#cve_2024_28916 — Public Fediverse posts

Here is the proof of concept for CVE-2024-28916: 🔗 https://github.com/Wh04m1001/GamingServiceEoP

Exploit for arbitrary folder move in GamingService component of Xbox. GamingService is not default service. If service is installed on system it allows low privilege users to escalate to system.

During the process of changing directory the Gaming Services service will try to open C:\XboxGames\GameSave\Content\MicrosoftGame.Config file, if the file exists the gaming service will try to move whole C:\XboxGames\GameSave folder. It does that by calling MoveFileW API call while impersonating calling user.

If gaming service fails to move folder due to access denied error it will revert impersonation and perform the move operation as system. As the C:\XboxGames folder gives modify permissions to authenticated users group (even if it does not the user can change it to directory that is fully controlled by that user) user can delete c:\xboxgames folder, create new one, drop arbitrary dll inside C:\XboxGames\GameSave folder and add deny delete ACL for itself so that move operation fails while impersonating user.

#CVE_2024_28916 #MSRC #Microsoft #xbox #vulnerability #proofofconcept

Who expected an Xbox Gaming Services Elevation of Privilege Vulnerability to be a Zero Day?! Microsoft Security Response Center (MSRC) published CVE-2024-28916 (8.8 high), marked as Publicly Disclosed. "An attacker who successfully exploited this vulnerability could gain SYSTEM privileges." Proof-of-concept exploit code is available. This must have been serious enough to release an update and advisory outside of Patch Tuesday. 🔗 https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-28916

cc: @campuscodi

#CVE_2024_28916 #MSRC #Microsoft #xbox #vulnerability #proofofconcept