what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Showing 26 - 26 of 26

Files Date: 2012-10-03 to 2012-10-04

MS11-080 AfdJoinLeaf Privilege Escalation

Posted Oct 3, 2012

Authored by Matteo Memelli, Spencer McIntyre | Site metasploit.com

This Metasploit module exploits a flaw in the AfdJoinLeaf function of the afd.sys driver to overwrite data in kernel space. An address within the HalDispatchTable is overwritten and when triggered with a call to NtQueryIntervalProfile will execute shellcode. This Metasploit module will elevate itself to SYSTEM, then inject the payload into another SYSTEM process before restoring it's own token to avoid causing system instability.

tags | exploit, kernel, shellcode

advisories | CVE-2011-2005

SHA-256 | f6dc1203a74e12170988c31fabd455ab39d26e8231aa917f56967362c0509242

Download | Favorite | View