CVE-2024-30051

Classification basis

The artifact contains complete C++ source code that actively exploits CVE-2024-30051 by hooking system APIs, corrupting heap memory, and injecting a payload to achieve code execution as SYSTEM. The README explicitly describes it as an exploit and provides step-by-step instructions for building and running it to gain elevated privileges.

Requirements

• Windows 11 22H2 build 22621.3447 without patch KB5037771README.md:11README.md:77
• Visual Studio 2022 with C++ Desktop workload to build the exploit and payload DLLREADME.md:78
• Payload DLL (s11.dll) must be placed at payload withheld before running the exploitREADME.md:87-91

Observed behavior

• Installs inline hooks on RtlAllocateHeap, RtlCreateHeap, NtDCompositionCreateChannel, and NtDCompositionCommitChannel to intercept DWM heap operations and DirectComposition channel creationexploit/exploit_src/main.cpp:411-480exploit/exploit_src/main.cpp:769-787
• Modifies the size field in a DWM heap chunk from 0x120 to 0x23F to trigger a 0x8F-byte heap overflow during memcpyexploit/exploit_src/main.cpp:574-602
• Performs a heap spray of 0x10000 CHolographicInteropTexture objects and frees holes to control heap layout for the overflowexploit/exploit_src/main.cpp:943-1014
• Writes a payload into the overflow buffer that overwrites KernelCallbackTable+0x388 with a pointer to LoadLibraryA and the path to the attacker-controlled DLLexploit/exploit_src/main.cpp:367-397
• Releases all spray objects to trigger the overflow in dwm.exe, causing it to load the payload DLL and execute code as SYSTEMexploit/exploit_src/main.cpp:1039-1061
• Payload DLL spawns a cmd.exe process under the DWM process with SYSTEM integrity level and performs self-cleanupexploit/payload/dllmain.cpp:78-127

Observables

Exploit Behavior

Payload withheldThis is the core exploit mechanism for CVE-2024-30051, matching the repository's stated purpose.exploit/exploit_src/main.cpp:158-169exploit/exploit_src/main.cpp:486-668exploit/exploit_src/main.cpp:943-1067

Payload Behavior

Payload withheldThe payload DLL's behavior is exactly what is described in the README and comments: it provides an interactive SYSTEM shell and cleans up after itself. No persistence or unrelated actions are taken.exploit/payload/dllmain.cpp:78-127exploit/payload/dllmain.cpp:23-75

File Path

Payload withheldHardcoded payload DLL path used by the exploit and the setup script. This is a standard location for temporary files and is consistent with the exploit's need to place a DLL for DWM to load.exploit/exploit_src/main.cpp:42README.md:87-88

Log File

Payload withheldThe exploit writes a detailed session log for debugging and academic purposes. This is a local log file, not an exfiltration channel.exploit/exploit_src/main.cpp:60-85