Skip to content

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories

Loading categories

CVE-2023-36407 — PoC - CVE-2023-36407 | Kitploit

GitHub/pwndorei/cve-2023-36407

Privilege Escalation Memory Forensics Vulnerability Analysis Exploitation Binary Exploitation

pwndorei/cve-2023-36407

CVE-2023-36407

PoC - CVE-2023-36407

View Repository

42 years ago

Most Popular

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →

Share

CVE-2023-36407

This is poc for CVE-2023-36407, Hyper-V Elevation of Privilege Vulnerability.

https://github.com/pwndorei/CVE-2023-36407/assets/96749184/a8ef87d3-e0d0-40e5-9b23-35ab057a9c78

Vulnerability

OOB Read/Write from/to Non-paged Pool via winhvr.sys!WinHvGet/SetVpState

Reproduction Steps

Environment I used: Windows 11 22H2 x64
Patch: kb5031354
control code for WinHvSetVpState: 0x221268
- if poc does not work, analyze Vid.sys to find out control code for WinHvSetVpState and change it

Build

Just build the project(Release/x64), then CVE-2023-36407.exe will be generated.

Reproduction

run CVE-2023-36407.exe in vulnerable Hyper-V Host(Root Partition)
Boom

How it works?

CVE-2023-36407.exe calls DeviceIoControl that invokes winhvr.sys!WinHvSetVpState
In WinHvSetVpState, memcpy copies data from input buffer(user-controlled) to Non-paged Pool memory
- length of data to copy depends on input data's length
The Non-paged Pool Memory is 0x1000 bytes size and there is no size check for input before calling memcpy
- BOF in Non-paged Pool
BSOD occurs because of the corruption