Roots of the CVE-2024-30085 vulnerability
More in Windows
- This is Siemens...
Recently, our colleagues from the Positive Industrial Expertise Center discovered a curious Windows sample on MalwareBazaar.…
- A look inside ESE
Looking inside ESE 🫣 During incident investigations, we at PT ESC IR regularly encounter the need…
- ::%16777216 — so what exactly are you?
::%16777216 — so what exactly are you? It is known that during attacks, adversaries can use…
- Confusion in WSUS vulnerabilities: setting the record straight
Confusion Around WSUS Vulnerabilities: Setting the Record Straight 🕷 One of the most pressing vulnerabilities in…
- Disabling Defender / MpPreference
In addition to the post 👆 Disabling Defender / MpPreference Set-MpPreference -DisableRealtimeMonitoring $true Set-MpPreference -DisableBehaviorMonitoring $true…
Roots of the CVE-2024-30085 Vulnerability 🌳
Back in September of last year, we at ESC-VR successfully reproduced an exploit for CVE-2024-30085 — a vulnerability in the Windows Cloud Files Mini Filter subsystem. The subsystem’s code resides in cldflt.sys — it is a minifilter driver, and it belongs to the preinstalled client of the Microsoft OneDrive cloud service.
Using the vulnerability and a WNF + ALPC chain, we created primitives for reading from and writing to kernel memory. Thanks to this, we stole a system token and launched a terminal with NT AUTHORITY\SYSTEM privileges.
🧐 Recently, as a follow-up to the publication, we released a detailed analysis of the CVE-2024-30085 vulnerability and the techniques applicable during kernel heap exploitation on Windows 10 22H2 19045.3803.
Read the analysis in the blog on Habr.
#escvr #cve #win
@ptescalator
More from author_vr
- Out-of-bounds write in ntfs!PageUpdateAnalysis
A heap buffer overflow vulnerability exists in the ntfs!PageUpdateAnalysis function of the Microsoft Windows NTFS driver.…
- How to CVE-2025-54916? Low-effort vulnerability research
How to CVE-2025-54916? Low-effort vulnerability research 💻 Hi, ESC-VR here. The Telegram post format is rarely…
- What happened to OpenSSH security in 2024
What happened to OpenSSH security in 2024 🚪 Let's look at the timeline: • Spring. Backdoor…
- Not a Pwn2Own bug
Not a Pwn2Own bug 🙂 CVE-2024-43641: a CWE-190 type error allowed overflowing the reference count on…
- CVE-2024-43629 Vulnerability Details
😏 Exclusively for Escalator, the ESC-VR team shares details about the vulnerability (CVE-2024-43629) that we found…
More in Windows
- This is Siemens...
Recently, our colleagues from the Positive Industrial Expertise Center discovered a curious Windows sample on MalwareBazaar.…
- A look inside ESE
Looking inside ESE 🫣 During incident investigations, we at PT ESC IR regularly encounter the need…
- ::%16777216 — so what exactly are you?
::%16777216 — so what exactly are you? It is known that during attacks, adversaries can use…
- Confusion in WSUS vulnerabilities: setting the record straight
Confusion Around WSUS Vulnerabilities: Setting the Record Straight 🕷 One of the most pressing vulnerabilities in…
- Disabling Defender / MpPreference
In addition to the post 👆 Disabling Defender / MpPreference Set-MpPreference -DisableRealtimeMonitoring $true Set-MpPreference -DisableBehaviorMonitoring $true…