CVE-2023-36874

This PoC exploits CVE-2023-36874, a Windows Error Reporting (WER) vulnerability, by creating symbolic links and manipulating directory objects to achieve local privilege escalation. The exploit involves COM object manipulation and symbolic link abuse to execute arbitrary code with elevated privileges.

This is a CobaltStrike BOF implementation of CVE-2023-36874, a Windows Error Reporting LPE exploit. It drops a user-specified EXE to disk and triggers the vulnerability to execute it as SYSTEM.

This PoC demonstrates a vulnerability in Windows Error Reporting (WER) by leveraging COM interfaces to trigger an exploit via report submission. The code initializes COM, interacts with WER components, and submits a report to exploit CVE-2023-36874.

This PoC exploits CVE-2023-36874 by creating a symbolic link to redirect system paths, allowing arbitrary code execution via a malicious 'wermgr.exe'. It leverages COM interfaces to trigger the vulnerability in Windows Error Reporting (WER).

This Metasploit module exploits CVE-2023-36874, a local privilege escalation vulnerability in Windows Error Reporting (WER). It manipulates directory paths to coerce WER into executing an arbitrary payload as SYSTEM by creating a shadow directory structure and uploading a malicious 'wermgr.exe'.

This repository contains a functional exploit for CVE-2023-36874, leveraging symbolic link manipulation and COM object interactions to achieve local privilege escalation. The exploit creates a malicious WER report and manipulates directory objects to escalate privileges.