Vulners
Lucene search
Microsoft Windows 8.1 - DCOM DCE/RPC Local NTLM Reflection Privilege Escalation (MS15-076)
| Reporter | Title | Published | Views | Family All 16 |
|---|---|---|---|---|
 | Windows 8.1 - DCOM DCE/RPC Local NTLM Reflection Privilege Escalation (MS15-076) Exploit | 14 Aug 201500:00 | – | zdt |
 | CVE-2015-2370 | 3 Jan 202509:50 | – | circl |
 | Microsoft Windows Server Elevation of Privilege Vulnerability (CNVD-2015-04666) | 16 Jul 201500:00 | – | cnvd |
 | CVE-2015-2370 | 14 Jul 201522:00 | – | cve |
 | CVE-2015-2370 | 14 Jul 201522:00 | – | cvelist |
 | Microsoft Windows 8.1 - DCOM DCERPC Local NTLM Reflection Privilege Escalation (MS15-076) | 13 Aug 201500:00 | – | exploitpack |
 | Windows Exploitation Tricks: Relaying DCOM Authentication | 20 Oct 202100:00 | – | googleprojectzero |
 | KLA10631 Multiple vulnerabilities in Microsoft Windows | 14 Jul 201500:00 | – | kaspersky |
 | CVE-2015-2370 | 14 Jul 201522:59 | – | nvd |
 | Microsoft Windows Remote Procedure Call Privilege Elevation Vulnerability (3067505) | 15 Jul 201500:00 | – | openvas |
10
Source: https://github.com/monoxgas/Trebuchet
Trebuchet
MS15-076 (CVE-2015-2370) Privilege Escalation
Copies a file to any privileged location on disk
Compiled with VS2015, precompiled exe in Binary directory
Usage: trebuchet.exe C:\Users\Bob\Evil.txt C:\Windows\System32\Evil.dll
This is a lightly modified Proof of Concept by James Forshaw with Google, found here: https://code.google.com/p/google-security-research/issues/detail?id=325
CreateSymlink tool was written by James Forshaw found here: https://github.com/google/symboliclink-testing-tools
Notes:
Microsoft.VisualStudio.OLE.Inerop.dll must be in the same directory
Exploit can only be one once every 2-3 minutes. This is because RPC can be help up by LocalSystem
Tested on x64/x86 Windows 7/8.1
Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37768.zipData
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
13 Aug 2015 00:00Current
7.6High risk
Vulners AI Score7.6
CVSS 27.2
EPSS0.09725