what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Showing 1 - 1 of 1

Files from Jon

Windows NTUserMessageCall Win32k Kernel Pool Overflow (Schlamperei)

Posted May 5, 2014

Authored by Nils, Jon | Site metasploit.com

A kernel pool overflow in Win32k which allows local privilege escalation. The kernel shellcode nulls the ACL for the winlogon.exe process (a SYSTEM process). This allows any unprivileged process to freely migrate to winlogon.exe, achieving privilege escalation. Used in pwn2own 2013 by MWR to break out of chrome's sandbox. NOTE: when you exit the meterpreter session, winlogon.exe is likely to crash.

tags | exploit, overflow, kernel, local, shellcode

advisories | CVE-2013-1300

SHA-256 | 029ce3aa761be432ed6f02ed2e5c43c401df5d87b251095db17f6f35430afe2d

Download | Favorite | View