module

Ancillary Function Driver (AFD) for WinSock Elevation of Privilege

Try Surface Command
Back to search
Disclosed
2023-01-10
Created
2023-03-30

Description

A vulnerability exists in the Windows Ancillary Function Driver for Winsock
(`afd.sys`) can be leveraged by an attacker to escalate privileges to those of
NT AUTHORITY\SYSTEM. Due to a flaw in `AfdNotifyRemoveIoCompletion`, it is
possible to create an arbitrary kernel Write-Where primitive, which can be used
to manipulate internal I/O ring structures and achieve local privilege
escalation.

This exploit only supports Windows 11 22H2 up to build 22621.963 (patched in
January 2023 updates).

Authors

chompie
b33f
Yarden Shafir
Christophe De La Fuente

Platform

Windows

Architectures

x64

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands ‘show options’ or ‘show advanced’:


    msf > use exploit/windows/local/cve_2023_21768_afd_lpe
    msf exploit(cve_2023_21768_afd_lpe) > show targets
        ...targets...
    msf exploit(cve_2023_21768_afd_lpe) > set TARGET < target-id >
    msf exploit(cve_2023_21768_afd_lpe) > show options
        ...show and set options...
    msf exploit(cve_2023_21768_afd_lpe) > exploit
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today