CVE-2024-21338Exploit(microsoft / windows_10_1809)

Lazarus used this as a zero-day. No BYOVD needed. The vulnerable driver is already on every Windows machine. CVE-2024-21338 exploits appid.sys (AppLocker's driver) to call a user-controlled function pointer in kernel mode. The exploit uses ExpProfileDelete as a valid kCFG target to decrement PreviousMode from 1 to 0. Once PreviousMode is flipped, NtWriteVirtualMemory and NtReadVirtualMemory skip all security checks. Full admin-to-kernel LPE with token manipulation. Works on Windows 10 and 11 with HVCI enabled. Full PoC included. If you just read the PreviousMode mitigation post by @yarden_shafir, this is the CVE that forced Microsoft to add it. https://hakaisecurity.io/cve-2024-21338-from-admin-to-kernel-through-token-manipulation-and-windows-kernel-exploitation/research-blog/ https://github.com/hakaioffsec/CVE-2024-21338 Author: @HakaiOffsec #WindowsInternals #ExploitDevelopment #InfoSec

Windows security doesn't stop at SYSTEM. CVE-2024-21338 shows that even an administrator isn't necessarily at the highest privilege level. The vulnerability exists in "appid.sys" (AppLocker) and allows an attacker to cross the boundary from Administrator to kernel by abusing an untrusted pointer exposed through a kernel IOCTL. Once kernel code execution is achieved, the exploit manipulates process tokens to obtain full kernel privileges while bypassing protections such as HVCI. What makes the Hakai Security research worth reading isn't just the exploit, it's the journey from a vulnerable IOCTL to a reliable kernel exploit. The write-up covers IOCTL dispatching, kernel callbacks, PreviousMode abuse, token manipulation, HVCI-aware exploitation, and modern Windows kernel exploitation techniques. If you're interested in Windows internals, it's an excellent deep dive into how real-world kernel exploits are built.

Dropped 2 Writeups Windows & Driver Internals → Exploitation Kernel Exploit ( CVEs + Root Cause → Exploit) • CVE-2025-62215 • CVE-2024-30088 • CVE-2024-21338 • Stack Overflow & Arbitrary Overwrite (Kernel) https://0xdbgman.github.io/posts/pwning-the-kernel-windows-internals-driver-exploitation/ #ExploitDevelopment

https://hakaisecurity.io/cve-2024-21338-from-admin-to-kernel-through-token-manipulation-and-windows-kernel-exploitation/research-blog/

https://lyrie.ai/research/research/active-exploit-cve-2024-21338-windows #lyrie #cybersecurity #CVE #threatintel #zerodayattack

00:00 UTC: CVE-2024-21338 disclosed. CISA: CVE-2024-21338 added to Known Exploited Vulnerabilities — Microsoft Windows Status: ✅ Confirmed exploited in the wild Date added: 2024-03-04 Required action: Apply mitigations per vendor instructions or discontinue use of the…