect kernel execution.win10_poc/win10_poc.cpp:122-124
  • Triggers the vulnerability by calling CreateLogFile with specific flags, causing the kernel to process the corrupted .blf file and execute the fake virtual table.win10_poc/win10_poc.cpp:133
  • Uses the vulnerability to achieve arbitrary kernel read/write, reads the SYSTEM token pointer, and overwrites the current process token to elevate privileges.win11_poc/win11_poc.cpp:227-258
  • Spawns an elevated command prompt (cmd.exe) after successful token replacement.win10_poc/win10_poc.cpp:155-157
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Privilege Escalation Technique
Token replacement via kernel memory read/writeThe win11 PoC reads a SYSTEM token pointer from kernel memory and writes it to the current process token field, then launches cmd.exe. This is standard behavior for a local privilege escalation exploit targeting the described CVE.win11_poc/win11_poc.cpp:227-261
Privilege Escalation Technique
Token replacement via PreviousMode modificationThe win10 PoC modifies the thread's PreviousMode to bypass kernel-mode checks, then replaces the token and launches cmd.exe. This is consistent with a Windows kernel EoP exploit.win10_poc/win10_poc.cpp:126-158
Exploit Trigger
CreateLogFile with crafted parametersBoth PoCs call CreateLogFile with specific flags (0xC0010000, 3, 0, 4, 0) to trigger the CLFS vulnerability, followed by NtSetInformationFile. This matches the expected exploit flow for CVE-2022-24481.win10_poc/win10_poc.cpp:133-149win11_poc/win11_poc.cpp:158-175
Review boundaries

What the analysis did not establish

  • 14 binary files (e.g., ParseBLF.h, Gadget.h, kernel_utils.h) are flagged as binary and not analyzed; their content is opaque, so the full exploit logic (e.g., Memory_prepare, GetTokenAddresses) cannot be fully verified from the provided text alone.
  • The evidence does not include the token_operations.h file referenced in win10_poc.cpp, limiting analysis of the token replacement mechanism in that variant.
  • The code is not executed; classification is based solely on static analysis of the provided source text.
  • 14 binary header files (e.g., ParseBLF.h, Gadget.h, kernel_utils.h) were not inspected; they are flagged as BINARY and only metadata was reviewed. These files likely contain exploit support code, but their content is unreadable in this evidence packet.
  • 3 additional text files in the repository were not included in the evidence packet, so their content is unknown.
  • The review is limited to static analysis of the provided source code excerpts; no dynamic analysis or execution was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1