devianntsec/CVE-2024-30051

GitHubRepository PoCExploit

PoC files

45 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a complete exploit for CVE-2024-30051, a heap-based buffer overflow in Windows DWM Core Library. It includes C++ source code that performs API hooking, heap spraying, and memory corruption to achieve local privilege escalation to SYSTEM integrity level.

Backdoor review

No backdoor observed in reviewed code

The repository contains a proof-of-concept exploit for CVE-2024-30051, a Windows DWM heap overflow elevation of privilege. The exploit code (main.cpp) performs heap spraying, API hooking, and memory corruption to load a payload DLL (dllmain.cpp) into the DWM process. The payload DLL spawns a SYSTEM-level command prompt and performs self-cleanup. All observed behavior is consistent with the stated exploit objective; no concealed backdoor, unrelated remote access, persistence mechanism, or credential theft was found in the reviewed source code.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesC++Batch
Target softwareWindows Desktop Window Manager (dwmcore.dll)Windows 11 22H2
Attack typesHeap-based Buffer OverflowLocal Privilege Escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains complete C++ source code that actively exploits CVE-2024-30051 by hooking system APIs, corrupting heap memory, and injecting a payload to achieve code execution as SYSTEM. The README explicitly describes it as an exploit and provides step-by-step instructions for building and running it to gain elevated privileges.

README.md:9-10README.md:97-105exploit/exploit_src/main.cpp:1-1203

Requirements

  • Windows 11 22H2 build 22621.3447 without patch KB5037771README.md:11README.md:77
  • Visual Studio 2022 with C++ Desktop workload to build the exploit and payload DLLREADME.md:78
  • Payload DLL (s11.dll) must be placed at C:\Users\Public\Documents\s11.dll before running the exploitREADME.md:87-91

Observed behavior

  • Installs inline hooks on RtlAllocateHeap, RtlCreateHeap, NtDCompositionCreateChannel, and NtDCompositionCommitChannel to intercept DWM heap operations and DirectComposition channel creationexploit/exploit_src/main.cpp:411-480exploit/exploit_src/main.cpp:769-787
  • Modifies the size field in a DWM heap chunk from 0x120 to 0x23F to trigger a 0x8F-byte heap overflow during memcpyexploit/exploit_src/main.cpp:574-602
  • Performs a heap spray of 0x10000 CHolographicInteropTexture objects and frees holes to control heap layout for the overflowexploit/exploit_src/main.cpp:943-1014
  • Writes a payload into the overflow buffer that overwrites KernelCallbackTable+0x388 with a pointer to LoadLibraryA and the path to the attacker-controlled DLLexploit/exploit_src/main.cpp:367-397
  • Releases all spray objects to trigger the overflow in dwm.exe, causing it to load the payload DLL and execute code as SYSTEMexploit/exploit_src/main.cpp:1039-1061
  • Payload DLL spawns a cmd.exe process under the DWM process with SYSTEM integrity level and performs self-cleanupexploit/payload/dllmain.cpp:78-127
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Heap spray, API hooking, and memory corruption to load a DLL into dwm.exeThis is the core exploit mechanism for CVE-2024-30051, matching the repository's stated purpose.exploit/exploit_src/main.cpp:158-169exploit/exploit_src/main.cpp:486-668exploit/exploit_src/main.cpp:943-1067
Payload Behavior
Spawns a SYSTEM-level command prompt and performs self-deletion of the DLL and a batch scriptThe payload DLL's behavior is exactly what is described in the README and comments: it provides an interactive SYSTEM shell and cleans up after itself. No persistence or unrelated actions are taken.exploit/payload/dllmain.cpp:78-127exploit/payload/dllmain.cpp:23-75
File Path
C:\Users\Public\Documents\s11.dllHardcoded payload DLL path used by the exploit and the setup script. This is a standard location for temporary files and is consistent with the exploit's need to place a DLL for DWM to load.exploit/exploit_src/main.cpp:42README.md:87-88
Log File
%TEMP%\cve_30051_log.txtThe exploit writes a detailed session log for debugging and academic purposes. This is a local log file, not an exfiltration channel.exploit/exploit_src/main.cpp:60-85
Review boundaries

What the analysis did not establish

  • Evidence includes only 6 of 45 total files; 29 non-text media files and 10 unclassified files are not analyzed.
  • The exploit binary is not provided; only source code is available.
  • The payload DLL source is provided but the compiled DLL is not included in the evidence.
  • Only the six text files included in the evidence packet were reviewed. The repository contains 39 other files (including 29 non-text media files and 10 unclassified files) that were not inspected. The review does not cover precompiled binaries, project files, or documentation images.
  • The payload DLL's self-deletion behavior could be used to hide evidence of exploitation, but this is a common feature of post-exploitation tools and is not itself a backdoor.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1