CVE-2024-38143

Windows WLAN AutoConfig Service Elevation of Privilege Vulnerability
Successful exploitation can lead to possible escalation to NT AUTHORITY\SYSTEM

Background

While on a client engagement, I had to test a physical laptop and for some reason, stumbled upon this article by Matthew Johnson, which was his resultant discovery of CVE-2021-28316. I wondered if it could be possible to modify and perform a similar type of attack, but what I discovered was that it actually just...worked right out of the gate. My client at the time basically said, "Wait this isn't supposed to work against a patched device". He wasn't wrong, this was allegedly patched in April of 2021. It obviously was not, thus, an unfixed vulnerability.

There's not much of a point in replicating the PoC steps once again, because in all fairness - Matthew Johnson found this bug and all I did was discover that Microsoft's previous patch was unsuccessful. If you're interested in setting up this attack, use this guide, and remember that you'll need an unpatched version of Windows.

Proof of Concept Video

https://github.com/user-attachments/assets/6bf025e7-3a53-40ce-a4a5-5886423e2839