Fix targeting for CVE-2021-21551 #15216
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This fixes a mistake I made in the exploit for CVE-2021-21551 where the version fingerprinting is overly specific. I noticed that the exploit was failing when targeting Windows 10 build 18363 since it didn't match the explicit build number 18362. This PR changes the fingerprinting to use ranges to fix this problem. Additionally, I added and tested the build number for the upcoming 21H1 release (available through the insider preview channel). For v21H1 the build number is 19043 and I confirmed that the offsets in EPROCESS are all the same as they are for 20H1 and 20H2.
Verification
Install Windows 10 v21H1 by signing up for Windows Insider Preview.
use exploit/windows/local/cve_2021_21551_dbutil_memmove
SESSION
andPAYLOAD
optionsrun
Example