2346 matches found
CVE-2015-0078
win32k.sys in the kernel-mode drivers in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly validate the token of a calling thread, which allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privile...
CVE-2015-0003
win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges or cause a denial of service...
win32k! GreBatchTextOut overflow exp challenges-vulnerability warning-the black bar safety net
http://technet.microsoft.com/en-us/security/bulletin/ms13-101 cve-2 0 1 3-3 8 9 9 kd u win32k! GreBatchTextOut win32k! GreBatchTextOut: bf8aa8b4 6 8 1 8 0 1 0 0 0 0 push 118h bf8aa8b9 68703c9abf push offset win32k!string'+0x4c bf9a3c70 bf8aa8be e8adc6feff call win32k! SEHprolog bf896f70 bf8aa8c3...
Microsoft Windows - win32k.sys Denial of Service
Microsoft Windows - win32k.sys Denial of Service Exploit Title: Microsoft Windows Win32k.sys Denial of Service Date: 20-11-2014 Exploit Author: Kedamsky [email protected] Vendor Homepage: http://microsoft.com Software Link: http://www.microsoft.com/en-us/download/windows.aspx Version: XP SP3, Vist...
Microsoft Windows - TrackPopupMenu Win32k Null Pointer Dereference (MS14-058) (Metasploit)
This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'msf/core/post/windows/reflectivedllinjection' require 'rex' class Metasploit3 'Windows TrackPopupMenu Win32k NULL Pointer Dereference',...
Did the “Man With No Name” Feel Insecure?
Posted by James Forshaw, Taker of Names Sometimes when I'm doing security research I'll come across a bug which surprises me. I discovered just such a bug in the Windows version of Chrome which exposed a little-known security detail in the OS. The bug, CVE-2014-3196 was fixed in M38, so it seemed...
VulnCheck KEV: CVE-2014-4113
Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation...
PT-2014-1733 · Microsoft · Windows 8 +8
Name of the Vulnerable Software and Affected Versions: Microsoft Windows versions prior to the fixed version Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT Gold and 8.1 Description: The...
Windows TrackPopupMenuEx Win32k NULL Page
No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'msf/core/post/windows/reflectivedllinjection' require 'rex' class Metasploit3 Msf::Exploit::Local Rank =...
MS10-073: Win32k Keyboard Layout Vulnerability
No description provided by source...
Windows NT - Windows 8 EPATHOBJ Local Ring 0 Exploit
No description provided by source. ifndef WIN32NOSTATUS define WIN32NOSTATUS endif include stdio.h include stdarg.h include stddef.h include windows.h include assert.h ifdef WIN32NOSTATUS undef WIN32NOSTATUS endif include ntstatus.h pragma commentlib, gdi32 pragma commentlib, kernel32 pragma...
Microsoft Windows win32k!xxxRealDrawMenuItem() Missing HBITMAP Bounds Checks
No description provided by source. Microsoft Windows win32k!xxxRealDrawMenuItem missing HBITMAP bounds checks ---------------------------------------------------------------------------- Microsoft produce two builds of each of thier supported operating system, a checked build and a free build. Th...
Microsoft Windows win32k!GreStretchBltInternal() Does Not Handle src == dest
No description provided by source. Microsoft Windows win32k!GreStretchBltInternal does not handle src == dest ---------------------------------------------------------------------------- A bitblt bit block transfer is used to copy one rectangular region of screen to another, often performing a...
MS15-061 Windows NTUserMessageCall Win32k Kernel Pool Overflow (Schlamperei)
No description provided by source. include include / Exploiting MS15-061 with reverse engineering Win32k.sys by steps : 1: hook PEB callback Function 2: trigger vulnerability make proper Window to lead vulnerable function 3: replace fake object with NtUserDefSetText in Desktop heap inside PEB...
Windows Win32k Pointer Dereferencement PoC (MS10-098)
No description provided by source. / MS10-098 CVE-2010-3944 Microsoft Windows Win32k pointer dereferencement -------------------- Affected Software ------------------------ Microsoft Windows 7 / 2008 -------------------- Consequences ----------------------- An unprivileged user may be able to cau...
Windows NTUserMessageCall Win32k Kernel Pool Overflow (Schlamperei)
A kernel pool overflow in Win32k which allows local privilege escalation. The kernel shellcode nulls the ACL for the winlogon.exe process a SYSTEM process. This allows any unprivileged process to freely migrate to winlogon.exe, achieving privilege escalation. Used in pwn2own 2013 by MWR to break...
Microsoft Windows - NTUserMessageCall Win32k Kernel Pool Overflow 'schlamperei.x86.dll' (MS13-053) (Metasploit)
This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'msf/core/post/windows/reflectivedllinjection' require 'rex' class Metasploit3 'Windows NTUserMessageCall Win32k Kernel Pool Overflow...
Windows NTUserMessageCall Win32k Kernel Pool Overflow (Schlamperei)
This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'msf/core/post/windows/reflectivedllinjection' require 'rex' class Metasploit3 'Windows NTUserMessageCall Win32k Kernel Pool Overflow...
Windows NTUserMessageCall Win32k Kernel Pool Overflow (Schlamperei)
This module leverages a kernel pool overflow in Win32k which allows local privilege escalation. The kernel shellcode nulls the ACL for the winlogon.exe process a SYSTEM process. This allows any unprivileged process to freely migrate to winlogon.exe, achieving privilege escalation. This exploit wa...
CVE-2014-0323
CVE-2014-0323 affects Microsoft Windows kernel-mode driver win32k.sys, enabling local attackers to disclose kernel memory contents or trigger a system hang via a crafted application. Affected products include Windows XP SP2/SP3, Server 2003 SP2, Vista SP2, Server 2008 SP2/R2, Windows 7 SP1, Windo...