CVE-2023-36874 Proof of Concept (PoC)

An educational and defensive research implementation of the CVE-2023-36874 vulnerability, demonstrating a Local Privilege Escalation (LPE) flaw within the Windows Error Reporting (WER) component.

⚠️ Disclaimer

This repository and the provided source code are intended strictly for educational purposes, security research, and defensive auditing. Do not run this code on production systems or environments without explicit authorization. The author accepts no liability for any misuse, damage, or illegal activity conducted with this material.

---

🔍 Vulnerability Overview

CVE-2023-36874 is a logical privilege escalation vulnerability in Windows Error Reporting (WER).

A low-privileged attacker can exploit this flaw by manipulating the Windows Object Manager namespace. By creating a custom symbolic link (\??\C:) inside the local session directory, the attacker can redirect file access requests intended for the root drive.

When a highly privileged service (NT AUTHORITY\SYSTEM) triggers error reporting tasks using specific, undocumented COM interfaces (such as IErcLuaSupport), it improperly executes files from the redirected path. This allows a user-controlled binary (wermgr.exe) to be executed with SYSTEM privileges.

🛠️ Project Structure

• main.cpp — The main C++ source code responsible for environment setup, Object Manager symlink creation, and COM interaction.
• exploit.exe (Placeholder) — The target payload binary that will be spawned by the privileged service.

---

🚀 Building the Project

Prerequisites

• Visual Studio 2022 (or higher) with the Desktop development with C++ workload installed.
• Target Operating System: Unpatched Windows 10/11 or Windows Server (prior to July 2023 security updates).

Configuration in Visual Studio

1. Open Visual Studio and create a new C++ Empty Project.
2. Add main.cpp to the source files.
3. Crucial: Change the build configuration from x86 (Win32) to x64. The exploit relies on 64-bit system path resolution.
4. Build the solution (Ctrl + Shift + B).

---

📊 Technical Flow & Execution Behavior

When executed, the program performs the following operations behind the scenes:

1. Environment Initialization: Creates dummy report folders in C:\ProgramData and prepares a mirror directory structure in C:\Users\Public\test\Windows\System32.
2. Object Manager Hijacking: Calls NtCreateSymbolicLinkObject to reroute local session drive C: queries to the custom Public\test folder.
3. COM Activation: Connects to the out-of-process COM server using CLSID_ERCLuaSupport.
4. Triggering Execution: Forces the privileged service to load and submit the dummy report via SubmitReport(). The system attempts to launch C:\Windows\System32\wermgr.exe but gets redirected to the payload.

Output

The binary runs silently in the background.

• If successful, the exit code is 0 and your payload will execute in the context of NT AUTHORITY\SYSTEM.
• If it fails (e.g., due to missing prerequisites or an already applied patch), it will exit with -1.

---

🛡️ Remediation and Patching

This issue was formally addressed by Microsoft in the July 2023 Patch Tuesday update cycle.

To mitigate this and similar vulnerabilities:

• Ensure your operating system is up to date with the latest cumulative quality updates.
• Ensure proper implementation of path validation and impersonation token sanitation within custom system-level services.