Microsoft Windows Kernel - Bitmap Handling Use-After-Free (MS15-061) (2)

Source: https://code.google.com/p/google-security-research/issues/detail?id=311 Bitmap object Use-after-Free 2 The attached PoC triggers a blue screen due to a use after free vulnerability. The crashes are unreliable, however you can use Special Pool in order to get reliable crashes. The crashes...

Microsoft Windows Kernel - 'HmgAllocateObjectAttr' Use-After-Free (MS15-061)

Source: https://code.google.com/p/google-security-research/issues/detail?id=320 The PoC bug checks reliably with Special Pool enabled on writing to freed memory. A reference to the freed memory is held at offset +0x10 of the THREADINFO object. This memory is referenced in HmgAllocateObjectAttr...

Microsoft Windows Kernel - Use-After-Free with Cursor Object (MS15-097)

Source: https://code.google.com/p/google-security-research/issues/detail?id=457 --- The attached testcase crashes Win 7 with Special Pool enabled while accessing the freed global cursor object gpqCursor. See poc.cpp for instructions on how to compile and run. Proof of Concept:...

Microsoft Windows Kernel - FlashWindowEx​ Memory Corruption (MS15-097)

Microsoft Windows Kernel - FlashWindowEx​ Memory Corruption MS15-097 Source: https://code.google.com/p/google-security-research/issues/detail?id=475 --- The attached PoC triggers a wild write on Win 7 32-bit with Special Pool enabled on win32k.sys. --- Proof of Concept:...

Microsoft Windows Kernel - win32k!vSolidFillRect Buffer Overflow (MS15-061)

Microsoft Windows Kernel - win32k!vSolidFillRect Buffer Overflow MS15-061 Source: https://code.google.com/p/google-security-research/issues/detail?id=313 The PoC triggers a pool buffer overflow in win32k!vSolidFillRect. ​When using Special Pool we get the crash immediately on the overwrite. Witho...

Microsoft Windows Kernel - Pool Buffer Overflow Drawing Caption Bar (MS15-061)

Microsoft Windows Kernel - Pool Buffer Overflow Drawing Caption Bar MS15-061 Source: https://code.google.com/p/google-security-research/issues/detail?id=321 The PoC triggers a crashes due to a pool buffer overflow while drawing the caption bar of window. The trigger depends on the current window...

Microsoft Windows Kernel - 'bGetRealizedBrush' Use-After-Free (MS15-097)

Source: https://code.google.com/p/google-security-research/issues/detail?id=458 --- The attached testcase crashes Win 7 with Special Pool on win32k while accessing freed memory in bGetRealizedBrush. --- Proof of Concept:...

Microsoft Windows Kernel - 'UserCommitDesktopMemory' Use-After-Free (MS15-073)

Source: https://code.google.com/p/google-security-research/issues/detail?id=335 Freed memory is accessed after switching between two desktops of which one is closed. The testcase crashes with and without special pool enabled. The attached crash output is with special enabled on win32k.sys and...

Microsoft Windows Kernel - 'FlashWindowEx​' Memory Corruption (MS15-097)

Source: https://code.google.com/p/google-security-research/issues/detail?id=475 --- The attached PoC triggers a wild write on Win 7 32-bit with Special Pool enabled on win32k.sys. --- Proof of Concept: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38276.zip...

Microsoft Windows Kernel - 'win32k!vSolidFillRect' Buffer Overflow (MS15-061)

Source: https://code.google.com/p/google-security-research/issues/detail?id=313 The PoC triggers a pool buffer overflow in win32k!vSolidFillRect. When using Special Pool we get the crash immediately on the overwrite. Without Special Pool we often get a crash in the same function, but sometimes it...

VBox Satellite Express 2.3.17.3 - Arbitrary Write Vulnerability

A vulnerability within the ndvbs module allows an attacker to inject memory they control into an arbitrary location they define. This vulnerability can be used to overwrite function pointers in HalDispatchTable resulting in an elevation of privilege. suffers from code execution, and local file...

VBox Satellite Express 2.3.17.3 - Arbitrary Write

VBox Satellite Express 2.3.17.3 - Arbitrary Write KL-001-2015-005 : VBox Satellite Express Arbitrary Write Privilege Escalation Title: VBox Satellite Express Arbitrary Write Privilege Escalation Advisory ID: KL-001-2015-005 Publication Date: 2015.09.16 Publication URL:...

VBox Satellite Express Arbitrary Write Privilege Escalation

Vulnerability Details Affected Vendor: VBox Communications Affected Product: Satellite Express Protocol Affected Version: 2.3.17.3 Platform: Microsoft Windows XP SP3, Microsoft Windows 7 x86 CWE Classification: CWE-123: Write-what-where condition Impact: Arbitrary Code Execution Attack vector:...

Microsoft Windows - CreateObjectTask SettingsSyncDiagnostics Privilege Escalation

Microsoft Windows - CreateObjectTask SettingsSyncDiagnostics Privilege Escalation Source: https://code.google.com/p/google-security-research/issues/detail?id=437 Windows: CreateObjectTask SettingsSyncDiagnostics Elevation of Privilege Platform: Windows 8.1 Update I don’t believe it’s available in...

Microsoft Windows - NtUserGetClipboardAccessToken Token Leak (MS15-023)

Microsoft Windows - NtUserGetClipboardAccessToken Token Leak MS15-023 Source: https://code.google.com/p/google-security-research/issues/detail?id=461 Windows: NtUserGetClipboardAccessToken Token Leak Redux Platform: Windows 8.1 Update, Windows 10 Build 10130 Class: Security Bypass/EoP Summary: Th...

Microsoft Windows - CreateObjectTask TileUserBroker Privilege Escalation

Microsoft Windows - CreateObjectTask TileUserBroker Privilege Escalation Source: https://code.google.com/p/google-security-research/issues/detail?id=439 Windows: CreateObjectTask TileUserBroker Elevation of Privilege Platform: Windows 8.1 Update I don’t believe it’s available in earlier Windows...

MS15-100 Microsoft Windows Media Center MCL Code Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 "MS15-100 Microsoft Windows Media Center MCL Vulnerability", 'Description' = %q This module exploits a vulnerability in Windows Media...

Microsoft Windows CDD Font Parsing Kernel Memory Corruption

Talos Vulnerability Report TALOS-2015-0007 Microsoft Windows CDD Font Parsing Kernel Memory Corruption September 15, 2015 CVE Number CVE-2015-2506 Description An exploitable kernel memory corruption vulnerability exists in Microsoft Windows. A specially crafted font file can cause the Microsoft...

Microsoft Windows Media Center - Command Execution (MS15-100)

Title: MS15-100 Windows Media Center Command Execution Date : 11/09/2015 Author: R-73eN Software: Windows Media Center Tested : Windows 7 Ultimate CVE : 2015-2509 banner = "" banner += " \n" banner +=" | | / | / | / \ | | \n" banner +=" | || ' | | / | | / \ ' \ / \ | | \n" banner +=" | || | | | |...

Microsoft Windows Font Driver Elevation of Privilege Vulnerability (CNVD-2015-05948)

Microsoft Windows is a series of operating systems released by the American company Microsoft. An elevation of privilege vulnerability exists in Microsoft Windows when the Adobe Type Manager library does not properly handle objects in memory. An attacker could exploit this vulnerability to execut...