# （CVE-2018-8639）Windows 本地提权漏洞.md

#### 描述

这个漏洞属于未正确处理窗口类成员对象导致的Double-free类型本地权限提升漏洞

#### 影响版本

| Product             | Version | Update | Edition | Tested |
| ------------------- | ------- | ------ | ------- | ------ |
| Windows 10          | -       |        |         |        |
| Windows 10          | 1607    |        |         |        |
| Windows 10          | 1703    |        |         |        |
| Windows 10          | 1709    |        |         |        |
| Windows 10          | 1803    |        |         |        |
| Windows 10          | 1809    |        |         |        |
| Windows 7           | -       | SP1    |         |        |
| Windows 8.1         | -       |        | pro N   |        |
| Windows Rt 8.1      | -       |        |         |        |
| Windows Server 2008 | -       | SP2    |         |        |
| Windows Server 2008 | R2      |        | itanium |        |
| Windows Server 2008 | R2      |        | x64     |        |
| Windows Server 2012 | -       |        |         |        |
| Windows Server 2012 | R2      |        |         |        |
| Windows Server 2016 | -       |        |         |        |
| Windows Server 2016 | 1709    |        |         |        |
| Windows Server 2016 | 1803    |        |         |        |
| Windows Server 2019 | -       |        |         |        |

#### 修复补丁

```
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8639
```

#### 利用方式

编译环境

- VS2019（V140）X64 Release

在Windows 2008 X64上测试通过的EXP，直接上GIF图

[![2](resource/%EF%BC%88CVE-2018-8639%EF%BC%89Windows%20%E6%9C%AC%E5%9C%B0%E6%8F%90%E6%9D%83%E6%BC%8F%E6%B4%9E/media/7.gif)](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/7.gif?raw=true)

编译环境

- VS2019（V120）X64 Debug，需要安装如下包作为支撑

    ```
    https://www.microsoft.com/zh-cn/download/confirmation.aspx?id=40770
    ```

Windows 7 X64测试通过的EXP，上GIF图

[![3](resource/%EF%BC%88CVE-2018-8639%EF%BC%89Windows%20%E6%9C%AC%E5%9C%B0%E6%8F%90%E6%9D%83%E6%BC%8F%E6%B4%9E/media/8.gif)](https://github.com/Ascotbe/Random-img/blob/master/WindowsKernelExploits/8.gif?raw=true)



> https://github.com/Ascotbe/Kernelhub/tree/master/CVE-2018-8639