Linux Kernel 2.6.22 < 3.9 (x86/x64) - 'Dirty COW /proc/self/mem' Race Condition Privilege Escalation (SUID Method)

/ EDB-Note: After getting a shell, doing "echo 0 /proc/sys/vm/dirtywritebackcentisecs" may make the system more stable. uncomment correct payload first x86 or x64! $ gcc cowroot.c -o cowroot -pthread $ ./cowroot DirtyCow root privilege escalation Backing up /usr/bin/passwd.. to /tmp/bak Size of...

Linux Kernel 2.6.22 3.9 (x86x64) - Dirty COW procselfmem Race Condition Privilege Escalation (SUID Method)

Linux Kernel 2.6.22 3.9 x86x64 - Dirty COW procselfmem Race Condition Privilege Escalation SUID Method / EDB-Note: After getting a shell, doing "echo 0 /proc/sys/vm/dirtywritebackcentisecs" may make the system more stable. uncomment correct payload first x86 or x64! $ gcc cowroot.c -o cowroot...

Windows x64 - WinExec() Shellcode (93 bytes)

Windows x64 - WinExec Shellcode 93 bytes. Shellcode exploit for Winx86-64 platform / Title : Windows x64 WinExec shellcode Date : 15-10-2016 Author : Roziul Hasan Khan Shifat size : 93 bytes Tested on : Windows 7 Ultimate x64 / / Disassembly of section .text: 0000000000000000 : 0: 99 cltd 1: 65 4...

Windows/x64 - WinExec() Shellcode (93 bytes)

/ Title : Windows x64 WinExec shellcode Date : 15-10-2016 Author : Roziul Hasan Khan Shifat size : 93 bytes Tested on : Windows 7 Ultimate x64 / / Disassembly of section .text: 0000000000000000 : 0: 99 cltd 1: 65 48 8b 42 60 mov %gs:0x60%rdx,%rax 6: 48 8b 40 18 mov 0x18%rax,%rax a: 48 8b 70 10 mo...

ASLDRService ATK Hotkey 1.0.69.0 - Unquoted Service Path Privilege Escalation

---------------------------------------------------------------------------------------------------------- Exploit Title: ASLDRService ATK Hotkey- Privilege Escalation Unquoted Service Path Date: 13/10/2016 Exploit Author : Cyril Vallicari Vendor Homepage: www.asus.com Version: 1.0.69.0 Tested on...

ATKGFNEXSrv ATKGFNEX 1.0.11.1 - Unquoted Service Path Privilege Escalation

Exploit Title: ATKGFNEXSrv ATKGFNEX- Privilege Escalation Unquoted Service Path vulnerability Date: 13/10/2016 Exploit Author : Cyril Vallicari Vendor Homepage: www.asus.com Version: 1.0.11.1 Tested on: Windows 7 x64 SP1 but it should works on all windows version The application suffers from an...

Security Update for Adobe Flash Player for Windows 10 Version 1511 (for x64-based Systems) (KB3194343)

A security issue has been identified in a Microsoft software product that could affect your system. You can help protect your system by installing this update from Microsoft. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article...

Security Update for Adobe Flash Player for Windows 10 Version 1607 (for x64-based Systems) (KB3194343)

A security issue has been identified in a Microsoft software product that could affect your system. You can help protect your system by installing this update from Microsoft. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article...

Windows Meterpreter Shell, Reverse TCP Inline (IPv6) (x64)

Connect back to attacker and spawn a Meterpreter shell. Requires Windows XP SP2 or newer. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 203846 include Msf::Payload::TransportConf...

Windows Meterpreter Shell, Reverse TCP Inline x64

Connect back to attacker and spawn a Meterpreter shell. Requires Windows XP SP2 or newer. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 203846 include Msf::Payload::TransportConf...

Windows Meterpreter Shell, Bind TCP Inline (x64)

Connect to victim and spawn a Meterpreter shell. Requires Windows XP SP2 or newer. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework module MetasploitModule CachedSize = 203846 include Msf::Payload::TransportConfig...

Microsoft Windows Kernel 'Win32k.sys' CVE-2016-7185 Local Privilege Escalation Vulnerability

Description Microsoft Windows is prone to a local privilege-escalation vulnerability that occurs in the Windows kernel. A local attacker can exploit this issue to execute arbitrary code in kernel mode with elevated privileges. Technologies Affected Microsoft Windows 10 Version 1607 for 32-bit...

HTA Web Server

This module hosts an HTML Application HTA that when opened will run a payload via Powershell. When a user navigates to the HTA file they will be prompted by IE twice before the payload is executed. Module Options msf use exploit/windows/misc/hta/server msf undefinedserver show actions ...actions...

Street Fighter 5 - 'Capcom.sys' Kernel Execution (Metasploit) Exploit

Exploit for windows platform in category local exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'msf/core/post/windows/reflectivedllinjection' require 'rex' class MetasploitModule...

Security Update for Adobe Flash Player for Windows Embedded 8 Standard for X64-based Systems (KB3174060)

A security issue has been identified in a Microsoft software product that could affect your system. You can help protect your system by installing this update from Microsoft. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article...

Street Fighter 5 - Capcom.sys Kernel Execution (Metasploit)

Street Fighter 5 - Capcom.sys Kernel Execution Metasploit This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'msf/core/post/windows/reflectivedllinjection' require 'rex' class MetasploitModule...

Windows Capcom.sys Kernel Execution Exploit (x64 only)

This Metasploit module abuses the Capcom.sys kernel driver's function that allows for an arbitrary function to be executed in the kernel from user land. This function purposely disables SMEP prior to invoking a function given by the caller. This has been tested on Windows 7 x64. This module...

Street Fighter 5 - 'Capcom.sys' Kernel Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'msf/core/post/windows/reflectivedllinjection' require 'rex' class MetasploitModule 'Windows Capcom.sys Kernel Execution Exploit x64 only',...

Windows Capcom.sys Kernel Execution Exploit (x64 only)

This module abuses the Capcom.sys kernel driver's function that allows for an arbitrary function to be executed in the kernel from user land. This function purposely disables SMEP prior to invoking a function given by the caller. This has been tested on Windows 7, 8.1, 10 x64 and Windows 11 x64...

MSI - NTIOLib.sys / WinIO.sys Local Privilege Escalation

Exploit for windows platform in category local exploits Exploit Title: MSI NTIOLib.sys, WinIO.sys local privilege escalation Date: 2016-09-26 Exploit Author: ReWolf Vendor Homepage: http://www.msi.com Version: too many Tested on: Windows 10 x64 TH2, RS1 Full description:...