CVE-2015-2524

Related Files

Windows CreateObjectTask SettingsSyncDiagnostics Privilege Escalation

Posted Sep 18, 2015

Authored by Google Security Research, forshaw

The Microsoft\Windows\Shell\CreateObjectTask initializes a shell32 based ICreateObject COM server as local system. This is marked as being accessible from a normal user account so once created we can attach to it. The server only has one method, CreateObject which checks the CLSID against a list of known safe classes before allowing it to be instantiated. One of these classes is a diagnostic class for setting synchronization implemented in SettingSync.dll.

tags | exploit, shell, local

systems | linux, windows

advisories | CVE-2015-2524

SHA-256 | 6aef4dd16b7085d61fe94cd118f3ece652f9cd33df0722b63a4bf31f53557554

Download | Favorite | View