Metasploit modules that can be used to exploit Microsoft products

Order by Disclosure Date Module Name Module Type
  • Microsoft Windows DrawIconEx OOB Write Local Privilege Elevation
    Disclosure Date: 2020-02-20
    First seen: 2020-12-15
    exploit/windows/local/cve_2020_1054_drawiconex_lpe
    This module exploits CVE-2020-1054, an out of bounds write reachable from DrawIconEx within win32k. The out of bounds write can be used to overwrite the pvbits of a SURFOBJ. By utilizing this vulnerability to execute controlled writes to kernel memory, an attacker can gain arbitrary code execution as the SYSTEM user. This module has been tested against a fully updated Windows 7 x64 SP1. Offsets within the exploit code may need to be adjusted to work with other versions of Windows. Authors: - Netanel Ben-Simon - Yoav Alon - bee13oy - timwr
  • Exchange Control Panel ViewState Deserialization
    Disclosure Date: 2020-02-11
    First seen: 2020-04-26
    exploit/windows/http/exchange_ecp_viewstate
    This module exploits a .NET serialization vulnerability in the Exchange Control Panel (ECP) web page. The vulnerability is due to Microsoft Exchange Server not randomizing the keys on a per-installation basis resulting in them using the same validationKey and decryptionKey values. With knowledge of these values, an attacker can craft a special ViewState to cause an OS command to be executed by NT_AUTHORITY\SYSTEM using .NET deserialization. Authors: - Spencer McIntyre
  • Service Tracing Privilege Elevation Vulnerability
    Disclosure Date: 2020-02-11
    First seen: 2020-05-14
    exploit/windows/local/cve_2020_0668_service_tracing
    This module leverages a trusted file overwrite with a DLL hijacking vulnerability to gain SYSTEM-level access on vulnerable Windows 10 x64 targets. Authors: - itm4n - bwatters-r7
  • SQL Server Reporting Services (SSRS) ViewState Deserialization
    Disclosure Date: 2020-02-11
    First seen: 2020-04-26
    exploit/windows/http/ssrs_navcorrector_viewstate
    A vulnerability exists within Microsoft's SQL Server Reporting Services which can allow an attacker to craft an HTTP POST request with a serialized object to achieve remote code execution. The vulnerability is due to the fact that the serialized blob is not signed by the server. Authors: - Soroush Dalili - Spencer McIntyre
  • Microsoft Windows Uninitialized Variable Local Privilege Elevation
    Disclosure Date: 2019-12-10
    First seen: 2020-10-15
    exploit/windows/local/cve_2019_1458_wizardopium
    This module exploits CVE-2019-1458, an arbitrary pointer dereference vulnerability within win32k which occurs due to an uninitalized variable, which allows user mode attackers to write a limited amount of controlled data to an attacker controlled address in kernel memory. By utilizing this vulnerability to execute controlled writes to kernel memory, an attacker can gain arbitrary code execution as the SYSTEM user. This module has been tested against Windows 7 x64 SP1. Offsets within the exploit code may need to be adjusted to work with other versions of Windows. The exploit can only be triggered once against the target and can cause the target machine to reboot when the session is terminated. Authors: - piotrflorczyk - unamer - timwr
  • Microsoft UPnP Local Privilege Elevation Vulnerability
    Disclosure Date: 2019-11-12
    First seen: 2020-04-26
    exploit/windows/local/comahawk
    This exploit uses two vulnerabilities to execute a command as an elevated user. The first (CVE-2019-1405) uses the UPnP Device Host Service to elevate to NT AUTHORITY\LOCAL SERVICE The second (CVE-2019-1322) leverages the Update Orchestrator Service to elevate from NT AUTHORITY\LOCAL SERVICE to NT AUTHORITY\SYSTEM. Authors: - NCC Group - hoangprod - bwatters-r7
  • Microsoft UPnP Local Privilege Elevation Vulnerability
    Disclosure Date: 2019-11-12
    First seen: 2020-04-26
    exploit/windows/local/comahawk
    This exploit uses two vulnerabilities to execute a command as an elevated user. The first (CVE-2019-1405) uses the UPnP Device Host Service to elevate to NT AUTHORITY\LOCAL SERVICE The second (CVE-2019-1322) leverages the Update Orchestrator Service to elevate from NT AUTHORITY\LOCAL SERVICE to NT AUTHORITY\SYSTEM. Authors: - NCC Group - hoangprod - bwatters-r7
  • Microsoft Spooler Local Privilege Elevation Vulnerability
    Disclosure Date: 2019-11-04
    First seen: 2021-01-16
    exploit/windows/local/cve_2020_1337_printerdemon
    This exploit leverages a file write vulnerability in the print spooler service which will restart if stopped. Because the service cannot be stopped long enough to remove the dll, there is no way to remove the dll once it is loaded by the service. Essentially, on default settings, this module adds a permanent elevated backdoor. Authors: - Peleg Hadar - Tomer Bar - 404death - sailay1996 - bwatters-r7
  • Windows Update Orchestrator unchecked ScheduleWork call
    Disclosure Date: 2019-11-04
    First seen: 2020-09-25
    exploit/windows/local/cve_2020_1313_system_orchestrator
    This exploit uses access to the UniversalOrchestrator ScheduleWork API call which does not verify the caller's token before scheduling a job to be run as SYSTEM. You cannot schedule something in a given time, so the payload will execute as system sometime in the next 24 hours. Authors: - Imre Rad - bwatters-r7
  • Microsoft Spooler Local Privilege Elevation Vulnerability
    Disclosure Date: 2019-11-04
    First seen: 2020-09-17
    exploit/windows/local/cve_2020_1048_printerdemon
    This exploit leverages a file write vulnerability in the print spooler service which will restart if stopped. Because the service cannot be stopped long enough to remove the dll, there is no way to remove the dll once it is loaded by the service. Essentially, on default settings, this module adds a permanent elevated backdoor. Authors: - Yarden Shafir - Alex Ionescu - shubham0d - bwatters-r7
  • CVE-2019-0708 BlueKeep RDP Remote Windows Kernel Use After Free
    Disclosure Date: 2019-05-14
    First seen: 2020-04-26
    exploit/windows/rdp/cve_2019_0708_bluekeep_rce
    The RDP termdd.sys driver improperly handles binds to internal-only channel MS_T120, allowing a malformed Disconnect Provider Indication message to cause use-after-free. With a controllable data/size remote nonpaged pool spray, an indirect call gadget of the freed channel is used to achieve arbitrary code execution. Windows 7 SP1 and Windows Server 2008 R2 are the only currently supported targets. Windows 7 SP1 should be exploitable in its default configuration, assuming your target selection is correctly matched to the system's memory layout. HKLM\SYSTEM\CurrentControlSet\Control\TerminalServer\Winstations\RDP-Tcp\fDisableCam *needs* to be set to 0 for exploitation to succeed against Windows Server 2008 R2. This is a non-standard configuration for normal servers, and the target will crash if the aforementioned Registry key is not set! If the target is crashing regardless, you will likely need to determine the non-paged pool base in kernel memory and set it as the GROOMBASE option. Authors: - Sean Dillon <sean.dillon@risksense.com> - Ryan Hanson - OJ Reeves <oj@beyondbinary.io> - Brent Cook <bcook@rapid7.com>
  • CVE-2019-0708 BlueKeep Microsoft Remote Desktop RCE Check
    Disclosure Date: 2019-05-14
    First seen: 2020-04-26
    auxiliary/scanner/rdp/cve_2019_0708_bluekeep
    This module checks a range of hosts for the CVE-2019-0708 vulnerability by binding the MS_T120 channel outside of its normal slot and sending non-DoS packets which respond differently on patched and vulnerable hosts. It can optionally trigger the DoS vulnerability. Authors: - National Cyber Security Centre - JaGoTu - zerosum0x0 - Tom Sellers
  • AppXSvc Hard Link Privilege Escalation
    Disclosure Date: 2019-04-09
    First seen: 2020-04-26
    exploit/windows/local/appxsvc_hard_link_privesc
    There exists a privilege escalation vulnerability for Windows 10 builds prior to build 17763. Due to the AppXSvc's improper handling of hard links, a user can gain full privileges over a SYSTEM-owned file. The user can then utilize the new file to execute code as SYSTEM. This module employs a technique using the Diagnostics Hub Standard Collector Service (DiagHub) which was discovered by James Forshaw to load and execute a DLL as SYSTEM. Authors: - Nabeel Ahmed - James Forshaw - Shelby Pace
  • Microsoft Windows NtUserMNDragOver Local Privilege Elevation
    Disclosure Date: 2019-03-12
    First seen: 2020-05-14
    exploit/windows/local/ntusermndragover
    This module exploits a NULL pointer dereference vulnerability in MNGetpItemFromIndex(), which is reachable via a NtUserMNDragOver() system call. The NULL pointer dereference occurs because the xxxMNFindWindowFromPoint() function does not effectively check the validity of the tagPOPUPMENU objects it processes before passing them on to MNGetpItemFromIndex(), where the NULL pointer dereference will occur. This module has been tested against Windows 7 x86 SP0 and SP1. Offsets within the solution may need to be adjusted to work with other versions of Windows, such as Windows Server 2008.
  • Microsoft Exchange Privilege Escalation Exploit
    Disclosure Date: 2019-01-21
    First seen: 2020-04-26
    auxiliary/scanner/http/exchange_web_server_pushsubscription
    This module exploits a privilege escalation vulnerability found in Microsoft Exchange - CVE-2019-0724 Execution of the module will force Exchange to authenticate to an arbitrary URL over HTTP via the Exchange PushSubscription feature. This allows us to relay the NTLM authentication to a Domain Controller and authenticate with the privileges that Exchange is configured. The module is based on the work by @_dirkjan, Authors: - _dirkjan - Petros Koutroumpis
  • Windows NtUserSetWindowFNID Win32k User Callback
    Disclosure Date: 2018-10-09
    First seen: 2020-04-26
    exploit/windows/local/cve_2018_8453_win32k_priv_esc
    An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This module is tested against Windows 10 v1703 x86. Authors: - ze0r - Kaspersky Lab - Jacob Robles
  • Microsoft Windows ALPC Task Scheduler Local Privilege Elevation
    Disclosure Date: 2018-08-27
    First seen: 2020-04-26
    exploit/windows/local/alpc_taskscheduler
    On vulnerable versions of Windows the alpc endpoint method SchRpcSetSecurity implemented by the task scheduler service can be used to write arbitrary DACLs to `.job` files located in `c:\windows\tasks` because the scheduler does not use impersonation when checking this location. Since users can create files in the `c:\windows\tasks` folder, a hardlink can be created to a file the user has read access to. After creating a hardlink, the vulnerability can be triggered to set the DACL on the linked file. WARNING: The PrintConfig.dll (%windir%\system32\driverstor\filerepository\prnms003*) on the target host will be overwritten when the exploit runs. This module has been tested against Windows 10 Pro x64. Authors: - SandboxEscaper - bwatters-r7 - asoto-r7 - Jacob Robles
  • Windows SetImeInfoEx Win32k NULL Pointer Dereference
    Disclosure Date: 2018-05-09
    First seen: 2020-04-26
    exploit/windows/local/ms18_8120_win32k_privesc
    This module exploits elevation of privilege vulnerability that exists in Windows 7 and 2008 R2 when the Win32k component fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. This module is tested against windows 7 x86, windows 7 x64 and windows server 2008 R2 standard x64. Authors: - unamer - bigric3 - Anton Cherepanov - Dhiraj Mishra <dhiraj@notsosecure.com>
  • Microsoft Office CVE-2017-11882
    Disclosure Date: 2017-11-15
    First seen: 2020-04-26
    exploit/windows/fileformat/office_ms17_11882
    Module exploits a flaw in how the Equation Editor that allows an attacker to execute arbitrary code in RTF files without interaction. The vulnerability is caused by the Equation Editor, to which fails to properly handle OLE objects in memory. Authors: - mumbai - embedi
  • LNK Code Execution Vulnerability
    Disclosure Date: 2017-06-13
    First seen: 2020-04-26
    exploit/windows/fileformat/cve_2017_8464_lnk_rce
    This module exploits a vulnerability in the handling of Windows Shortcut files (.LNK) that contain a dynamic icon, loaded from a malicious DLL. This vulnerability is a variant of MS15-020 (CVE-2015-0096). The created LNK file is similar except an additional SpecialFolderDataBlock is included. The folder ID set in this SpecialFolderDataBlock is set to the Control Panel. This is enough to bypass the CPL whitelist. This bypass can be used to trick Windows into loading an arbitrary DLL file. If no PATH is specified, the module will use drive letters D through Z so the files may be placed in the root path of a drive such as a shared VM folder or USB drive. Authors: - Uncredited - Yorick Koster - Spencer McIntyre
221 metasploit modules found
1 2 3 4 5 6 7 8 9 10 11 12
Please note: Metasploit modules are only matched by CVE numbers. Visit metasploit web site for more details
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close