# CVE-2023-36874 Proof of Concept (PoC)

An educational and defensive research implementation of the **CVE-2023-36874** vulnerability, demonstrating a Local Privilege Escalation (LPE) flaw within the Windows Error Reporting (WER) component.

## ⚠️ Disclaimer
This repository and the provided source code are intended **strictly for educational purposes, security research, and defensive auditing**. Do not run this code on production systems or environments without explicit authorization. The author accepts no liability for any misuse, damage, or illegal activity conducted with this material.

---

## 🔍 Vulnerability Overview
**CVE-2023-36874** is a logical privilege escalation vulnerability in **Windows Error Reporting (WER)**. 

A low-privileged attacker can exploit this flaw by manipulating the Windows Object Manager namespace. By creating a custom symbolic link (`\??\C:`) inside the local session directory, the attacker can redirect file access requests intended for the root drive. 

When a highly privileged service (`NT AUTHORITY\SYSTEM`) triggers error reporting tasks using specific, undocumented COM interfaces (such as `IErcLuaSupport`), it improperly executes files from the redirected path. This allows a user-controlled binary (`wermgr.exe`) to be executed with `SYSTEM` privileges.

## 🛠️ Project Structure
* `main.cpp` — The main C++ source code responsible for environment setup, Object Manager symlink creation, and COM interaction.
* `exploit.exe` *(Placeholder)* — The target payload binary that will be spawned by the privileged service.

---

## 🚀 Building the Project

### Prerequisites
* **Visual Studio 2022** (or higher) with the **Desktop development with C++** workload installed.
* Target Operating System: Unpatched Windows 10/11 or Windows Server (prior to July 2023 security updates).

### Configuration in Visual Studio
1. Open Visual Studio and create a new **C++ Empty Project**.
2. Add `main.cpp` to the source files.
3. **Crucial:** Change the build configuration from `x86` (Win32) to **`x64`**. The exploit relies on 64-bit system path resolution.
4. Build the solution (`Ctrl + Shift + B`).

---

## 📊 Technical Flow & Execution Behavior

When executed, the program performs the following operations behind the scenes:
1. **Environment Initialization:** Creates dummy report folders in `C:\ProgramData` and prepares a mirror directory structure in `C:\Users\Public\test\Windows\System32`.
2. **Object Manager Hijacking:** Calls `NtCreateSymbolicLinkObject` to reroute local session drive `C:` queries to the custom `Public\test` folder.
3. **COM Activation:** Connects to the out-of-process COM server using `CLSID_ERCLuaSupport`.
4. **Triggering Execution:** Forces the privileged service to load and submit the dummy report via `SubmitReport()`. The system attempts to launch `C:\Windows\System32\wermgr.exe` but gets redirected to the payload.

### Output
The binary runs **silently** in the background. 
* If successful, the exit code is `0` and your payload will execute in the context of `NT AUTHORITY\SYSTEM`.
* If it fails (e.g., due to missing prerequisites or an already applied patch), it will exit with `-1`.

---

## 🛡️ Remediation and Patching
This issue was formally addressed by Microsoft in the **July 2023 Patch Tuesday** update cycle. 

To mitigate this and similar vulnerabilities:
* Ensure your operating system is up to date with the latest cumulative quality updates.
* Ensure proper implementation of path validation and impersonation token sanitation within custom system-level services.