Exploit for Untrusted Pointer Dereference in Microsoft

githubexploit · 2023-04-20

Description

Exploit for Vulnerability in Microsoft CVE-2023-21768-AFD-for-WinSock-Eo

Affected software

Microsoft Windows 11= 21h2, 22h2

Microsoft Windows Server 2022 All versions

All known vulnerabilities by product

Windows Windows Ancillary Function Driver For Winsock

CVSS 7.8 for CVE-2023-21768

7.8

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector:LOCAL

Attack Complexity:LOW

Privileges Required:LOW

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

Working code

58%confidence this exploit runs

Based on 3 file(s) in the source

EPSS Score

65.4%higher than 99.2% of all CVEs

Updated 2026-06-16

Exploit Details

Modified:2025-07-25 12:33

Last Seen:2025-08-31 21:35

Reporter:zoemurmure

Written in:C++

Last commit:2023-04-21

Tags

microsoftvulnerabilityexploitCVE-2023-21768afdwinsockelevation of privilegepatch tuesdayancillary function driverwindows 11

Other exploits for CVE-2023-21768

Exploit for Untrusted Pointer Dereference in Microsoft

2026-06-11 r4uznGITHUB

Exploit for Untrusted Pointer Dereference in Microsoft

2024-05-15 xboxoneresearchGITHUB

Exploit for Untrusted Pointer Dereference in Microsoft

2024-04-07 Ha0-YGITHUB

Exploit for Untrusted Pointer Dereference in Microsoft

2023-04-05 h1bAnaGITHUB

Ancillary Function Driver (AFD) For Winsock Privilege Escalation Exploit

2023-03-30 metasploitZDTRuby

Ancillary Function Driver (AFD) For Winsock Privilege Escalation

2023-03-30 Christophe de la Fuente, b33f, Yarden Shafir, chompie, metasploit.comPACKETSTORMRuby

Exploit for Untrusted Pointer Dereference in Microsoft

2023-03-22 CKevensGITHUB

Exploit for Untrusted Pointer Dereference in Microsoft

2023-03-22 3yujw7njaiGITHUB

Exploit Code

README15 lines

## https://sploitus.com/exploit?id=1CF38F98-5ABB-51BF-9844-75A5F3EB675D
# CVE-2023-21768 – AFD-for-WinSock-EoP-exploit  
Analysis article:  
https://mp.weixin.qq.com/s/9W9puJltbK-xto2A1duqgQ  
https://www.zoemurmure.top/posts/cve_2023_21768/  

According to “Patch Tuesday -> Exploit Wednesday: Pwning Windows Ancillary Function Driver for WinSock (afd.sys) in 24 Hours” (https://securityintelligence.com/posts/patch-tuesday-exploit-wednesday-pwning-windows-ancillary-function-driver-winsock/), this exploit was developed independently. Code for cleanup after privilege escalation was added, allowing successful privilege escalation. Testing platform: Windows 11 22621.963; Windows Feature Experience Pack 1000.22638.1000.0.  

Screenshot of execution:  
![screenshot-20230420-163108](https://user-images.githubusercontent.com/43516782/233308029-b26fa71a-2eee-4f8e-88d1-3d1852355d6b.png)  

Privilege escalation succeeded:  
![screenshot-20230420-163018](https://user-images.githubusercontentCom/43516782/233307633-064f6b7e-5fe3-4e86-98d6-08b65ecbc3cd.png)

[source-iocs-preserved url=https://user-images.githubusercontent.com/43516782/233307633-064f6b7e-5fe3-4e86-98d6-08b65ecbc3cd.png]