Microsoft Windows - DeviceApi CMApi User Hive Impersonation Privilege Escalation (MS16-124)

/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=875 Windows: DeviceApi CMApi User Hive Impersonation EoP Platform: Windows 10 10586 not tested 8.1 Update 2 or Windows 7 Class: Elevation of Privilege Summary: The DeviceApi CMApi PnpCtxRegOpenCurrentUserKey function doesn’t chec...

Microsoft Windows Diagnostics Hub - DLL Load Privilege Escalation (MS16-125)

/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=887 Windows: Diagnostics Hub DLL Load EoP Platform: Windows 10 10586, not tested 8.1 Update 2 or Windows 7 Class: Elevation of Privilege Summary: The fix for CVE-2016-3231 is insufficient to prevent a normal user specifying an...

Immunity Canvas: MS16_111

Name| ms16111 ---|--- CVE| CVE-2016-3371 Exploit Pack| CANVAS Description| MS16-111 Registry Hive Hijack Notes| CVE Name: CVE-2016-3371 VENDOR: Microsoft Notes: Tested against: Windows 10 x64 EN both Chinese and English usernames - SUCCESSFUL EOP Windows XP x86 - EXECUTABLE DOES NOT RUN Windows 7...

Little Snitch Bug Leaves Some Mac Systems Open to Attack

Trusted Mac OS X firewall Little Snitch is vulnerable to local privilege escalation attacks that could give criminals the ability plant rootkits and keyloggers on some El Capitan systems. The Little Snitch firewall vulnerability was found by Synack Director of Research and well-known OS X hacker...

Hide.Me VPN Client 1.2.4 - Privilege Escalation

Exploit for windows platform in category local exploits Title: Hide.Me VPN Client - EoP: User to SYSTEM CWE Class: CWE-276: Incorrect Default Permissions Date: 01/06/2016 Vendor: eVenture Product: Hide.Me VPN Client Version: 1.2.4 Download link: https://hide.me/en/software/windows Tested on:...

Hide.Me VPN Client 1.2.4 Privilege Escalation

Title: Hide.Me VPN Client - EoP: User to SYSTEM CWE Class: CWE-276: Incorrect Default Permissions Date: 01/06/2016 Vendor: eVenture Product: Hide.Me VPN Client Version: 1.2.4 Download link: https://hide.me/en/software/windows Tested on: Windows 7 x86, fully patched Release mode: no bugbounty...

EOP Compendium Master Handles EOPN File Memory Corruption Vulnerability

EOP Short Score Master is a permanently free software for making piano short scores. The software has a memory corruption vulnerability when dealing with the EOPN format, which allows attackers to crash the program by constructing malformed EOPN files that can be executed in arbitrary code if...

Everyone Piano Handles EOP File Memory Corruption Vulnerability

Everyone Piano is a program to play piano music through the keyboard. A memory corruption vulnerability exists in the handling of EOP files, which allows attackers to crash the program by constructing malformed EOP files...

Microsoft Windows 7 SP1 (x86) - Privilege Escalation (MS16-014)

Exploit for windows platform in category local exploits / Exploit Title: Elevation of privilege on Windows 7 SP1 x86 Date: 28/06-2016 Exploit Author: @blomster81 Vendor Homepage: www.microsoft.com Version: Windows 7 SP1 x86 Tested on: Windows 7 SP1 x86 CVE : 2016-0400 MS16-014 EoP PoC created fro...

Microsoft Windows - CreateObjectTask TileUserBroker Privilege Escalation

Microsoft Windows - CreateObjectTask TileUserBroker Privilege Escalation Source: https://code.google.com/p/google-security-research/issues/detail?id=439 Windows: CreateObjectTask TileUserBroker Elevation of Privilege Platform: Windows 8.1 Update I don’t believe it’s available in earlier Windows...

Microsoft Windows Task Scheduler - 'DeleteExpiredTaskAfter' File Deletion Privilege Escalation

Source: https://code.google.com/p/google-security-research/issues/detail?id=442 Windows: Task Scheduler DeleteExpiredTaskAfter File Deletion Elevation of Privilege Platform: Windows 8.1 Update, looks like it should work on 7 and 10 as well Class: Elevation of Privilege Summary: The Task Scheduler...

Взлом Hacking Team

В рунете тишина, давайте обсудим. Цитата: @cBekrar: I think I've spotted the name of the guy who sold the Windows Kernel EoP 0day to Hackingteam, 25K EUR is a decent price. --- Я думал все куда лучше, а тут директор vupen пишет, что это decent price...

Microsoft Windows - Local Privilege Escalation (MS15-010) Exploit

Exploit for windows platform in category local exploits // ex.cpp / Windows XP/2K3/VISTA/2K8/7 WMSYSTIMER Kernel EoP CVE-2015-0003 March 2015 Public Release: May 24, 2015 Tested on: x86: Win 7 SP1 | Win 2k3 SP2 | Win XP SP3 x64: Win 2k8 SP1 | Win 2k8 R2 SP1 Author: Skylake - skylake mail com /...

DosDevices Impersonation Process Creation Elevation of Privilege

The fix for CVE-2015-1644 doesn’t take into account process creation scenarios. If a process is created by a system service while impersonating another user their per-user drive mappings will still be used which could lead to EoP. Recent assessments: busterb at May 09, 2019 5:57pm UTC reported: N...

Comodo Backup 4.4.0.0 - NULL Pointer Dereference EOP

Exploit for windows platform in category local exploits / Exploit Title - Comodo Backup Null Pointer Dereference Privilege Escalation Date - 23rd January 2015 Discovered by - Parvez Anwar @parvezghh Vendor Homepage - https://www.comodo.com Tested Version - 4.4.0.0 Driver Version - 1.0.0.957 -...

Sandbox Escape: Win32k Window Handle Vulnerability (EoP)

This bug was disclosed directly to Microsoft. http://technet.microsoft.com/en-us/security/bulletin/ms14-003...

A web site security detection system of an EOP 0Day-vulnerability warning-the black bar safety net

Following last night found a website security monitoring system in the presence of a tasteless 0Day after, and just through pure manual way to discover its presence at an EOP 0Day the. This is my study of vulnerabilities for the first time since without the aid of the Fuzz of the case to find the...

Null pointer dereference

The Client/Server Run-time Subsystem aka CSRSS in the Win32 subsystem in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly initialize memory and consequently uses a NULL...

CVE-2011-1281

The Client/Server Run-time Subsystem aka CSRSS in the Win32 subsystem in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly restrict the number of console objects for a...

Cross site scripting

Cross-site scripting XSS vulnerability in the Web Monitor in Microsoft Forefront Unified Access Gateway UAG 2010 Gold, 2010 Update 1, and 2010 Update 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "UAG XSS Allows EOP Vulnerability."...