漏洞成因
（CVE-2024-26229）Windows CSC服务特权提升漏洞，csc.sys驱动程序中带有METHOD_NEITHER I/O控制代码的IOCTL地址验证不正确。当IOCTL使用METHOD_NEITHER选项进行I/O控制时，IOCTL有责任验证提供给它的地址，如果验证缺失或不正确，攻击者可以提供任意内存地址，从而导致代码执行或拒绝服务。
影响版本
Windows Server 2022, 23H2 Edition (Server Core installation)
Windows Server 2012 R2
Windows Server 2012 (Server Core installation)
Windows Server 2012
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2016 (Server Core installation)
Windows Server 2016
Windows 10 Version 1607 for x64-based Systems
Windows 10 Version 1607 for 32-bit Systems
Windows 10 for x64-based Systems
Windows 10 for 32-bit Systems
Windows 11 Version 23H2 for x64-based Systems
Windows 11 Version 23H2 for ARM64-based Systems
Windows 10 Version 22H2 for 32-bit Systems
Windows 10 Version 22H2 for ARM64-based Systems
Windows 10 Version 22H2 for x64-based Systems
Windows 11 Version 22H2 for x64-based Systems
Windows 11 Version 22H2 for ARM64-based Systems
Windows 10 Version 21H2 for x64-based Systems
Windows 10 Version 21H2 for ARM64-based Systems
Windows 10 Version 21H2 for 32-bit Systems
Windows 11 version 21H2 for ARM64-based Systems
Windows 11 version 21H2 for x64-based Systems
Windows Server 2012 R2 (Server Core installation)
Windows Server 2022 (Server Core installation)
Windows Server 2022
Windows Server 2019 (Server Core installation)
Windows Server 2019
Windows 10 Version 1809 for ARM64-based Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 1809 for 32-bit Systems
利用条件
这个提权漏洞需要目标主机启用csc服务，可以使用sc qc csc 命令查询，START_TYPE为DISABLED禁用、SYSTEM_START启用。
特别说明
2008/2012没有这服务（无法利用），2016/2019/2022有该服务，但是默认都禁用了，而且没法启动。实战项目测试中如果遇到Win 10/11时可以试试用这个exp来提权，而且大概率能绕过一些防护的拦截。
测试脚本1
CVE-2024-26229-BOF工具利用起来更简单更好（内存执行，无需落地），使用inline-execute执行BOF文件即可将当前Beacon提升为SYSTEM。
下载地址：
https://github.com/NVISOsecurity/CVE-2024-26229-BOF
编译：
gcc -c CVE-2024-26229-bof.c -o CVE-2024-26229-bof.o
编译过的exe
https://github.com/team-MineDEV/CVE-2024-26229
漏洞修复建议
漏洞已于2024年4月9日修复，详情请参阅如下
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26229
原文始发于微信公众号（信安王子）：windows 提权漏洞预警CVE-2024-26229
评论