CVE-2024-30088

Classification basis

The code actively exploits CVE-2024-30088 by implementing a race condition to escalate privileges and spawn a SYSTEM process. It is not merely detecting the vulnerability; it exercises the vulnerability to achieve code execution with elevated privileges.

Requirements

• Requires local low-privilege code execution on a vulnerable Windows system.poc/main.cpp:63
• Requires a payload binary at payload withheld.poc/main.cpp:140

Observed behavior

• Opens the current process token and leaks its kernel address.poc/main.cpp:73-74
• Queries token information to locate a target offset for the race condition.poc/main.cpp:88-99
• Executes a race condition by repeatedly calling NtQueryInformationToken in a loop while a high-priority thread modifies the token information buffer.poc/main.cpp:117-123
• After winning the race, obtains a handle to winlogon.exe with PROCESS_ALL_ACCESS.poc/main.cpp:124-125
• Uses the winlogon handle to spawn a SYSTEM-privileged process (powershell.exe launching payload withheld).poc/main.cpp:140

Observables

Hardcoded Payload Path

Payload withheldThe exploit launches a hardcoded executable via PowerShell to demonstrate SYSTEM-level code execution. This is a standard PoC pattern and does not constitute a backdoor.poc/main.cpp:140README.md:21-28

Privilege Escalation Technique

Payload withheldThe core exploit logic races a kernel token information query to gain a handle to winlogon.exe, then creates a child process inheriting its SYSTEM token. This is the documented CVE-2024-30088 technique.poc/main.cpp:56-62poc/main.cpp:117-134poc/main.cpp:140