A Design Flaw in Windows Kernel API can Lead to privilege escalation.
Mirror of Original Post: http://www.exploit-db.com/bypassing-uac-with-user-privilege-under-windows-vista7-mirror/
PoC: http://www.codeproject.com/KB/vista-security/uac.aspx (not available)
mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15609.zip (uacpoc.zip)
After running this PoC, just type “whoami” in command prompt to see the escalated user credentials.
Points of Interest
All actions this PoC performs require only user privilege, but result in arbitrary kernel mode code execution due to the ambiguous design of RtlQueryRegistryValues. This design flaw exists in most versions of Windows kernels, yet no patch or documentation is publicly available on this issue.
Additional Information
This PoC may not correctly fix the exploited kernel context and resume execution without BSOD, such as on kernels ealier than 6.1.6000 are not supported, current supported kernels are:
Windows Vista/2008 6.1.6000 x32,
Windows Vista/2008 6.1.6001 x32,
Windows 7 6.2.7600 x32,
Windows 7/2008 R2 6.2.7600 x64.
Beyond this scope you may contact me for information on how to tune the code to work correctly on your kernel or how the shellcode works, etc. Those contents are beyond the scope of this article and of no importance to the exploit, therefore it is not included.
