## https://sploitus.com/exploit?id=AB2A7948-3025-57B9-9F0D-5B495BCC090C
# CVE-2022-24481 Type Confusion
Type confusion
# Vulnerable File
`clfs.sys`
# Root Cause
Because the validation logic for `rgContainers[0]` is not strict, after forging `rgContainers[0]`, `ClientContext` overlaps with the `ContainerContext` structure. If the fake data is accepted, after `CloseHandle`, `CClfsLogFcbPhysical::FlushMetadata` restores the `ClientContext` data.
# Exploitation Method
After forging `rgContainers[0]`, `ClientContext` overlaps with the `ContainerContext` structure. If the fake data is accepted, after `CloseHandle`, `CClfsLogFcbPhysical::FlushMetadata` restores the `ClientContext` data. Because the structures overlap, this process changes `ContainerContext->pContainer` to the forged data. Finally, when `CClfsBaseFilePersisted::RemoveContainer` is called, it triggers an indirect member-function call, executes a specific gadget, and leads to privilege escalation.
# PoC Flow
## 1. Static File Preparation
`createlog` creates a new log file.
Add a `Container` entry.
Create a symbolic link `X:\` that points to the current directory.
Clear the `cbSymbolName_start -> cbSymbolName_end` range.
Set `cbSymbolName_start` to `X:\N`.
Copy the data in `ContainerContext_start -> New_cbSymbolName_end` into `ClientContext`.
Update `rgContainers[0]` so it points to the new `ContainerContext_start` location.
Update the new `ContainerContext->pContainer` value.
Recompute the checksum.
## 2. Runtime Preparation
Locate the gadget address in kernel memory.
Build the fake virtual table.
Perform the remaining memory setup.
## 3. Open the Forged Log File
`CClfsLogFcbPhysical::Initialize`
`00000001C0002EDB` stores the `ClientContext` data.
After `CloseHandle`, `CClfsRequest::Cleanup->CClfsLogFcbPhysical::FlushMetadata` runs.
It copies the forged data back into `ClientContext`. Because `ClientContext` overlaps with `ContainerContext`, `ContainerContext->pContainer` is overwritten with the forged data.
`CClfsBaseFilePersisted::RemoveContainer` then executes our gadget, resulting in a 16-byte write to an arbitrary address.
# References
https://zhuanlan.zhihu.com/p/645490730
<https://github.com/fr4nkxixi/CVE-2022-24481-POC>
<https://securelist.com/windows-clfs-exploits-ransomware-cve-2022-24521/111580/>
https://starmap.dbappsecurity.com.cn/blog/articles/2022/05/10/cve-2022-24481/
https://www.4awl.net/9646.html
# Data Modification List
# Function Flow Key Points
`win10_21H2_19044.1620`
`CClfsLogFcbPhysical::Initialize(0x??7c)` initialization routine for opening the file
`bp clfs!CClfsLogFcbPhysical::Initialize + 0x45F`
This code stores the `ClientContext` memory.
After `CloseHandle`, `CClfsRequest::Cleanup->CClfsLogFcbPhysical::FlushMetadata` is executed.
`bp clfs!CClfsLogFcbPhysical::FlushMetadata + 0x46`
This restores the `ClientContext` data.
`CClfsBaseFilePersisted::RemoveContainer`
`bp clfs!CClfsBaseFilePersisted::RemoveContainer + 0x10F`
Use the forged virtual table pointer to reach the gadget.
Note that if the forged file fails, opening the file will fail and `GetLastError` will reveal the reason. In that case, the exploit flow cannot continue.
# Gadget
`CClfsBaseFilePersisted::RemoveContainer`
`CLFS!ClfsEarlierLsn`
`nt!SeSetAccessStateGenericMapping`
`nt!SeSetAccessStateGenericMapping`
`movdqu xmmword ptr [rax+8], xmm0` writes 16 bytes to `[rax+8]` (`XMMWORD`, 128 bits).
After sequential execution, the result is to write the 16-byte data from `poi(rdx) 0xFFFFFFFF` into `poi(poi(rcx+0x48)+0x8)`.
`rcx` is the virtual table pointer location, and this location is under our control.
# Implemented PoC
https://github.com/uname1able/CVE-2022-24481.git
## Win10 PoC
`winver`
`win10_21H2_19044.1620`
`bp clfs!CClfsBaseFilePersisted::RemoveContainer + 0x10F`
## Win11 PoC
`winver`
`win11_21H2_22000.593`
`bp clfs!CClfsBaseFilePersisted::RemoveContainer + 0x183`