ish2yu/cve-2023-36802

Procedure to Recreate the Exploit for CVE-2023-36802 targeting MSKSSRV.SYS driver

POC Recreating CVE 2023-36802

Microsoft Streaming Service Proxy Privilege Escalation Vulnerability

Procedure to Recreate the Exploit for CVE-2023-36802 targeting MSKSSRV.SYS driver

Prequisites

If You want to Understand how this Exploit is working , Go through this Blog

This CVE is actually the Bypass of Another CVE which is CVE-2023-29360 , Go through That Also its mentioned in Blog I have linked above

If You want to check if your Windows has MSKSSRV.SYS driver

• Open Command Prompt , Go to this Path : dir

C:\Windows\System32\drivers> dir

Windows Version

This is the list of Version of Windows where its Vulnerable to this CVE :-

• I would say you should perefer Installing 21h2 version of Windows VM

Steps to Recreate :-

• You can find Iso-Image file in this link (Note: I dont guarantee safety of this link)
• Boot-Up the Iso-Image file in your Virtual Box / Vmware
• Install Visual Studio in that VM ( Not Visual Studio Code )
• Clone the Repository or Download the Zip
• After the Installtion is complete , Open your CVE-2023-36802_Win10.sln in it
• Build < Run

cve-2023-36802's Issues

Confirm CVE and CNA please?

Is this CVE-2023-11518 (repo title) or CVE-2023-1518 (README.md heading)? The latter is currently assigned for "CP Plus KVMS Pro Unspecified Insufficient Protection Local Credential Disclosure" so assuming this is meant to be 2023-11518. But... per MITRE it is listed as: ERROR: Couldn't find 'CVE-2023-11518'

Can you please confirm the assigning CNA as well? Thanks @ISH2YU