Exploit the possiblities
Showing 1 - 25 of 31 RSS Feed

Files from James Forshaw

First Active2011-08-11
Last Active2018-01-11
Microsoft Windows SMB Server Mount Point Privilege Escalation
Posted Jan 11, 2018
Authored by James Forshaw, Google Security Research

On Microsoft Windows, the SMB server drivers (srv.sys and srv2.sys) do not check the destination of a NTFS mount point when manually handling a reparse operation leading to being able to locally open an arbitrary device via an SMB client which can result in privilege escalation.

tags | exploit, arbitrary
systems | windows
advisories | CVE-2018-0749
MD5 | 8bee2db391a04c548de7c3126b3c73a4
Microsoft Windows NtImpersonateAnonymousToken LPAC To Non-LPAC Privilege Escalation
Posted Jan 11, 2018
Authored by James Forshaw, Google Security Research

On Microsoft Windows, when impersonating the anonymous token in an LPAC the WIN://NOAPPALLPKG security attribute is ignored leading to impersonating a non-LPAC token leading to privilege escalation.

tags | exploit
systems | windows
advisories | CVE-2018-0752
MD5 | 8c8cfa8d06fb3178fe47edd96393a118
Microsoft Windows NtImpersonateAnonymousToken AC To Non-AC Privilege Escalation
Posted Jan 11, 2018
Authored by James Forshaw, Google Security Research

On Microsoft Windows, the check for an AC token when impersonating the anonymous token does not check impersonation token's security level leading to impersonating a non-AC anonymous token leading to privilege escalation.

tags | exploit
systems | windows
advisories | CVE-2018-0751
MD5 | ec5a514309e694f43622f9260cc4f20a
Microsoft Windows NTFS Owner/Mandatory Label Privilege Bypass
Posted Jan 11, 2018
Authored by James Forshaw, Google Security Research

When creating a new file on an NTFS drive it's possible to circumvent security checks for setting an arbitrary owner and mandatory label leading to a non-admin user setting those parts of the security descriptor with non-standard values which could result in further attacks resulting privilege escalation.

tags | exploit, arbitrary
advisories | CVE-2018-0748
MD5 | 23055e91c47aae5d9ca3bd19f9708bba
Microsoft Windows Local XPS Print Spooler Sandbox Escape
Posted Jan 10, 2018
Authored by James Forshaw, Google Security Research

The Microsoft Windows local print spooler can be abused to create an arbitrary file from a low privilege application including one in an AC as well as a typical Edge LPAC CP leading to elevation of privilege.

tags | exploit, arbitrary, local
systems | windows
MD5 | f9c76875d1743262b2802cf76e9e7f56
Intel Content Protection HECI Service Privilege Escalation
Posted Dec 19, 2017
Authored by James Forshaw, Google Security Research

The Intel Content Protection HECI Service exposes a DCOM object to all users and most sandboxes (such as Edge LPAC and Chrome GPU). It has a type confusion vulnerability which can be used to elevate to SYSTEM privileges.

tags | exploit
advisories | CVE-2017-5717
MD5 | a4c2f8375ebdc7ea8ce2023d56ff8651
Windows Defender Controlled Folder Bypass
Posted Nov 30, 2017
Authored by James Forshaw, Google Security Research

Windows Defender suffers from a controlled folder bypass through the UNC path. Affected includes Windows 10 1709 and Antimalware client version 4.12.16299.15.

tags | exploit
systems | windows
MD5 | a7c30a5ca5f72bced3e65bfc017e3f47
Microsoft Windows CI CiSetFileCache TOCTOU Security Feature Bypass
Posted Nov 21, 2017
Authored by James Forshaw, Google Security Research

It is possible to add a cached signing level to an unsigned file by exploiting a TOCTOU in CI leading to circumvention of Device Guard policies and possibly PPL signing levels.

tags | exploit
advisories | CVE-2017-11830
MD5 | 8ebc146325ec05100a1d36b627380a7b
Microsoft Windows WLDP/Scriptlet CLSID UMCI Bypass
Posted Nov 15, 2017
Authored by James Forshaw, Google Security Research

The enlightened lockdown policy check for COM Class instantiation can be bypassed in Scriptlet hosts leading to arbitrary code execution on a system with UMCI enabled (e.g. Device Guard).

tags | exploit, arbitrary, code execution
MD5 | 9f26a70091ba091d126dd62e22de0746
Microsoft Windows WLDP/MSHTML CLSID UMCI Bypass
Posted Oct 14, 2017
Authored by James Forshaw, Google Security Research

The enlightened lockdown policy check for COM Class instantiation can be bypassed in MSHTML hosts leading to arbitrary code execution on a system with UMCI enabled (e.g. Device Guard).

tags | exploit, arbitrary, code execution
advisories | CVE-2017-11823
MD5 | 1b2d4d07eba9dc0ac29034a6908021a0
Microsoft Windows PPL Process Injection Privilege Escalation
Posted Aug 29, 2017
Authored by James Forshaw, Google Security Research

Microsoft Windows suffers from an issue where it is possible to inject code into a PPL protected process by hijacking COM objects leading to accessing PPL processes such as Lsa and AntiMalware from an administrator.

tags | exploit
systems | windows
MD5 | f56afa12662c26fd335723f194b4b1df
VirtualBox Windows Process DLL UNC Path Signature Bypass Privilege Escalation
Posted Aug 4, 2017
Authored by James Forshaw, Google Security Research

VirtualBox suffers from a privilege escalation vulnerability due to a windows process DLL UNC path signature bypass vulnerability.

tags | exploit, bypass
systems | windows
advisories | CVE-2017-10129
MD5 | b7b24727a13df6c61f230dfaf8caa4b7
VirtualBox indows Process DLL Signature Bypass Privilege Escalation
Posted Aug 4, 2017
Authored by James Forshaw, Google Security Research

VirtualBox suffers from a privilege escalation vulnerability due to a windows process DLL signature bypass vulnerability.

tags | exploit, bypass
systems | windows
advisories | CVE-2017-10204
MD5 | e1476610f1872866ca63ea58ddd4a886
Microsoft Windows COM Session Moniker Privilege Escalation
Posted Jul 14, 2017
Authored by James Forshaw, Google Security Research | Site metasploit.com

Microsoft Windows has a bad fix for the COM session moniker that can allow for elevation of privilege.

tags | advisory
systems | windows
advisories | CVE-2017-0298
MD5 | 3415ad73c8d69869f7f6b54856151c87
MS16-032 Secondary Logon Handle Privilege Escalation
Posted Jul 12, 2016
Authored by b33f, James Forshaw, khr0x40sh | Site metasploit.com

This Metasploit module exploits the lack of sanitization of standard handles in Windows' Secondary Logon Service. The vulnerability is known to affect versions of Windows 7-10 and 2k8-2k12 32 and 64 bit. This Metasploit module will only work against those versions of Windows with Powershell 2.0 or later and systems with two or more CPU cores.

tags | exploit
systems | windows, 7
advisories | CVE-2016-0099
MD5 | 37a34759947c810455938c65ab482084
Microsoft Windows Local WebDAV NTLM Reflection Privilege Escalation
Posted Mar 24, 2015
Authored by James Forshaw

A default installation of Windows 7/8 can be made to perform a NTLM reflection attack through WebDAV which allows a local user to elevate privileges to local system. It can also be used to escape application sandboxes if TCP socket access is not blocked. Microsoft will not fix this issue.

tags | advisory, local, tcp
systems | windows, 7
MD5 | acf5e4414852c101a882e4682f56ac7f
Microsoft Windows NtApphelpCacheControl Improper Authorization Check
Posted Jan 15, 2015
Authored by sinn3r, James Forshaw | Site metasploit.com

On Windows, the system call NtApphelpCacheControl (the code is actually in ahcache.sys) allows application compatibility data to be cached for quick reuse when new processes are created. A normal user can query the cache but cannot add new cached entries as the operation is restricted to administrators. This is checked in the function AhcVerifyAdminContext. This function has a vulnerability where it doesn't correctly check the impersonation token of the caller to determine if the user is an administrator. It reads the caller's impersonation token using PsReferenceImpersonationToken and then does a comparison between the user SID in the token to LocalSystem's SID. It doesn't check the impersonation level of the token so it's possible to get an identify token on your thread from a local system process and bypass this check. This Metasploit module currently only affects Windows 8 and Windows 8.1, and requires access to C:\Windows\System\ComputerDefaults.exe (although this can be improved).

tags | exploit, local
systems | windows
advisories | CVE-2015-0002
MD5 | 0a24503dad5a5aa40600b53cdb125f0c
ExploitRemotingService .NET Tool
Posted Nov 19, 2014
Authored by James Forshaw

This is a tool to exploit .NET Remoting Services vulnerable to CVE-2014-1806 or CVE-2014-4149. It only works on Windows although some aspects might work in Mono on *nix.

tags | exploit
systems | windows
advisories | CVE-2014-1806, CVE-2014-4149
MD5 | 2f08afabb6a71899af115848864f91b0
MS14-009 .NET Deployment Service IE Sandbox Escape
Posted Jun 27, 2014
Authored by juan vazquez, James Forshaw | Site metasploit.com

This Metasploit module abuses a process creation policy in the Internet Explorer Sandbox which allows to escape the Enhanced Protected Mode and execute code with Medium Integrity. The problem exists in the .NET Deployment Service (dfsvc.exe), which can be run as Medium Integrity Level. Further interaction with the component allows to escape the Enhanced Protected Mode and execute arbitrary code with Medium Integrity.

tags | exploit, arbitrary
advisories | CVE-2014-0257
MD5 | 6fa97cd4c465e9e94afcce09121b97e6
MS13-097 Registry Symlink IE Sandbox Escape
Posted Jun 27, 2014
Authored by juan vazquez, James Forshaw | Site metasploit.com

This Metasploit module exploits a vulnerability in Internet Explorer Sandbox which allows to escape the Enhanced Protected Mode and execute code with Medium Integrity. The vulnerability exists in the IESetProtectedModeRegKeyOnly function from the ieframe.dll component, which can be abused to force medium integrity IE to user influenced keys. By using registry symlinks it's possible force IE to add a policy entry in the registry and finally bypass Enhanced Protected Mode.

tags | exploit, registry
advisories | CVE-2013-5045
MD5 | ef7740b999fc84dc0a624768d0f11944
Microsoft Internet Explorer COALineDashStyleArray Unsafe Memory Access
Posted Nov 26, 2013
Authored by Vitaliy Toropov, juan vazquez, James Forshaw | Site metasploit.com

This Metasploit module exploits a vulnerability on Microsoft Silverlight. The vulnerability exists on the Initialize() method from System.Windows.Browser.ScriptObject, which access memory in an unsafe manner. Since it is accessible for untrusted code (user controlled) it's possible to dereference arbitrary memory which easily leverages to arbitrary code execution. In order to bypass DEP/ASLR a second vulnerability is used, in the public WriteableBitmap class from System.Windows.dll. This Metasploit module has been tested successfully on IE6 - IE10, Windows XP SP3 / Windows 7 SP1 on both x32 and x64 architectures.

tags | exploit, arbitrary, code execution, bug bounty, packet storm
systems | windows, xp, 7
advisories | CVE-2013-0074, CVE-2013-3896, OSVDB-91147, OSVDB-98223
MD5 | db77ce1a58c39fd936f1e6241e3e85cb
Apache Santuario XML Security For C++ Signature Bypass
Posted Jun 18, 2013
Authored by James Forshaw

The implementation of XML digital signatures in the Santuario-C++ library is vulnerable to a spoofing issue allowing an attacker to reuse existing signatures with arbitrary content. The vulnerability affects only applications that do not perform proper checking/analysis of the content of the Reference elements in the Signature, but the bug exacerbates this problem by opening such applications to attacks using arbitrary content, instead of just attacks involving malicious, but signed, content. Versions prior to 1.7.1 are affected.

tags | advisory, arbitrary, spoof
advisories | CVE-2013-2153
MD5 | 6909adda4a133b3bb2789f0b09950d0f
Apache Santuario XML Security For C++ Heap Overflow
Posted Jun 18, 2013
Authored by James Forshaw

A heap overflow exists in the processing of the PrefixList attribute optionally used in conjunction with Exclusive Canonicalization, potentially allowing arbitrary code execution. If verification of the signature occurs prior to actual evaluation of a signing key, this could be exploited by an unauthenticated attacker. Apache Santuario XML Security for C++ library versions prior to 1.7.1 are affected.

tags | advisory, overflow, arbitrary, code execution
advisories | CVE-2013-2156
MD5 | e9bfa2ee300325c5ed08df2593f5a6ff
Apache Santuario XML Security For C++ Denial Of Service / Bypass
Posted Jun 18, 2013
Authored by James Forshaw

A bug exists in the processing of the output length of an HMAC-based XML Signature that would cause a denial of service when processing specially chosen input. Exploitation of this issue does not require authenticated content. In very unusual cases, inputs could be chosen in such a way that the fix for the issue in CVE-2009-0217 could be bypassed, enabling improper verification of a signature. Versions prior to 1.7.1 are affected.

tags | advisory, denial of service
advisories | CVE-2013-2155
MD5 | a1fb07cc6fa97feddc0acf800c8a09d8
Apache Santuario XML Security For C++ Stack Overflow
Posted Jun 18, 2013
Authored by James Forshaw

A stack overflow, possibly leading to arbitrary code execution, exists in the processing of malformed XPointer expressions in the XML Signature Reference processing code. An attacker could use this to exploit an application performing signature verification if the application does not block the evaluation of such references prior to performing the verification step. The exploit would occur prior to the actual verification of the signature, so does not require authenticated content. Versions prior to 1.7.1 are affected.

tags | advisory, overflow, arbitrary, code execution
advisories | CVE-2013-2154
MD5 | 2e4c041ed6441f26334548c790ec639b
Page 1 of 2
Back12Next

Want To Donate?


Bitcoin: 18PFeCVLwpmaBuQqd5xAYZ8bZdvbyEWMmU

File Archive:

February 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    15 Files
  • 2
    Feb 2nd
    15 Files
  • 3
    Feb 3rd
    15 Files
  • 4
    Feb 4th
    13 Files
  • 5
    Feb 5th
    16 Files
  • 6
    Feb 6th
    15 Files
  • 7
    Feb 7th
    15 Files
  • 8
    Feb 8th
    15 Files
  • 9
    Feb 9th
    18 Files
  • 10
    Feb 10th
    8 Files
  • 11
    Feb 11th
    8 Files
  • 12
    Feb 12th
    17 Files
  • 13
    Feb 13th
    15 Files
  • 14
    Feb 14th
    15 Files
  • 15
    Feb 15th
    17 Files
  • 16
    Feb 16th
    18 Files
  • 17
    Feb 17th
    37 Files
  • 18
    Feb 18th
    2 Files
  • 19
    Feb 19th
    16 Files
  • 20
    Feb 20th
    11 Files
  • 21
    Feb 21st
    3 Files
  • 22
    Feb 22nd
    0 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close