CVE-2021-1732
HIGH KEV RANSOMWAREWindows 10 1803-20H2 and Windows Server 1909-20H2 - Elevation of Privilege via Win32k ConsoleControl Offset Confusion
Title source: llmExploitation Summary
CVE-2021-1732 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 3, 2021, with confirmed use in ransomware campaigns.
EIP tracks 17 public exploits from researchers including KaLendsi, Pai-Po, exploitblizzard, including a Metasploit module exploits/windows/local/cve_2022_21882_win32k.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2021-1732, a Windows Win32k elevation of privilege vulnerability. The exploit leverages a race condition and memory corruption to escalate privileges by manipulating window class extra bytes and kernel callbacks.
Description
Windows Win32k Elevation of Privilege Vulnerability
Exploits (17)
This repository contains a functional exploit for CVE-2021-1732, a Windows Win32k elevation of privilege vulnerability. The exploit leverages a race condition and memory corruption to escalate privileges by manipulating window class extra bytes and kernel callbacks.
This repository contains a functional exploit for CVE-2021-1732, a Windows local privilege escalation vulnerability. The code demonstrates a complex exploit chain involving window object manipulation, callback hooking, and token duplication to achieve SYSTEM privileges.
This repository contains a functional exploit for CVE-2021-1732, a Windows privilege escalation vulnerability. The code demonstrates a local privilege escalation (LPE) by manipulating window objects and exploiting a use-after-free condition in the Windows kernel.
This repository contains a functional exploit for CVE-2021-1732, a Windows kernel privilege escalation vulnerability. The exploit leverages a use-after-free in the win32k driver to achieve arbitrary kernel memory read/write and ultimately escalate privileges.
This repository contains a functional exploit for CVE-2021-1732, a Windows local privilege escalation vulnerability. The exploit manipulates window class extra bytes and kernel callbacks to achieve arbitrary kernel memory read/write, targeting Windows 10 1809 (17763).
This repository contains a functional exploit for CVE-2021-1732, a Windows Win32k privilege escalation vulnerability. The exploit leverages a race condition in the Windows kernel to achieve local privilege escalation by manipulating window class extra bytes and kernel callbacks.
This repository contains a functional exploit for CVE-2021-1732, a Windows Win32k Elevation of Privilege vulnerability. The code demonstrates a local privilege escalation (LPE) by manipulating window objects and leveraging a use-after-free condition to achieve SYSTEM privileges.
This repository contains a functional exploit for CVE-2021-1732, a Windows kernel vulnerability. The exploit leverages a use-after-free in win32k to achieve local privilege escalation (LPE) by manipulating kernel objects and callback functions.
This repository contains a functional exploit for CVE-2021-1732, a Windows Win32k privilege escalation vulnerability. The exploit leverages a race condition in the Windows kernel to achieve local privilege escalation by manipulating window class extra bytes and hooking kernel callbacks.
The repository contains only a minimal assembly snippet (INT3.asm) with an INT 3 instruction, which is insufficient to demonstrate exploitation of CVE-2021-1732. No functional exploit code or technical details are provided.
This repository contains a functional exploit for CVE-2021-1732, a Windows local privilege escalation vulnerability. The exploit leverages a race condition in the win32k driver to achieve arbitrary kernel memory read/write, ultimately escalating privileges to SYSTEM.
This Metasploit module exploits a privilege escalation vulnerability in Windows 10 (CVE-2021-1732 and CVE-2022-21882) by manipulating the WndExtra field in win32k to achieve an out-of-bounds write, leading to SYSTEM privileges. It combines the original exploit with a patch bypass for broader compatibility.
This repository contains a functional exploit for CVE-2021-1732, a Win32k elevation of privilege vulnerability. The PoC leverages kernel callback table manipulation and window object manipulation to achieve privilege escalation.
This repository contains a functional exploit for CVE-2021-1732, a Windows local privilege escalation vulnerability. The code demonstrates a kernel callback table hooking technique to achieve arbitrary memory read/write and escalate privileges.
This repository is a documentation hub for Windows kernel exploits, including CVE-2021-1732, with structured README files and automated documentation generation. It does not contain functional exploit code but provides detailed technical references and categorization of vulnerabilities.
References (4)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H