johnnygreeme/cve-2023-21817A minimalist Local Privilege Escalation (LPE) vulnerability checker for CVE-2023-21817 (Windows Kerberos LPE) written in C++.
A minimalist C++ Proof of Concept (PoC) / Vulnerability Checker for CVE-2023-21817. This utility helps security researchers and system administrators determine whether a Windows system is vulnerable to the Kerberos Local Privilege Escalation (LPE) flaw by interacting with the Local Security Authority (LSA) subsystem.
CVE-2023-21817 is a Local Privilege Escalation vulnerability in the Windows Kerberos component. It allows a low-privileged user to bypass security restrictions during a workstation unlock sequence.
This tool attempts to trigger the specific parsing logic via LsaLogonUser using the restricted KerbUnlockLogon info class. It analyzes the returned NTSTATUS code to determine if the security patch is missing.
The tool evaluates the vulnerability status based on the NTSTATUS response from the LSA subsystem:
| NTSTATUS Code | Status Name | Verdict | Description |
|---|---|---|---|
0xC0000003 | STATUS_INVALID_INFO_CLASS | PATCHED (Secure) | The patch is active. LSA safely rejected the restricted KerbUnlockLogon class in this context. |
0xC000006D | STATUS_LOGON_FAILURE | VULNERABLE (Unpatched) | The vulnerable handler processed the request and dropped it only because of the dummy credentials. |
0xC0000022 | STATUS_ACCESS_DENIED | VULNERABLE (Unpatched) | The structure bypassed initial checks but failed due to low process privileges. |
0xC000005E | STATUS_NO_LOGON_SERVERS | VULNERABLE (Unpatched) | The vulnerable handler is active but could not reach a Domain Controller. |
Secur32.lib (linked automatically via pragma)CVE-2023-21817-Checker.exe
This tool is developed strictly for authorized security testing, educational purposes, and vulnerability research. Do not run it on production systems without proper authorization. The author accepts no responsibility for any misuse or damage caused by this software.