Windows Kernel Local Privilege Escalation via SeDebugPrivilege Bit Corruption (CVE-2026-40369)

Metadata

Affected Target

Summary

This exploit is a local privilege escalation chain against the Windows kernel that abuses a low-level primitive reachable through NtQuerySystemInformation to corrupt a bit near the process’s SeDebugPrivilege state in kernel memory, without requiring the attacker to already hold elevated rights. Once the debug privilege has effectively been granted, the tool locates the kernel object address of winlogon.exe’s token/thread structures, opens a handle to the winlogon.exe process with PROCESS_CREATE_PROCESS rights, and spawns a new cmd.exe process inherited from that SYSTEM-level process — resulting in a SYSTEM command shell for the original low-privilege caller. The PoC requires the operator to manually supply the running system’s ntoskrnl.exe kernel base address (leaked separately, e.g. via a known info-leak or debug interface) before the offset calculations and corruption primitive can be used.

Vulnerability Details

Root Cause

A kernel memory corruption/confusion primitive reachable through the NtQuerySystemInformation system call (invoked here with the SystemHandleCountInformation class against a crafted, attacker-influenced address derived from the resolved SeDebugPrivilege offset) allows an unprivileged caller to flip privilege-related state without proper access checks.

Attack Vector

1. Attacker resolves the running kernel’s base address (ntoskrnl.exe load address) and supplies it to the exploit.
2. The exploit locates SeDebugPrivilege- and token-related offsets by parsing the on-disk ntoskrnl.exe image loaded into the process (via GetModuleByName/offset-finder helpers).
3. The exploit repeatedly invokes NtQuerySystemInformation with SystemHandleCountInformation against an address derived from SeDebugPrivilegeAddr - 1, corrupting adjacent privilege state in the current process’s kernel object.
4. With SeDebugPrivilege-equivalent access effectively obtained, the tool opens winlogon.exe (a SYSTEM-level process) with PROCESS_CREATE_PROCESS access.
5. The exploit uses the winlogon.exe process handle to spawn a new cmd.exe process that inherits SYSTEM-level context, giving the attacker a privileged command shell.

Impact

Local privilege escalation from a standard user to SYSTEM on affected Windows builds, via a self-contained native executable requiring only local code execution.

Environment / Lab Setup

Target:   Windows host with a vulnerable ntoskrnl.exe build; low-privilege local user session
Attacker: Visual Studio / MSVC toolchain (Windows SDK, ntdll.lib) to build exp.cpp + exp_tools.cpp

Proof of Concept

PoC Script

See exp.cpp (entry point) and exp_tools.cpp/exp_tools.h (offset-finding and privilege/token helper routines) in this folder.

1
2
3
4
5
6

1. Build the project (Visual Studio, link against ntdll.lib).
2. Run the resulting executable on the target Windows host.
3. When prompted "Please enter ntoskrnl kernel base:", supply the leaked kernel base address
   (e.g. via an external info-leak or debug method — not included in this PoC).
4. The tool resolves SeDebugPrivilege/Token offsets, corrupts kernel privilege state,
   and repeatedly attempts to spawn a SYSTEM cmd.exe via winlogon.exe.

The program first prints the local OS version, prompts the operator for the kernel base address, computes the SeDebugPrivilege and token offsets from the loaded ntoskrnl.exe image, then loops corrupting kernel state via NtQuerySystemInformation while attempting to spawn a cmd.exe from winlogon.exe’s context until it succeeds, yielding an elevated shell.

Detection & Indicators of Compromise

Signs of compromise:

• Unexpected cmd.exe processes with a parent process ID pointing to winlogon.exe
• A low-integrity or standard-user process suddenly holding SeDebugPrivilege without a corresponding administrative action
• Anomalous, high-frequency NtQuerySystemInformation calls from user processes shortly before a privilege change

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/CCELEND/CVE-2026-40369 on 2026-07-05.