Metasploit modules that can be used to exploit Microsoft » Windows Vista

Order by Disclosure Date Module Name Module Type
  • CVE-2019-0708 BlueKeep RDP Remote Windows Kernel Use After Free
    Disclosure Date: 2019-05-14
    First seen: 2020-04-26
    exploit/windows/rdp/cve_2019_0708_bluekeep_rce
    The RDP termdd.sys driver improperly handles binds to internal-only channel MS_T120, allowing a malformed Disconnect Provider Indication message to cause use-after-free. With a controllable data/size remote nonpaged pool spray, an indirect call gadget of the freed channel is used to achieve arbitrary code execution. Windows 7 SP1 and Windows Server 2008 R2 are the only currently supported targets. Windows 7 SP1 should be exploitable in its default configuration, assuming your target selection is correctly matched to the system's memory layout. HKLM\SYSTEM\CurrentControlSet\Control\TerminalServer\Winstations\RDP-Tcp\fDisableCam *needs* to be set to 0 for exploitation to succeed against Windows Server 2008 R2. This is a non-standard configuration for normal servers, and the target will crash if the aforementioned Registry key is not set! If the target is crashing regardless, you will likely need to determine the non-paged pool base in kernel memory and set it as the GROOMBASE option. Authors: - Sean Dillon <sean.dillon@risksense.com> - Ryan Hanson - OJ Reeves <oj@beyondbinary.io> - Brent Cook <bcook@rapid7.com>
  • CVE-2019-0708 BlueKeep Microsoft Remote Desktop RCE Check
    Disclosure Date: 2019-05-14
    First seen: 2020-04-26
    auxiliary/scanner/rdp/cve_2019_0708_bluekeep
    This module checks a range of hosts for the CVE-2019-0708 vulnerability by binding the MS_T120 channel outside of its normal slot and sending non-DoS packets which respond differently on patched and vulnerable hosts. It can optionally trigger the DoS vulnerability. Authors: - National Cyber Security Centre - JaGoTu - zerosum0x0 - Tom Sellers
  • Microsoft Office Word Malicious Hta Execution
    Disclosure Date: 2017-04-14
    First seen: 2020-04-26
    exploit/windows/fileformat/office_word_hta
    This module creates a malicious RTF file that when opened in vulnerable versions of Microsoft Word will lead to code execution. The flaw exists in how a olelink object can make a http(s) request, and execute hta code in response. This bug was originally seen being exploited in the wild starting in Oct 2016. This module was created by reversing a public malware sample. Authors: - Haifei Li - ryHanson - wdormann - DidierStevens - vysec - Nixawk - sinn3r <sinn3r@metasploit.com>
  • NetBIOS Response "BadTunnel" Brute Force Spoof (NAT Tunnel)
    Disclosure Date: 2016-06-14
    First seen: 2020-04-26
    auxiliary/server/netbios_spoof_nat
    This module listens for a NetBIOS name request and then continuously spams NetBIOS responses to a target for given hostname, causing the target to cache a malicious address for this name. On high-speed networks, the PPSRATE value should be increased to speed up this attack. As an example, a value of around 30,000 is almost 100% successful when spoofing a response for a 'WPAD' lookup. Distant targets may require more time and lower rates for a successful attack. This module works when the target is behind a NAT gateway, since the stream of NetBIOS responses will keep the NAT mapping alive after the initial setup. To trigger the initial NetBIOS request to the Metasploit system, force the target to access a UNC link pointing to the same address (HTML, Office attachment, etc). This NAT-piercing issue was named the 'BadTunnel' vulnerability by the discoverer, Yu Yang (@tombkeeper). The Microsoft patches (MS16-063/MS16-077) impact the way that the proxy host (WPAD) host is identified, but do change the predictability of NetBIOS requests. Authors: - vvalien - hdm <x@hdm.io> - tombkeeper
  • NetBIOS Response "BadTunnel" Brute Force Spoof (NAT Tunnel)
    Disclosure Date: 2016-06-14
    First seen: 2020-04-26
    auxiliary/server/netbios_spoof_nat
    This module listens for a NetBIOS name request and then continuously spams NetBIOS responses to a target for given hostname, causing the target to cache a malicious address for this name. On high-speed networks, the PPSRATE value should be increased to speed up this attack. As an example, a value of around 30,000 is almost 100% successful when spoofing a response for a 'WPAD' lookup. Distant targets may require more time and lower rates for a successful attack. This module works when the target is behind a NAT gateway, since the stream of NetBIOS responses will keep the NAT mapping alive after the initial setup. To trigger the initial NetBIOS request to the Metasploit system, force the target to access a UNC link pointing to the same address (HTML, Office attachment, etc). This NAT-piercing issue was named the 'BadTunnel' vulnerability by the discoverer, Yu Yang (@tombkeeper). The Microsoft patches (MS16-063/MS16-077) impact the way that the proxy host (WPAD) host is identified, but do change the predictability of NetBIOS requests. Authors: - vvalien - hdm <x@hdm.io> - tombkeeper
  • MS16-032 Secondary Logon Handle Privilege Escalation
    Disclosure Date: 2016-03-21
    First seen: 2020-04-26
    exploit/windows/local/ms16_032_secondary_logon_handle_privesc
    This module exploits the lack of sanitization of standard handles in Windows' Secondary Logon Service. The vulnerability is known to affect versions of Windows 7-10 and 2k8-2k12 32 and 64 bit. This module will only work against those versions of Windows with Powershell 2.0 or later and systems with two or more CPU cores. Authors: - James Forshaw - b33f - khr0x40sh
  • MS16-016 mrxdav.sys WebDav Local Privilege Escalation
    Disclosure Date: 2016-02-09
    First seen: 2020-04-26
    exploit/windows/local/ms16_016_webdav
    This module exploits the vulnerability in mrxdav.sys described by MS16-016. The module will spawn a process on the target system and elevate its privileges to NT AUTHORITY\SYSTEM before executing the specified payload within the context of the elevated process. Authors: - Tamas Koczka - William Webb <william_webb@rapid7.com>
  • Windows Net-NTLMv2 Reflection DCOM/RPC
    Disclosure Date: 2016-01-16
    First seen: 2020-04-26
    exploit/windows/local/ms16_075_reflection
    Module utilizes the Net-NTLMv2 reflection between DCOM/RPC to achieve a SYSTEM handle for elevation of privilege. Currently the module does not spawn as SYSTEM, however once achieving a shell, one can easily use incognito to impersonate the token. Authors: - FoxGloveSec - breenmachine - Mumbai
  • Windows Net-NTLMv2 Reflection DCOM/RPC (Juicy)
    Disclosure Date: 2016-01-16
    First seen: 2020-04-26
    exploit/windows/local/ms16_075_reflection_juicy
    This module utilizes the Net-NTLMv2 reflection between DCOM/RPC to achieve a SYSTEM handle for elevation of privilege. It requires a CLSID string. Windows 10 after version 1803, (April 2018 update, build 17134) and all versions of Windows Server 2019 are not vulnerable. Authors: - FoxGloveSec - breenmachine - decoder - ohpe - phra - lupman
  • MS15-134 Microsoft Windows Media Center MCL Information Disclosure
    Disclosure Date: 2015-12-08
    First seen: 2020-04-26
    auxiliary/server/ms15_134_mcl_leak
    This module exploits a vulnerability found in Windows Media Center. It allows an MCL file to render itself as an HTML document in the local machine zone by Internet Explorer, which can be used to leak files on the target machine. Please be aware that if this exploit is used against a patched Windows, it can cause the computer to be very slow or unresponsive (100% CPU). It seems to be related to how the exploit uses the URL attribute in order to render itself as an HTML file. Authors: - Francisco Falcon - sinn3r <sinn3r@metasploit.com>
  • Office OLE Multiple DLL Side Loading Vulnerabilities
    Disclosure Date: 2015-12-08
    First seen: 2020-04-26
    exploit/windows/fileformat/office_ole_multiple_dll_hijack
    Multiple DLL side loading vulnerabilities were found in various COM components. These issues can be exploited by loading various these components as an embedded OLE object. When instantiating a vulnerable object Windows will try to load one or more DLLs from the current working directory. If an attacker convinces the victim to open a specially crafted (Office) document from a directory also containing the attacker's DLL file, it is possible to execute arbitrary code with the privileges of the target user. This can potentially result in the attacker taking complete control of the affected system. Authors: - Yorick Koster
  • Office OLE Multiple DLL Side Loading Vulnerabilities
    Disclosure Date: 2015-12-08
    First seen: 2020-04-26
    exploit/windows/fileformat/office_ole_multiple_dll_hijack
    Multiple DLL side loading vulnerabilities were found in various COM components. These issues can be exploited by loading various these components as an embedded OLE object. When instantiating a vulnerable object Windows will try to load one or more DLLs from the current working directory. If an attacker convinces the victim to open a specially crafted (Office) document from a directory also containing the attacker's DLL file, it is possible to execute arbitrary code with the privileges of the target user. This can potentially result in the attacker taking complete control of the affected system. Authors: - Yorick Koster
  • Office OLE Multiple DLL Side Loading Vulnerabilities
    Disclosure Date: 2015-12-08
    First seen: 2020-04-26
    exploit/windows/fileformat/office_ole_multiple_dll_hijack
    Multiple DLL side loading vulnerabilities were found in various COM components. These issues can be exploited by loading various these components as an embedded OLE object. When instantiating a vulnerable object Windows will try to load one or more DLLs from the current working directory. If an attacker convinces the victim to open a specially crafted (Office) document from a directory also containing the attacker's DLL file, it is possible to execute arbitrary code with the privileges of the target user. This can potentially result in the attacker taking complete control of the affected system. Authors: - Yorick Koster
  • Office OLE Multiple DLL Side Loading Vulnerabilities
    Disclosure Date: 2015-12-08
    First seen: 2020-04-26
    exploit/windows/fileformat/office_ole_multiple_dll_hijack
    Multiple DLL side loading vulnerabilities were found in various COM components. These issues can be exploited by loading various these components as an embedded OLE object. When instantiating a vulnerable object Windows will try to load one or more DLLs from the current working directory. If an attacker convinces the victim to open a specially crafted (Office) document from a directory also containing the attacker's DLL file, it is possible to execute arbitrary code with the privileges of the target user. This can potentially result in the attacker taking complete control of the affected system. Authors: - Yorick Koster
  • Windows WMI Receive Notification Exploit
    Disclosure Date: 2015-12-04
    First seen: 2020-04-26
    exploit/windows/local/ms16_014_wmi_recv_notif
    This module exploits an uninitialized stack variable in the WMI subsystem of ntoskrnl. This module has been tested on vulnerable builds of Windows 7 SP0 x64 and Windows 7 SP1 x64. Authors: - smmrootkit - de7ec7ed - de7ec7ed
  • MS15-100 Microsoft Windows Media Center MCL Vulnerability
    Disclosure Date: 2015-09-08
    First seen: 2020-04-26
    exploit/windows/fileformat/ms15_100_mcl_exe
    This module exploits a vulnerability in Windows Media Center. By supplying an UNC path in the *.mcl file, a remote file will be automatically downloaded, which can result in arbitrary code execution. Authors: - sinn3r <sinn3r@metasploit.com>
  • MS15-078 Microsoft Windows Font Driver Buffer Overflow
    Disclosure Date: 2015-07-11
    First seen: 2020-04-26
    exploit/windows/local/ms15_078_atmfd_bof
    This module exploits a pool based buffer overflow in the atmfd.dll driver when parsing a malformed font. The vulnerability was exploited by the hacking team and disclosed in the July data leak. This module has been tested successfully on vulnerable builds of Windows 8.1 x64. Authors: - Eugene Ching - Mateusz Jurczyk - Cedric Halbronn - juan vazquez <juan.vazquez@metasploit.com>
  • MS15-078 Microsoft Windows Font Driver Buffer Overflow
    Disclosure Date: 2015-07-11
    First seen: 2020-04-26
    exploit/windows/local/ms15_078_atmfd_bof
    This module exploits a pool based buffer overflow in the atmfd.dll driver when parsing a malformed font. The vulnerability was exploited by the hacking team and disclosed in the July data leak. This module has been tested successfully on vulnerable builds of Windows 8.1 x64. Authors: - Eugene Ching - Mateusz Jurczyk - Cedric Halbronn - juan vazquez <juan.vazquez@metasploit.com>
  • Windows ClientCopyImage Win32k Exploit
    Disclosure Date: 2015-05-12
    First seen: 2020-04-26
    exploit/windows/local/ms15_051_client_copy_image
    This module exploits improper object handling in the win32k.sys kernel mode driver. This module has been tested on vulnerable builds of Windows 7 x64 and x86, and Windows 2008 R2 SP1 x64. Authors: - Unknown - hfirefox - OJ Reeves - Spencer McIntyre
  • Microsoft Windows Shell LNK Code Execution
    Disclosure Date: 2015-03-10
    First seen: 2020-04-26
    exploit/windows/fileformat/ms15_020_shortcut_icon_dllloader
    This module exploits a vulnerability in the MS10-046 patch to abuse (again) the handling of Windows Shortcut files (.LNK) that contain an icon resource pointing to a malicious DLL. This module creates the required files to exploit the vulnerability. They must be uploaded to an UNC path accessible by the target. This module has been tested successfully on Windows 2003 SP2 with MS10-046 installed and Windows 2008 SP2 (32 bits) with MS14-027 installed. Authors: - Michael Heerklotz - juan vazquez <juan.vazquez@metasploit.com>
60 metasploit modules found
1 2 3
Please note: Metasploit modules are only matched by CVE numbers. Visit metasploit web site for more details
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close