OP 15 February, 2023 - 10:46 PM
So we can find out the principle: Because the creation and deletion of temporary files occur one after another, and there is no restriction on the file between the two operations, this causes the attacker to create another thread. After the temporary file is created and before the deletion, the attacker can obtain the file handle and create an opportunity lock to prevent other threads from operating. At the same time, the file is deleted, and the original file path is set to point to other files. When the opportunity lock is released, Other files pointed to will be deleted.
CVE-2023-21752 is a Windows Local Exploit to elevate privilege. Its bottom principle is condition race.
Virustotal link https://www.virustotal.com/gui/file/7007545e3ec52584ee333f19e194e43dffe08fc6eac9795ef4a0eee8cfad02b9?nocache=1