Microsoft Windows Vista/7 - Local Privilege Escalation (UAC Bypass)
| Reporter | Title | Published | Views | Family All 17 |
|---|---|---|---|---|
 | CVE-2010-4398 | 6 Dec 201000:00 | – | attackerkb |
 | CVE-2010-4398 | 24 Nov 201000:00 | – | circl |
 | Microsoft Windows Kernel Stack-Based Buffer Overflow Vulnerability | 28 Mar 202200:00 | – | cisa_kev |
 | Microsoft Windows Kernel win32k.sys Privilege Escalation (MS11-011; CVE-2010-4398) | 18 Mar 201100:00 | – | checkpoint_advisories |
 | CVE-2010-4398 | 3 Dec 201020:00 | – | cve |
 | CVE-2010-4398 | 3 Dec 201020:00 | – | cvelist |
 | CARBANAK Week Part Two: Continuing the CARBANAK Source Code Analysis | 23 Apr 201917:45 | – | fireeye |
 | Immunity Canvas: MS_ENABLEEUDC | 6 Dec 201013:44 | – | canvas |
 | CVE-2010-4398 | 6 Dec 201013:44 | – | nvd |
 | Microsoft Windows Kernel Elevation of Privilege Vulnerability (2393802) | 9 Feb 201100:00 | – | openvas |
10
A Design Flaw in Windows Kernel API can Lead to privilege escalation.
Mirror of Original Post: http://www.exploit-db.com/bypassing-uac-with-user-privilege-under-windows-vista7-mirror/
PoC: http://www.codeproject.com/KB/vista-security/uac.aspx (not available)
mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/15609.zip (uacpoc.zip)
After running this PoC, just type “whoami” in command prompt to see the escalated user credentials.
Points of Interest
All actions this PoC performs require only user privilege, but result in arbitrary kernel mode code execution due to the ambiguous design of RtlQueryRegistryValues. This design flaw exists in most versions of Windows kernels, yet no patch or documentation is publicly available on this issue.
Additional Information
This PoC may not correctly fix the exploited kernel context and resume execution without BSOD, such as on kernels ealier than 6.1.6000 are not supported, current supported kernels are:
Windows Vista/2008 6.1.6000 x32,
Windows Vista/2008 6.1.6001 x32,
Windows 7 6.2.7600 x32,
Windows 7/2008 R2 6.2.7600 x64.
Beyond this scope you may contact me for information on how to tune the code to work correctly on your kernel or how the shellcode works, etc. Those contents are beyond the scope of this article and of no importance to the exploit, therefore it is not included.Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
24 Nov 2010 00:00Current
5.2Medium risk
Vulners AI Score5.2
CVSS 27.2
CVSS 3.17.8
EPSS0.08661
SSVC